easyMultiple ChoiceObjective-mapped
CCSP Practice Question: A startup provides a cloud-based document…
A startup provides a cloud-based document collaboration platform. They store user-uploaded documents in a cloud object storage bucket. Compliance with data privacy laws requires that when a user deletes an account, all their documents must be permanently deleted within 30 days. The current process uses object versioning and lifecycle policies to expire objects after 30 days. However, during a recent audit, it was discovered that deleted user documents were still accessible via the bucket's previous versions for months after the deletion. The security team needs to ensure that all traces of a user's data are removed immediately upon account deletion. Which solution should be implemented?
⚠ Common exam trap
ISC2 often tests the misconception that lifecycle policies automatically delete all object versions, when in fact they require separate rules for current and noncurrent versions, and candidates may overlook the need to explicitly target previous versions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use a lifecycle policy to permanently delete current and previous object versions immediately after the user deletion request.
Object versioning in cloud storage (e.g., AWS S3) retains both current and previous versions of objects. A lifecycle policy that immediately expires both current and noncurrent versions upon user deletion ensures that all copies of the data are permanently removed, satisfying the 30-day compliance requirement. Without explicitly targeting previous versions, the default lifecycle policy only deletes current versions, leaving older versions accessible indefinitely.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure bucket policies to deny read access to all objects after the user deletion date.
Why it's wrong here
Does not delete objects; they are still accessible if policy is modified.
- ✗
Change the bucket's default encryption to use customer-managed keys and delete the key after 30 days.
Why it's wrong here
Objects remain even if key is deleted; they could be recovered with another key.
- ✗
Enable MFA Delete on the bucket to require additional authentication for deletions.
Why it's wrong here
Does not ensure timely deletion; versions remain.
- ✓
Use a lifecycle policy to permanently delete current and previous object versions immediately after the user deletion request.
Why this is correct
Ensures immediate removal of all versions.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every CCSP question from scratch — 964 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.