Protecting S3 Data from Accidental Deletion

Determine appropriate data security controls.
Answer Correct answer: A, B — enable versioning so deleted objects retain recoverable versions, and enable MFA Delete so any delete requires a multi-factor authentication code.

A company has an Amazon S3 bucket that contains critical data. The company must protect the data from accidental deletion. Which combination of steps should a solutions architect take to meet these requirements? (Choose two.)

  1. Enable versioning on the S3 bucket. Correct Answer
  2. Enable MFA Delete on the S3 bucket. Correct Answer
  3. Create a bucket policy on the S3 bucket.
  4. Enable default encryption on the S3 bucket.
  5. Create a lifecycle policy for the objects in the S3 bucket.

Community Insight

The tested concept is the difference between preventing deletion outright and protecting against ACCIDENTAL deletion; the trap is choosing policy, encryption, or lifecycle controls that address confidentiality or cleanup rather than recovery from an unintended delete.

This AWS Solutions Architect (SAA-C03) question asks which two Amazon S3 controls together protect critical data from accidental deletion. Enabling versioning (A) preserves recoverable object versions, and MFA Delete (B) forces a multi-factor authentication step before a delete is committed, making A and B the correct combination.

Option C (bucket policy) is the most tempting wrong pick: learners argue you can deny s3:DeleteObject, but a bucket policy blocks all unauthorized deletes and does nothing for an authorized user who deletes the wrong object by mistake — exactly the accidental scenario posed. Options D and E fail outright because encryption protects confidentiality and lifecycle rules actually automate deletion.

Community Discussion (83 comments)

