SOA-C02 Reliability and Business Continuity Practice Question

A company wants to protect its data in Amazon S3 from accidental deletion. Which TWO methods should the SysOps administrator use? (Choose TWO.)

⚠ Common exam trap

Many candidates confuse replication (CRR) or notifications as protective measures, but they do not prevent deletion; only versioning and MFA Delete directly safeguard against accidental or malicious permanent data loss.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Enable S3 Versioning on the bucket.

Enabling S3 Versioning preserves all versions of an object, including overwrites and deletes. When versioning is enabled, a delete operation does not permanently remove the object; instead, it adds a delete marker, allowing the object to be restored by removing the marker. This directly protects against accidental deletion.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Set up cross-Region replication.
Why it's wrong here
Cross-Region Replication is an asynchronous background feature that copies objects to a destination bucket in another AWS Region, providing geographic redundancy and disaster recovery. However, it does not protect against accidental deletion; a user with s3:DeleteObject permission can still delete the source object, and delete markers are replicated as well, meaning deletion can propagate to the replica. Therefore, while it creates additional copies, it does not prevent or delay deletion behavior in the source bucket.
✗
Enable S3 Transfer Acceleration.
Why it's wrong here
S3 Transfer Acceleration uses AWS edge locations and Amazon's private network to speed up uploads over long distances, improving throughput for clients and applications. It only affects network layer performance during uploads; it has no involvement in bucket-level configuration, permissions, or object lifecycle. As a result, it neither blocks DeleteObject calls nor preserves version history, making it irrelevant to data protection from accidental deletion.
✗
Configure S3 event notifications.
Why it's wrong here
S3 event notifications deliver asynchronous notifications via SNS, SQS, or Lambda whenever specified events, such as s3:ObjectRemoved:* or s3:ObjectCreated:*, occur in a bucket. They act as an alerting or automation trigger, but they execute after the API call has already been made and cannot intercept or reject a delete request. Since notification does not impart any permission or retention capability, it cannot by itself protect data from accidental deletion.
✓
Enable S3 Versioning on the bucket.
Why this is correct
Enabling S3 Versioning makes the bucket store every object version, including all overwrites and deletes. When a delete request is made, S3 does not physically remove the object; instead, it inserts a null version delete marker, leaving all prior versions intact and recoverable at any time. This allows you to easily undo accidental deletions by removing the delete marker and restoring an older version, making it a fundamental protection mechanism.
✓
Enable MFA Delete on the bucket.
Why this is correct
MFA Delete is a bucket-level security feature that, when enabled with versioning, requires a valid multi-factor authentication code before an object version can be permanently deleted and before bucket versioning itself can be suspended or changed. Because standard deletes that only remove the latest version are still permitted and only create delete markers, MFA Delete specifically prevents permanent deletion of a specified version ID, guarding against malicious or accidental irreversible deletion. It does not require MFA for every delete, only for destructive operations on specific versions.

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

SOA-C02 Reliability and Business Continuity Practice Question

Why each option matters

Option-by-option breakdown

AWS S3 Storage Class Comparison

Related to this question