SCS-C02 Data Protection Practice Question
A company has an S3 bucket with versioning enabled. They want to ensure that all deleted objects are retained for 90 days before permanent deletion. Which S3 feature should be used?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
S3 Lifecycle policy with NoncurrentVersionExpiration
S3 Lifecycle policies can manage the expiration of noncurrent versions of objects. In this scenario, after an object is deleted, it becomes a noncurrent version. A lifecycle rule with NoncurrentVersionExpiration can be set to permanently delete those noncurrent versions after a specified number of days (e.g., 90). Option A is correct. S3 Object Lock protects objects from deletion but does not automatically delete them after a period. S3 Replication is for copying objects to another bucket. MFA Delete adds a multi-factor authentication requirement for deletion but does not set a retention period.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
S3 Lifecycle policy with NoncurrentVersionExpiration
Why this is correct
S3 Lifecycle policy with NoncurrentVersionExpiration defines how many days a previous version is retained after it becomes noncurrent. When a versioned object is deleted, S3 places a delete marker and the prior version is preserved as a noncurrent version; the lifecycle action permanently removes those noncurrent versions only after the specified number of days. This provides exactly the requested grace period for recovering deleted objects before they are eventually purged.
- ✗
S3 Replication
Why it's wrong here
S3 Replication asynchronously copies objects (and optionally delete markers) to a destination bucket, but it does not control how long the source bucket retains noncurrent versions. Replication is designed for geographic redundancy, latency reduction, or compliance copies, not for establishing a deletion grace period. Even with delete marker replication, both source and destination might immediately reflect a permanent deletion of the object in their current-version state, so it cannot act as a recovery window.
- ✗
S3 Object Lock
Why it's wrong here
S3 Object Lock enforces a write-once-read-many (WORM) model that prevents objects or versions from being deleted or overwritten for a fixed retention period using Governance or Compliance modes. It is applied before or at upload, and while it delays deletion for the entire locked duration, it does not automatically expire older versions after a user-initiated delete. In fact, an object under a legal hold or retention mode cannot be deleted at all until the lock expires, which is a different intent than 'retaining deleted objects'.
- ✗
MFA Delete
Why it's wrong here
MFA Delete is a versioning feature that requires a signed request with a multi-factor authentication code to permanently delete an object version, and also to suspend versioning. It adds a security barrier against accidental or malicious deletion, but it imposes no calendar-based retention period; once the MFA-authenticated deletion completes, the version is gone immediately. Therefore it cannot provide the stated 'retention after deletion' behavior.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 1,205 original SCS-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.