vicoalvin 👍 1 Selected: AB
I agree with AB because the questions says "Accidental deletions".
Clouddon 👍 1 Selected: AB
To protect critical data in S3 from accidental deletion, enable versioning and MFA Delete — the two most effective built-in AWS mechanisms for this purpose.
Mrigraj12 👍 1 Selected: AB
c: won't be able to delete anyhting d: doesn't change anything e: baseless
satyaammm 👍 1 Selected: AB
AB is the correct solution here as we need MFA delete for making the deletion process inevitable and also we need S3 bucket versioning for MFA delete.
MGKYAING 👍 1 Selected: AB
To protect critical data in an S3 bucket from accidental deletion, these two features provide robust safeguards: A. Enable versioning on the S3 bucket: Versioning allows the bucket to maintain multiple versions of an object. Even if an object is accidentally deleted, the previous version can be restored, ensuring data recovery. B. Enable MFA Delete on the S3 bucket: MFA Delete adds an additional layer of security by requiring multi-factor authentication for deletion operations. This prevents accidental or unauthorized deletions.
Chr1s_Mrg 👍 2 Selected: AB
To protect critical data in an Amazon S3 bucket from accidental deletion, a solutions architect should take the following steps: Enable versioning on the S3 bucket: This allows you to recover objects that are accidentally deleted or overwritten by keeping multiple versions of an object. Enable MFA Delete on the S3 bucket: This adds an extra layer of security by requiring multi-factor authentication (MFA) for delete operations, which helps prevent accidental or unauthorized deletions
PaulGa 👍 2 Selected: BD
Ans A,B - as per 'kwabsAA' 2 months ago "To protect data from accidental deletion, the correct answers are B and D. Versioning does not prevent accidental deletion; it only allows for recovery after the fact. Multi-Factor Authentication (MFA) helps prevent accidental deletion by requiring an additional confirmation step before deletion, making it deliberate rather than accidental. Option D, which involves encryption, ensures that only individuals with the encryption keys can read or manipulate the data, thus preventing unauthorized access and manipulation, including deletion."
zied007 👍 2 Selected: AB
encryption will not prevent accidental deletions
vicoalvin 👍 1
It can not be C because the question says "Accidental deletions" and It could refer about users who have all permission to manipulate S3 buckets.
kwabsAA 👍 3
To protect data from accidental deletion, the correct answers are B and D. Versioning does not prevent accidental deletion; it only allows for recovery after the fact. Multi-Factor Authentication (MFA) helps prevent accidental deletion by requiring an additional confirmation step before deletion, making it deliberate rather than accidental. Option D, which involves encryption, ensures that only individuals with the encryption keys can read or manipulate the data, thus preventing unauthorized access and manipulation, including deletion.
liams123 👍 2
but it could be C you could use 's3:deleteobject" permission without specific conditions or restricts only to authorized users. B does the same thing tho but B is mainly used to restrict unauthroized access not deletion. does anyone agree. I think it is A and C or A & B. A allows multiple versions of objects to be stored in the bucket. Even if an object is deleted, its previous versions remain intact and accessible. idk the questions weird i could see how it could be all of them except D & E
liams123 👍 2
you do realised B and D are only to stop unauthroized people from deleting it and if they did delete it would be on purpose to cause issues for a business. it says accidental id say A and C. idk the questions worded poorly dont trust half the answers on here
kwabsAA 👍 2
BD. For D, When you encrypt data, an unauthorized user (without the encryption key) cannot manipulate the data (ie. decryption, modifying, deletion).
liams123 👍 1
yea chatgpt said A and C it does make sense. Cause B is mainly used for unauthroized access not deletion. idk this website and certlibrary give some interesting answers makes it hard to know but some questions are difficult
mmrakib 👍 3 Selected: AB
AB will be the correct answer.
sidharthwader 👍 2
This could be done if we enable MFA delete on the bucket but in order to enable this bucket versioning must be done. Hence A and B would be the answer.
liams123 👍 7
but it could be C you could use 's3:deleteobject" permission without specific conditions or restricts only to authorized users. B does the same thing tho but B is mainly used to restrict unauthroized access not deletion. does anyone agree. I think it is A and C or A & B
Conster 👍 2
I am getting so confused about what answers I should study. The answers don't match here or in ChatGPT. Can anyone who just took the exam, and passed, point me in the right direction? TIA!
KRC96 👍 1
chatgpt will help you only if you gave correct prompt.
awsgeek75 👍 3 Selected: AB
B: MFA to put an extra step to verify deletion and stop from accidental deletion A: Versioning for recovery of objects that were deleted accidentally even with MFA Remember, the solution is not required to STOP from deletion. It just wants to STOP ACCIDENTAL deletion. CDE offer nothing related to accidental deletion
rt_7777 👍 1
Not sure why Answer is BD. I am trying to rationalize it. What I guess could be to address keyword "critical data" where set default encryption is just enhance the security of stored data but does not prevent from deletion. This will be have 2 options A, B for that. B is make sense to ensure user know what to delete on second layer. For option A, it just help you to audit and recovered what was accidentally deleted but does not "prevent" accidentally delete.
liams123 👍 1
but B is literally just meant for unauthorized action think about it you said ACCIDENTAL. unauthorized people would purposely delete it
fb4afde 👍 2 Selected: AB
Agree, s3 encryption does not prevent deletion
jjcode 👍 2
