SOA-C02 Reliability and Business Continuity Practice Question
Exhibit
Refer to the exhibit.
CloudFormation template snippet:
Resources:
MyBucket:
Type: AWS::S3::Bucket
Properties:
BucketName: my-app-data-123
VersioningConfiguration:
Status: Enabled
LifecycleConfiguration:
Rules:
- Id: ExpireOldVersions
Status: Enabled
NoncurrentVersionExpirationInDays: 30
MyBucketPolicy:
Type: AWS::S3::BucketPolicy
Properties:
Bucket: !Ref MyBucket
PolicyDocument:
Version: 2012-10-17
Statement:
- Effect: Deny
Action: s3:DeleteBucket
Resource: !GetAtt MyBucket.Arn
Principal: "*"Refer to the exhibit. A SysOps administrator deployed the CloudFormation template. Which statement is true about data protection?
⚠ Common exam trap
Many exam-takers confuse S3 versioning's behavior with standard (non-versioned) buckets, assuming that 'deleted' means 'permanently removed' immediately, or they overlook that lifecycle policies only apply to noncurrent versions and do not prevent direct deletion of objects.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Deleted objects become noncurrent versions and are retained for 30 days.
The CloudFormation template likely configures an S3 bucket with versioning enabled and a lifecycle policy that transitions noncurrent versions to the 'ExpiredObjectDeleteMarker' or retains them for a specified period. By default, when versioning is enabled, deleted objects are not permanently removed but become noncurrent versions, and the lifecycle rule can be set to permanently delete these noncurrent versions after 30 days, as indicated in the template.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Deleted objects are immediately and permanently removed.
Why it's wrong here
With S3 Versioning enabled, a DELETE request does not physically erase the object; instead, S3 inserts a delete marker at the top of the version stack. The previous version becomes a noncurrent version and remains stored in the bucket, so the data is not immediately and permanently removed. Permanent removal would only occur if a version ID were specified in the DELETE request or if a lifecycle rule expired the noncurrent versions, which is not the immediate default behavior.
- ✗
The bucket cannot be deleted by anyone.
Why it's wrong here
The bucket policy shown denies the s3:DeleteBucket action to all principals, which would prevent most IAM users and roles from deleting the bucket. However, the AWS account root user retains full administrative permissions and is not bound by the bucket policy unless an SCP in AWS Organizations explicitly denies the action. Therefore, the statement that the bucket cannot be deleted by anyone is false because the root user or a user with explicit Allow for s3:DeleteBucket outside the bucket policy could still delete it.
- ✗
Objects cannot be deleted from the bucket.
Why it's wrong here
The bucket policy does not include s3:DeleteObject or s3:DeleteObjectVersion in its Deny statements; it only denies s3:DeleteBucket. As a result, any principal with an IAM policy that grants the necessary S3 delete permissions can legally delete objects from the bucket. The existence of the bucket policy does not inherently block object deletion, so saying objects cannot be deleted is incorrect.
- ✓
Deleted objects become noncurrent versions and are retained for 30 days.
Why this is correct
Because versioning is enabled on the bucket, deleting an object creates a delete marker and the object's current version transitions to noncurrent status, rather than being destroyed. The lifecycle configuration specifies that noncurrent versions expire 30 days after they become noncurrent, at which point S3 permanently removes them. Consequently, deleted objects are retained for exactly 30 days before being purged, matching the behavior described in this option.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This SOA-C02 question is part of Courseiva's 1,169-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SOA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SOA-C02 exam.