CLF-C02 practice question: Storage (3 of 3)

Cloud Technology and Services A free question from our original CLF-C02 practice exam. Try it, then open the answer to see why each option is right or wrong.

A financial firm must keep trade records in Amazon S3 unchanged for seven years, as its regulator requires.

No one at the firm, including its AWS administrators, may be able to delete or overwrite a record during that period.

Which S3 feature meets this requirement?

Choose one answer.

A. S3 Versioning, which keeps earlier versions of each object
B. A bucket policy that denies delete requests to all users
C. S3 Object Lock in compliance mode, with a seven-year retention period
D. An S3 Lifecycle rule that moves records to Glacier Flexible Retrieval

Show the answer and explanation

Answer: C

A. Wrong: Versioning keeps every version of an object, so an overwrite does not destroy the earlier data. A user with permission can still delete a version, so the regulator's rule is not met.
B. Wrong: Anyone who can edit the bucket policy can remove the deny statement, so administrators could still delete records. A policy is not a lock that holds for the full period.
C. Right: In compliance mode, no user, including the root user, can overwrite or delete a protected object version, and the retention period cannot be shortened. That holds for the full seven years. Learn more: Locking objects with Object Lock (opens in a new tab)
D. Wrong: Lifecycle rules change the storage class and can expire objects on a schedule. They do not stop a user with permission from deleting or overwriting a record.

Explanation

S3 Object Lock in compliance mode is the only option that stops every user, including administrators and the root user, from changing a protected object until its retention date. Versioning and bucket policies can be undone by someone with permission, and lifecycle rules manage cost or expiry rather than protection.

CLF-C02 practice question: Storage (3 of 3)

Explanation

Study

Keep practicing