Yeah so.. encryption is enabled by default on S3, sooooo why is the answer D. --------- Starting today, Amazon Simple Storage Service (Amazon S3) encrypts all new objects by default. Now, S3 automatically applies server-side encryption (SSE-S3) for each new object, unless you specify a different encryption option.
Leo1688 👍 1
What's the correct answers？
liams123 👍 1
I would say A & C
Marco_St 👍 2 Selected: AB
MFA will add extra security of deleting item from s3 Versioning will make the data recovering
JustEugen 👍 2 Selected: AB
A) https://docs.aws.amazon.com/AmazonS3/latest/userguide/Versioning.html Versioning-enabled buckets can help you recover objects from accidental deletion or overwrite. For example, if you delete an object, Amazon S3 inserts a delete marker instead of removing the object permanently. The delete marker becomes the current object version. If you overwrite an object, it results in a new object version in the bucket. You can always restore the previous version B) https://docs.aws.amazon.com/AmazonS3/latest/userguide/MultiFactorAuthenticationDelete.html
xdkonorek2 👍 2 Selected: AC
A - object must be versioned, so multiple uploads won't cause data loss C - even though objects are version you have to specify deny policy for delete actions on bucket level to ensure they can't be deleted B - MFA helps with authentication, doesn't protect if user has permission to delete
liams123 👍 1
thought the same thing i think the questions is pre hard especially answers i went with AC
pentium75 👍 3
You're asked to prevent ACCIDENTAL deletion, not deletion.
Ruffyit 👍 1
https://aws.amazon.com/it/premiumsupport/knowledge-center/s3-audit-deleted-missing-objects/
AWSStudyBuddy 👍 1 Selected: AB
The two most effective steps a solutions architect can take to protect an Amazon S3 bucket from accidental deletion are: A. Enable versioning on the S3 bucket. B. Enable MFA Delete on the S3 bucket. Versioning keeps multiple versions of objects in the S3 bucket, even when they are overwritten or deleted. This allows you to recover objects that have been accidentally deleted. MFA Delete requires you to enter a one-time password from a multi-factor authentication (MFA) device before you can delete an object in the S3 bucket. This helps to prevent accidental deletions.
kagitala 👍 1
A+B is the correct answer
Tralfalgarlaw 👍 1 Selected: AB
Keyword: accidental deletions
tom_cruise 👍 1 Selected: A
D has nothing to do with deletion, not sure why it is even shown as correct answer?
pentium75 👍 2
$correctAnswer = (@("A","B","C","D") | Get-Random)
awashenko 👍 1 Selected: AB
Agree A and B. D doesn't do anything for deletion. E helps more with deleting objects. C is more about access control than deletion.
paniya93 👍 1
The correct solution is AB, as you can see here: https://aws.amazon.com/it/premiumsupport/knowledge-center/s3-audit-deleted-missing-objects/ It states the following: To prevent or mitigate future accidental deletions, consider the following features: Enable versioning to keep historical versions of an object. Enable Cross-Region Replication of objects. Enable MFA delete to require multi-factor authentication (MFA) when deleting an object version.
Guru4Cloud 👍 2 Selected: AB
Enable versioning on the S3 bucket. This will create a history of all object versions in the bucket, including deleted objects. This way, even if an object is deleted, it can be restored from a previous version. Enable MFA Delete on the S3 bucket. This will require users to enter their MFA token in addition to their password in order to delete objects from the bucket. This adds an extra layer of protection against accidental deletion.
TariqKipkemei 👍 1 Selected: AB
Enable versioning to ensure restore is possible, Enable two step verification of file deletion using MFA delete to ensure unwanted persons are unable to perform this action.
Bill__ 👍 4
AB is the correct answer. Admin please don't make us fail the exam😂
miki111 👍 2
Option AB is the right answer.
KFCR 👍 1 Selected: AB
To prevent or mitigate future accidental deletions, consider the following features: Enable versioning to keep historical versions of an object. Enable Cross-Region Replication of objects. Enable MFA delete to require multi-factor authentication (MFA) when deleting an object version.
cookieMr 👍 13 Selected: AB
Enabling versioning on S3 ensures multiple versions of object are stored in bucket. When object is updated or deleted, new version is created, preserving previous version. Enabling MFA Delete adds additional layer of protection by requiring MFA device to be present when attempting to delete objects. This helps prevent accidental or unauthorized deletions by requiring extra level of authentication. C. Creating a bucket policy on S3 is more focused on defining access control and permissions for bucket and its objects, rather than protecting against accidental deletion. D. Enabling default encryption on S3 ensures that any new objects uploaded to bucket are automatically encrypted. While encryption is important for data security, it does not directly address accidental deletion. E. Creating lifecycle policy for objects in S3 allows for automated management of objects based on predefined rules. While this can help with data retention and storage cost optimization, it does not directly protect against accidental deletion.
Bmarodi 👍 1 Selected: AB
options A & B meet these requirements, hence A and B are the right answers.
Chaudhry1997 👍 1 Selected: AB
The correct solution is AB
pbpally 👍 1
Admin out here trying to get people to fail lol. A and B, folks. If somehow this presents as a question needing only one answer, MFA dlete is your go to.
acuaws 👍 1 Selected: AB
Had this question on TD exam... A and B. Period.
darn 👍 1
A and B seems are the good ones to me but couldnt I create policy to block all deletes and allow Put/Get, etc.?
cheese929 👍 1 Selected: AB
A+B will solve the problem
piavik 👍 1 Selected: AB
Policies and encryption do not affect delete protection
linux_admin 👍 1 Selected: AB
