An investment brokerage must keep client trade records for seven years in an S3 bucket with Object Lock turned on. No one at the firm, including administrators, may delete or overwrite a record during that period.
When a regulator opens an investigation, the legal team must freeze specific records until the case closes, without changing their retention dates. Once the case closes, the legal team must be able to lift the freeze on those records only.
Which solution meets these requirements?
Choose one answer.
AA. Turn on Object Lock in governance mode with a seven-year default retention. Grant the legal team the s3:BypassGovernanceRetention permission, and let them delete frozen records when the case closes.
BB. Turn on Object Lock in compliance mode with no default retention. Apply a legal hold to each record when the investigation starts, and remove the hold when the case closes.
CC. Use compliance mode with a seven-year default retention. Place legal holds on the affected records during the investigation, and allow only the legal team role to call s3:PutObjectLegalHold.
DD. Turn on versioning, and create a lifecycle rule that expires noncurrent versions after seven years. Add an IAM policy that denies s3:DeleteObject to all users, including administrators.
Show the answer and explanation
Answer: C
A. Wrong: Governance mode can be bypassed by any principal with s3:BypassGovernanceRetention, so administrators with that permission could delete records early. The requirement says no one, including administrators, may delete during retention.
B. Wrong: A legal hold blocks deletion while it is on, but without a default retention the records have no fixed period. Once the hold is removed, the records could be deleted, which breaks the seven-year rule.
C. Right: Correct. Compliance mode keeps every record locked for seven years, and a legal hold freezes selected records without changing their retention dates. Limiting PutObjectLegalHold to the legal team lets it lift holds without anyone shortening retention. Learn more: Locking objects with Object Lock (opens in a new tab)
D. Wrong: The IAM deny stops ordinary deletes, but an administrator who edits the policy can remove it, so the records are not immutable. Lifecycle expiration is an action that removes records, not a lock that prevents their removal.
Explanation
Compliance mode retention cannot be shortened or removed by anyone, including the root user. A legal hold is separate from retention, so it can freeze and release specific records without changing their dates. Governance mode, a hold without retention, and an IAM deny each leave a way to delete records early.
Want more on Data integrity and immutability (S3 Object Lock, Glacier Vault Lock, code signing)? The 5 full-length practice sets have 6 more Data integrity and immutability (S3 Object Lock, Glacier Vault Lock, code signing) questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →