SOA-C02 Reliability and Business Continuity Practice Question
Which THREE measures help protect an S3 bucket from accidental data loss? (Choose 3)
⚠ Common exam trap
Candidates often confuse data protection features like encryption or lifecycle policies with data durability and accidental deletion prevention, leading them to select options that secure data but do not prevent loss from deletion.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable MFA Delete on the bucket.
Enabling MFA Delete on an S3 bucket requires multi-factor authentication for any delete operations, adding an extra layer of protection against accidental or unauthorized deletion of objects. This helps prevent data loss by ensuring that even if credentials are compromised, a delete action cannot be performed without the MFA token.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Enable MFA Delete on the bucket.
Why this is correct
MFA Delete requires a valid multi-factor authentication code to permanently delete an object version or suspend versioning, meaning an accidental delete request without the temporary code will be rejected. Because the MFA device is separate from AWS credentials, even a compromised access key cannot complete destructive actions like version removal. This adds a human/physical factor that effectively prevents costly accidental deletions and serves as a last line of defense for critical data.
- ✗
Create a lifecycle policy to transition objects to S3 Glacier.
Why it's wrong here
Transitioning objects to S3 Glacier changes only the storage class for cost savings; it does not establish any deletion safeguards, and the objects remain fully prunable via normal DELETE calls. In fact, if a lifecycle policy also includes an expiration action, objects moved to Glacier can be permanently removed automatically, creating a new accidental deletion risk. Thus, while Glacier is useful for archival, it contributes nothing to protecting against loss due to accidental user actions.
- ✗
Enable server-side encryption on the bucket.
Why it's wrong here
SSE encrypts objects at rest using keys managed by AWS or the customer, defending data confidentiality but leaving the object's lifecycle and deletion semantics completely unchanged. An accidental or malicious DELETE request will still immediately remove the encrypted object, and no encryption technique can compute or restore a deleted version. Therefore, enabling encryption is a security measure, not a data preservation measure, and cannot mitigate the risk of accidental destruction.
- ✓
Configure cross-region replication to a destination bucket.
Why this is correct
Cross-region replication asynchronously copies every permitted object version to a destination bucket in a different AWS Region, creating a geographically separate backup that is insulated from source-bucket failures and erroneous deletions. If the source object is accidentally overwritten or removed, administrators can retrieve the pristine copy from the replica bucket and restore it to the source, as long as versioning is enabled on both buckets. Because the copy is independent of the source, even a full source-bucket deletion event does not destroy the disaster-recovery copy.
- ✓
Enable versioning on the bucket.
Why this is correct
Versioning retains every historical version of every object, so a simple DELETE only creates a delete marker and the previous versions remain hidden but recoverable; an accidental PUT overwrite also preserves the prior version. Removing the delete marker or restoring an earlier version instantly rolls back the unintended change. This makes versioning the structural backbone that other safeguards like MFA Delete and replication rely on to ensure that no single accident can permanently erase data.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This SOA-C02 question is part of Courseiva's 1,169-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on SOA-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company wants to protect its data in Amazon S3 from accidental deletion. Which TWO methods should the SysOps administrator use? (Choose TWO.)
easy- A.Set up cross-Region replication.
- B.Enable S3 Transfer Acceleration.
- C.Configure S3 event notifications.
- ✓ D.Enable S3 Versioning on the bucket.
- ✓ E.Enable MFA Delete on the bucket.
Why D: Enabling S3 Versioning preserves all versions of an object, including overwrites and deletes. When versioning is enabled, a delete operation does not permanently remove the object; instead, it adds a delete marker, allowing the object to be restored by removing the marker. This directly protects against accidental deletion.
Variation 2. A company wants to ensure that its Amazon S3 data is resilient to an accidental deletion of an entire bucket. Which two actions should the company take? (Choose TWO.)
easy- ✓ A.Configure Cross-Region Replication to replicate objects to a bucket in another AWS Region.
- B.Configure a lifecycle policy to transition objects to S3 Glacier after 30 days.
- C.Enable MFA Delete on the bucket.
- ✓ D.Enable S3 Versioning on the bucket.
- E.Enable S3 Transfer Acceleration on the bucket.
Why A: Option A is correct because Cross-Region Replication (CRR) copies objects to a bucket in a different AWS Region, so if an entire bucket is accidentally deleted in the source Region, the replicated copies in the destination bucket remain intact and recoverable. Option D is correct because enabling S3 Versioning keeps all versions of every object, so even if objects are deleted (creating delete markers) or overwritten, prior versions can be restored, protecting against accidental deletion of object data. Option B is incorrect because a lifecycle transition to S3 Glacier only changes the storage class of objects and does not protect against deletion of the bucket or its contents. Option C is incorrect because MFA Delete adds an authentication requirement for permanently deleting versions or changing versioning state, but it does not by itself provide a separate copy of the data and does not protect against deletion of the entire bucket. Option E is incorrect because S3 Transfer Acceleration only speeds up uploads and downloads using AWS edge locations and provides no data-resilience or deletion-protection capability.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SOA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SOA-C02 exam.