A. Enable versioning on the S3 bucket. Versioning allows multiple versions of an object to be stored in the same bucket. When versioning is enabled, every object uploaded to the bucket is automatically assigned a unique version ID. This provides protection against accidental deletion or modification of objects. B. Enable MFA Delete on the S3 bucket. MFA Delete requires the use of a multi-factor authentication (MFA) device to permanently delete an object or suspend versioning on a bucket. This provides an additional layer of protection against accidental or malicious deletion of objects.
GalileoEC2 👍 1
There no need to add default S3 encryption this is alrady enabled Amazon S3 now applies server-side encryption with Amazon S3 managed keys (SSE-S3) as the base level of encryption for every bucket in Amazon S3. Starting January 5, 2023, all new object uploads to Amazon S3 are automatically encrypted at no additional cost and with no impact on performance. The automatic encryption status for S3 bucket default encryption configuration and for new object uploads is available in AWS CloudTrail logs, S3 Inventory, S3 Storage Lens, the Amazon S3 console, and as an additional Amazon S3 API response header in the AWS Command Line Interface and AWS SDKs
Sdraju 👍 1 Selected: AB
A & B together solve this problem
SilentMilli 👍 1 Selected: AB
Enabling versioning on the S3 bucket and enabling MFA Delete on the S3 bucket will help protect the data from accidental deletion. Versioning allows the company to store multiple versions of an object in the same bucket. When versioning is enabled, S3 automatically archives all versions of an object (including all writes and deletes) in the bucket. This means that if an object is accidentally deleted, it can be recovered by restoring an earlier version of the object. MFA Delete adds an extra layer of protection by requiring users to provide additional authentication (through an MFA device) before they can permanently delete an object version. This helps prevent accidental or malicious deletion of objects by requiring users to confirm their intent to delete. By using both versioning and MFA Delete, the company can protect the data in the S3 bucket from accidental deletion and provide a way to recover deleted objects if necessary.
etikalas 👍 1
As per white paper - "versioning" is one of the answer https://d0.awsstatic.com/whitepapers/protecting-s3-against-object-deletion.pdf
pazabal 👍 2 Selected: AB
A, versioning is a way to protect buckets from accidental deletions B, MFA is a way to protect bucket from accidental deletions
Buruguduystunstugudunstuy 👍 3 Selected: AB
CORRECT A. Enable versioning on the S3 bucket. B. Enable MFA Delete on the S3 bucket. Enabling versioning on an S3 bucket allows you to store multiple versions of an object in the same bucket. This means that you can recover an object that was accidentally deleted or overwritten. When versioning is enabled, deleted objects are not permanently deleted, but are instead marked as deleted and stored as a new version of the object. Enabling MFA (Multi-Factor Authentication) Delete on an S3 bucket adds an additional layer of security by requiring that you provide a valid MFA code before permanently deleting an object version. This can help prevent the accidental deletion of objects in the bucket.
Buruguduystunstugudunstuy 👍 3
WRONG Option C, creating a bucket policy, would not directly protect the data from accidental deletion. Option D, enabling default encryption, would help protect the data from unauthorized access but would not prevent accidental deletion. Option E, creating a lifecycle policy, can be used to automate the deletion of objects based on specified criteria, but would not prevent accidental deletion in this case.
career360guru 👍 1 Selected: AB
A and B
NikaCZ 👍 1 Selected: AB
Enable versioning on the S3 bucket. Most Voted Enable MFA Delete on the S3 bucket
NiceGuy1169 👍 1 Selected: AB
I would accept D if they would have mentioned "sensitive" but it is not... A & B is the answer
parku 👍 2 Selected: AB
Versioning + MFA Delete.
VJ_For_Azure_AWS 👍 2
A should not be an answer because you can delete version of files, whenever you delete file which has versions it will delete top version so basically it is allowing you to delete, you can keep deleting versions until you delete old file.
hpipit 👍 1 Selected: AB
A & B, THE CORRECT RESPONSE
hpipit 👍 1 Selected: AB
A and B, 100% CORRECT
Wpcorgan 👍 1
A and B
Solarch 👍 2
AB, Versioning keeps a copy and can be retrieved. MFA ensures you have proper authorization to delete an item.
ricenguyen208 👍 1
AB for sure =))))))))))))))
raffaello44 👍 2 Selected: AB
there is no relation between cncryption and delete protection. so D is discarded.
ukwafabian 👍 1 Selected: AB
There is no way it is not A and B.
airraid2010 👍 3 Selected: AB
https://docs.aws.amazon.com/AmazonS3/latest/userguide/Versioning.html You can use the S3 Versioning feature to preserve, retrieve, and restore every version of every object stored in your buckets https://docs.aws.amazon.com/AmazonS3/latest/userguide/MultiFactorAuthenticationDelete.html When working with S3 Versioning in Amazon S3 buckets, you can optionally add another layer of security by configuring a bucket to enable MFA (multi-factor authentication) delete.
Six_Fingered_Jose 👍 1 Selected: AB
obviously AB here
Jahangeer_17 👍 1
Correct answer is A & B.
Incognito013 👍 1
The answers are A and B
Rachness 👍 1 Selected: AB
AB-version and MFA to ensure.
rajendradba 👍 1 Selected: AB
https://aws.amazon.com/premiumsupport/knowledge-center/s3-audit-deleted-missing-objects/
tt79 👍 3
AB is correct.
Uhrien 👍 67 Selected: AB
The correct solution is AB, as you can see here: https://aws.amazon.com/it/premiumsupport/knowledge-center/s3-audit-deleted-missing-objects/ It states the following: To prevent or mitigate future accidental deletions, consider the following features: Enable versioning to keep historical versions of an object. Enable Cross-Region Replication of objects. Enable MFA delete to require multi-factor authentication (MFA) when deleting an object version.
tuloveu 👍 2 Selected: AB
A,B is my option.
Testtest123321 👍 3
I BELIVE A,C IS CORRECT!
CloudGuru99 👍 3
AB is the correct answer

