SCS-C02 Data Protection Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Enable MFA Delete on the bucket.

  Why this is correct

  MFA Delete is a bucket-level feature that, when enabled alongside versioning, requires a valid multi-factor authentication code before S3 will permanently delete an object version or change the versioning state. Even if an IAM policy grants s3:DeleteObject or s3:DeleteObjectVersion, the API call fails unless the x-amz-mfa header contains a valid code, adding an independent security layer. This specifically prevents accidental or malicious deletion by requiring physical possession of an MFA device, making it a direct and powerful control for data protection.

• ✗

  Enable Cross-Region Replication.

  Why it's wrong here

  Cross-Region Replication (CRR) asynchronously copies objects from a source bucket to a destination bucket in a different AWS Region, which provides geographic redundancy and helps with disaster recovery. However, CRR does not by default replicate delete markers, and even when you enable replication of delete markers, it copies the marker rather than protecting the source object from deletion. Moreover, if a source object is permanently deleted, replication cannot restore it — the delete is not undone. Therefore, CRR does not prevent or recover from deletions and is not a data protection mechanism for the original object.

• ✗

  Enable default encryption.

  Why it's wrong here

  Default encryption automatically applies server-side encryption to all newly stored objects, using options such as SSE-S3, SSE-KMS, or SSE-C, thereby protecting data at rest from unauthorized read access. Encryption is a confidentiality measure; it does not affect any delete operations, lifecycle rules, or the permissions that govern who can remove objects. An actor with the s3:DeleteObject permission can still delete an object regardless of whether it is encrypted. Thus, default encryption has no bearing on preventing data loss due to deletion.

• ✓

  Enable versioning on the bucket.

  Why this is correct

  Enabling versioning on an S3 bucket preserves every version of an object, including overwrites and deletions; a standard delete operation places a delete marker instead of erasing the underlying data. This means previous versions remain retrievable, allowing an administrator to restore data after an accidental or intentional deletion, as long as the versions have not been permanently removed by a lifecycle policy or an explicit delete with the version ID. Versioning alone does not require MFA and therefore does not stop deletion attempts, but it provides a robust recovery mechanism, making it a valid part of a data protection strategy.

• ✗

  Set a lifecycle policy to expire objects.

  Why it's wrong here

  A lifecycle policy is a set of rules that automates actions such as transitioning objects to colder storage or permanently expiring them after a specified number of days. For example, an Expiration action will permanently delete objects or object versions, which directly removes backups and leads to data loss rather than preventing it. Because lifecycle policies are destructive by design, they work against the goal of protecting data against deletion unless that is the explicit intent. Consequently, this option is incorrect for preventing deletion.

Go deeper

Related to this question