S3 Object Lock Governance Mode and Lifecycle Policies for Data Protection
A company needs to protect sensitive data in Amazon S3 from accidental deletion or overwriting. The data must be retained for at least 7 years after creation. Which combination of S3 features should be used?
Quick Answer
The answer is to enable S3 Object Lock in Governance mode and configure a lifecycle policy to expire objects after 7 years. This combination works because Governance mode allows authorized users to temporarily adjust retention settings while preventing any user—including the root account—from deleting or overwriting the object until the retention period expires, and the lifecycle policy handles automatic deletion after the mandated 7-year retention window. On the AWS Certified Security Specialty SCS-C02 exam, this scenario tests your understanding of how Object Lock’s retention modes (Governance vs. Compliance) interact with lifecycle actions; a common trap is choosing only a bucket policy or versioning, which prevents deletion but not overwriting, or selecting Compliance mode, which locks settings so tightly that even the account root cannot modify them. Remember the memory tip: “Governance gives you wiggle room, Compliance locks the tomb.” For long-term data protection against both accidental deletion and overwriting, always pair Object Lock with a lifecycle expiration rule.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable S3 Object Lock in Governance mode and configure a lifecycle policy to expire objects after 7 years
S3 Object Lock in Governance mode prevents objects from being deleted or overwritten during the retention period, and a lifecycle policy can automatically expire objects after 7 years to meet the retention requirement. Option A is incorrect because Object Lock in Compliance mode also prevents deletion and overwriting, but without specifying a retention period, it does not enforce the 7-year retention; additionally, Compliance mode cannot be overridden, which may be too restrictive. Option B is incorrect because S3 Intelligent-Tiering and lifecycle policies manage storage costs and transitions, not protection against deletion or overwriting. Option C is incorrect because versioning and MFA Delete protect against accidental deletion and preserve overwritten versions, but do not guarantee a 7-year retention period; lifecycle policies would be needed to enforce it.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable S3 Versioning and enable S3 Object Lock in Compliance mode
Why it's wrong here
Object Lock in Compliance mode prevents both deletion and overwriting, but without a retention period it does not guarantee the 7-year retention requirement. Additionally, Compliance mode cannot be overridden, which may be too restrictive.
- ✗
Use S3 Intelligent-Tiering and lifecycle policies
Why it's wrong here
S3 Intelligent-Tiering and lifecycle policies manage storage classes and costs; they do not prevent accidental deletion or overwriting.
- ✗
Enable S3 Versioning and MFA Delete
Why it's wrong here
Versioning and MFA Delete protect against accidental deletion and preserve versions, but they do not enforce a specific retention period; without lifecycle policies, data may be retained indefinitely or deleted before 7 years.
- ✓
Enable S3 Object Lock in Governance mode and configure a lifecycle policy to expire objects after 7 years
Why this is correct
Object Lock in Governance mode prevents deletion and overwriting during the retention period, and a lifecycle policy can expire objects after exactly 7 years, satisfying the requirement.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every SCS-C02 question from scratch — 376 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on SCS-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company needs to protect data stored in S3 from accidental deletion by users. Which S3 feature should be used?
easy- A.S3 Lifecycle policies
- B.S3 MFA Delete
- ✓ C.S3 Versioning
- D.S3 Block Public Access
Why C: S3 Versioning allows retrieval of overwritten or deleted objects, protecting against accidental deletion. Option A is incorrect because Lifecycle policies manage object transitions and expiration, not deletion protection. Option B is incorrect because MFA Delete adds an extra layer of protection for deletion but is not the primary feature for recovering from accidental deletion; it requires versioning to be enabled. Option D is incorrect because Block Public Access prevents public access to buckets, not deletion.
Variation 2. A company is implementing a data protection strategy for Amazon S3. Which TWO actions should be taken to protect data from accidental deletion or overwrite?
medium- A.Enable cross-region replication
- ✓ B.Enable MFA Delete on the bucket
- C.Apply a bucket policy that denies s3:DeleteObject
- ✓ D.Enable S3 Versioning on the bucket
- E.Enable default encryption on the bucket
Why B: Options B and D are correct. Enable S3 Versioning to preserve previous versions of objects, and enable MFA Delete to require multi-factor authentication for destructive operations. Option A is wrong because cross-region replication does not protect against accidental deletion in the source bucket; it only copies objects to another region. Option C is wrong because a bucket policy that denies s3:DeleteObject alone does not prevent overwrites (which use s3:PutObject) and may not cover all deletion scenarios; MFA Delete and versioning are more comprehensive. Option E is wrong because default encryption only encrypts data at rest, it does not prevent deletion or overwrite.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.