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

Expert Analysis

Why the Answer Is Correct

Versioning is the foundational safeguard: when it is enabled, a delete request creates a delete marker rather than permanently removing the object, so any accidentally deleted item can be restored from a prior version. MFA Delete adds a second, deliberate step — a privileged delete requires a time-based code from a multi-factor device — which makes an unintended delete virtually impossible because it cannot be triggered by a single mistaken command. AWS explicitly pairs these two features as its recommended mitigation for lost or deleted objects, and together they satisfy the requirement without changing access patterns for legitimate users. Neither feature alone is complete: versioning recovers after the fact, while MFA Delete reduces the likelihood of the event occurring at all.

Why the Other Options Are Wrong

A bucket policy (C) governs who may perform which API actions; adding an s3:DeleteObject deny would also block legitimate, intentional cleanup and still would not stop an authenticated administrator who is permitted to delete from removing the wrong object, so it does not address accidental deletion. Default encryption (D) protects data at rest from unauthorized disclosure and has no bearing on whether an object can be deleted. A lifecycle policy (E) is actively counterproductive here, since it automates the expiration and permanent removal of objects after a defined period. As pentium75 summarized, "You're asked to prevent ACCIDENTAL deletion, not deletion."

Community Comment Notes

The community strongly converges on A and B, with Uhrien citing AWS Premium Support guidance that recommends versioning plus MFA delete, and awsgeek75 making the crucial distinction that the scenario requires stopping accidental deletion rather than stopping all deletion. liams123's doubt about choosing A and C is misplaced for the reason above: a bucket policy cannot distinguish an accident from intent. One dissenting vote for B and D on the grounds that "Versioning does not prevent accidental deletion; it only allows for recovery" misunderstands the requirement — recovery capability is exactly the protection AWS prescribes. The remaining comments from Buruguduystunstugudunstu and others confirm that C, D, and E offer no protection against accidental deletion.

Official Reference

Exam Strategy

On SAA-C03 data-protection questions, read whether the requirement is confidentiality, integrity, or recoverability before evaluating options. For 'accidental deletion' specifically, look for versioning paired with MFA Delete, and treat bucket policies, encryption, and lifecycle rules as distractors that target different goals.

Frequently Asked Questions

Why isn't a bucket policy denying s3:DeleteObject a valid answer here?

A bucket policy cannot distinguish an accidental delete from an intentional one; it would block all deletes by the denied principals and still protect nothing when an authorized user removes the wrong object by mistake.

Does enabling versioning alone fully prevent accidental deletion in S3?

No. Versioning preserves prior versions and lets you restore deleted objects, but a delete marker still hides the object. MFA Delete adds the deliberate confirmation step that reduces accidental deletes in the first place.

More SAA-C03 FAQ →

Related Analysis

A company uses AWS Organizations for its multi-account AWS s

A-Grade

A company has an automobile sales website that stores its li

S-Grade

A company runs a critical data analysis job each week before

A-Grade

Practice All SAA-C03 Questions

Access 120 questions with complete answers and detailed explanations.

View Full SAA-C03 Practice Test →

← Back to SAA-C03 Study Guide