Exams / SCS-C03 / Study guide / Data integrity and immutability (S3 Object Lock, Glacier Vault Lock, code signing)
Data integrity and immutability (S3 Object Lock, Glacier Vault Lock, code signing): SCS-C03 study notes and practice questions
What to know about Data integrity and immutability (S3 Object Lock, Glacier Vault Lock, code signing) for the SCS-C03 exam, from the Data Protection domain (18% of the exam guide), then 1 free question to test it. Part of the SCS-C03 study guide.
These questions describe a rule such as “records must not be altered or deleted for seven years” or “only signed code may run,” then ask which control enforces immutability and which one proves the data is unchanged.
Immutability controls
S3 Object Lock requires versioning on the bucket. It stores objects in write-once-read-many form for a retention period. In governance mode, users with the bypass permission can remove the lock. In compliance mode, no one, including the root user, can shorten or remove the retention period before it ends.
Legal hold keeps one object locked until someone removes the hold. It has no end date and works independently of retention.
Object Lock can be set as a bucket default, so every new object gets the same retention.
S3 versioning keeps earlier versions when an object is overwritten or deleted. MFA delete adds a second factor for permanently deleting versions. Only the root user can enable it.
Glacier Vault Lock attaches a vault lock policy to a vault in the original, vault-based Amazon Glacier service. Once the policy is locked, it cannot be changed or removed. That service no longer accepts new customers, so a new archive uses the S3 Glacier storage classes with S3 Object Lock. The exam guide still names Vault Lock, so know how it works.
S3 checksums store and verify a checksum for each object, so you can show that a file arrived unchanged.
Code signing with AWS Signer creates signed artifacts. A Lambda code signing configuration rejects code that is not signed by an approved signing profile.
How to choose
Scenario wording
Pick
Records must not be deleted by anyone for a fixed period
S3 Object Lock, compliance mode
Administrators may delete in an emergency, with logging
S3 Object Lock, governance mode
Hold one object for litigation with no end date
Legal hold
Existing Glacier vault whose policy can never change once locked
Glacier Vault Lock
New archive that must never change
S3 Glacier storage class with Object Lock in compliance mode
Only signed code may run in Lambda
Code signing configuration with AWS Signer
Prove a file arrived unchanged
S3 checksums
Common traps
Governance mode for a compliance rule. Users with the bypass permission can delete in governance mode.
Object Lock on an unversioned bucket. Versioning must be on first.
Expecting lifecycle rules to delete locked objects. Expiration waits until the retention ends or the hold is removed.
Treating Vault Lock as reversible. A locked vault policy is permanent, so test the policy in the unlocked state first.
Relying on governance mode against a root-level attacker. The scenario then needs compliance mode.
An investment brokerage must keep client trade records for seven years in an S3 bucket with Object Lock turned on. No one at the firm, including administrators, may delete or overwrite a record during that period.
When a regulator opens an investigation, the legal team must freeze specific records until the case closes, without changing their retention dates. Once the case closes, the legal team must be able to lift the freeze on those records only.
Which solution meets these requirements?
Choose one answer.
AA. Turn on Object Lock in governance mode with a seven-year default retention. Grant the legal team the s3:BypassGovernanceRetention permission, and let them delete frozen records when the case closes.
BB. Turn on Object Lock in compliance mode with no default retention. Apply a legal hold to each record when the investigation starts, and remove the hold when the case closes.
CC. Use compliance mode with a seven-year default retention. Place legal holds on the affected records during the investigation, and allow only the legal team role to call s3:PutObjectLegalHold.
DD. Turn on versioning, and create a lifecycle rule that expires noncurrent versions after seven years. Add an IAM policy that denies s3:DeleteObject to all users, including administrators.
Show the answer and explanation
Answer: C
A. Wrong: Governance mode can be bypassed by any principal with s3:BypassGovernanceRetention, so administrators with that permission could delete records early. The requirement says no one, including administrators, may delete during retention.
B. Wrong: A legal hold blocks deletion while it is on, but without a default retention the records have no fixed period. Once the hold is removed, the records could be deleted, which breaks the seven-year rule.
C. Right: Correct. Compliance mode keeps every record locked for seven years, and a legal hold freezes selected records without changing their retention dates. Limiting PutObjectLegalHold to the legal team lets it lift holds without anyone shortening retention. Learn more: Locking objects with Object Lock (opens in a new tab)
D. Wrong: The IAM deny stops ordinary deletes, but an administrator who edits the policy can remove it, so the records are not immutable. Lifecycle expiration is an action that removes records, not a lock that prevents their removal.
Explanation
Compliance mode retention cannot be shortened or removed by anyone, including the root user. A legal hold is separate from retention, so it can freeze and release specific records without changing their dates. Governance mode, a hold without retention, and an IAM deny each leave a way to delete records early.
Want more on Data integrity and immutability (S3 Object Lock, Glacier Vault Lock, code signing)? The 5 full-length practice sets have 6 more Data integrity and immutability (S3 Object Lock, Glacier Vault Lock, code signing) questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →
Study Data integrity and immutability (S3 Object Lock, Glacier Vault Lock, code signing)