Protecting S3 Data from Accidental Deletion

SAA-C03 By islever Editorial Last updated

Determine appropriate data security controls.

Short answer

AB Enable versioning so deleted objects retain recoverable versions, and enable MFA Delete so any delete requires a multi-factor authentication code.

Question

A company has an Amazon S3 bucket that contains critical data. The company must protect the data from accidental deletion.
Which combination of steps should a solutions architect take to meet these requirements? (Choose two.)
  1. Enable versioning on the S3 bucket. Correct Answer
  2. Enable MFA Delete on the S3 bucket. Correct Answer
  3. Create a bucket policy on the S3 bucket.
  4. Enable default encryption on the S3 bucket.
  5. Create a lifecycle policy for the objects in the S3 bucket.

Key Takeaways

The tested concept is the difference between preventing deletion outright and protecting against ACCIDENTAL deletion; the trap is choosing policy, encryption, or lifecycle controls that address confidentiality or cleanup rather than recovery from an unintended delete.

This AWS Solutions Architect (SAA-C03) question asks which two Amazon S3 controls together protect critical data from accidental deletion. Enabling versioning (A) preserves recoverable object versions, and MFA Delete (B) forces a multi-factor authentication step before a delete is committed, making A and B the correct combination.

Common mistake: Option C (bucket policy) is the most tempting wrong pick: learners argue you can deny s3:DeleteObject, but a bucket policy blocks all unauthorized deletes and does nothing for an authorized user who deletes the wrong object by mistake — exactly the accidental scenario posed. Options D and E fail outright because encryption protects confidentiality and lifecycle rules actually automate deletion.

Expert Analysis

Why the Answer Is Correct

Versioning is the foundational safeguard: when it is enabled, a delete request creates a delete marker rather than permanently removing the object, so any accidentally deleted item can be restored from a prior version. MFA Delete adds a second, deliberate step — a privileged delete requires a time-based code from a multi-factor device — which makes an unintended delete virtually impossible because it cannot be triggered by a single mistaken command. AWS explicitly pairs these two features as its recommended mitigation for lost or deleted objects, and together they satisfy the requirement without changing access patterns for legitimate users. Neither feature alone is complete: versioning recovers after the fact, while MFA Delete reduces the likelihood of the event occurring at all.

Why the Other Options Are Wrong

A bucket policy (C) governs who may perform which API actions; adding an s3:DeleteObject deny would also block legitimate, intentional cleanup and still would not stop an authenticated administrator who is permitted to delete from removing the wrong object, so it does not address accidental deletion. Default encryption (D) protects data at rest from unauthorized disclosure and has no bearing on whether an object can be deleted. A lifecycle policy (E) is actively counterproductive here, since it automates the expiration and permanent removal of objects after a defined period. As pentium75 summarized, "You're asked to prevent ACCIDENTAL deletion, not deletion."

Community Comment Notes

The community strongly converges on A and B, with Uhrien citing AWS Premium Support guidance that recommends versioning plus MFA delete, and awsgeek75 making the crucial distinction that the scenario requires stopping accidental deletion rather than stopping all deletion. liams123's doubt about choosing A and C is misplaced for the reason above: a bucket policy cannot distinguish an accident from intent. One dissenting vote for B and D on the grounds that "Versioning does not prevent accidental deletion; it only allows for recovery" misunderstands the requirement — recovery capability is exactly the protection AWS prescribes. The remaining comments from Buruguduystunstugudunstu and others confirm that C, D, and E offer no protection against accidental deletion.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

On SAA-C03 data-protection questions, read whether the requirement is confidentiality, integrity, or recoverability before evaluating options. For 'accidental deletion' specifically, look for versioning paired with MFA Delete, and treat bucket policies, encryption, and lifecycle rules as distractors that target different goals.

Frequently Asked Questions

Why isn't a bucket policy denying s3:DeleteObject a valid answer here?

A bucket policy cannot distinguish an accidental delete from an intentional one; it would block all deletes by the denied principals and still protect nothing when an authorized user removes the wrong object by mistake.

Does enabling versioning alone fully prevent accidental deletion in S3?

No. Versioning preserves prior versions and lets you restore deleted objects, but a delete marker still hides the object. MFA Delete adds the deliberate confirmation step that reduces accidental deletes in the first place.

More SAA-C03 FAQ →

Discussion 81 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 30 of 81

  1. cookieMr 👍 13
    Enabling versioning on S3 ensures multiple versions of object are stored in bucket. When object is updated or deleted, new version is created, preserving previous version. Enabling MFA Delete adds additional layer of protection by requiring MFA device to be present when attempting to delete objects. This helps prevent accidental or unauthorized deletions by requiring extra level of authentication. C. Creating a bucket policy on S3 is more focused on defining access control and permissions for bucket and its objects, rather than protecting against accidental deletion. D. Enabling default encryption on S3 ensures that any new objects uploaded to bucket are automatically encrypted. While encryption is important for data security, it does not directly address accidental deletion. E. Creating lifecycle policy for objects in S3 allows for automated management of objects based on predefined rules. While this can help with data retention and storage cost optimization, it does not directly protect against accidental deletion.
  2. liams123 👍 7
    but it could be C you could use 's3:deleteobject" permission without specific conditions or restricts only to authorized users. B does the same thing tho but B is mainly used to restrict unauthroized access not deletion. does anyone agree. I think it is A and C or A & B
  3. Bill__ 👍 4
    AB is the correct answer. Admin please don't make us fail the exam😂
  4. Buruguduystunstugudunstuy 👍 3
    CORRECT A. Enable versioning on the S3 bucket. B. Enable MFA Delete on the S3 bucket. Enabling versioning on an S3 bucket allows you to store multiple versions of an object in the same bucket. This means that you can recover an object that was accidentally deleted or overwritten. When versioning is enabled, deleted objects are not permanently deleted, but are instead marked as deleted and stored as a new version of the object. Enabling MFA (Multi-Factor Authentication) Delete on an S3 bucket adds an additional layer of security by requiring that you provide a valid MFA code before permanently deleting an object version. This can help prevent the accidental deletion of objects in the bucket.
  5. kwabsAA 👍 3
    To protect data from accidental deletion, the correct answers are B and D. Versioning does not prevent accidental deletion; it only allows for recovery after the fact. Multi-Factor Authentication (MFA) helps prevent accidental deletion by requiring an additional confirmation step before deletion, making it deliberate rather than accidental. Option D, which involves encryption, ensures that only individuals with the encryption keys can read or manipulate the data, thus preventing unauthorized access and manipulation, including deletion.
Show 25 more comments
  1. airraid2010 👍 3
    https://docs.aws.amazon.com/AmazonS3/latest/userguide/Versioning.html You can use the S3 Versioning feature to preserve, retrieve, and restore every version of every object stored in your buckets https://docs.aws.amazon.com/AmazonS3/latest/userguide/MultiFactorAuthenticationDelete.html When working with S3 Versioning in Amazon S3 buckets, you can optionally add another layer of security by configuring a bucket to enable MFA (multi-factor authentication) delete.
  2. Buruguduystunstugudunstuy 👍 3
    WRONG Option C, creating a bucket policy, would not directly protect the data from accidental deletion. Option D, enabling default encryption, would help protect the data from unauthorized access but would not prevent accidental deletion. Option E, creating a lifecycle policy, can be used to automate the deletion of objects based on specified criteria, but would not prevent accidental deletion in this case.
  3. awsgeek75 👍 3
    B: MFA to put an extra step to verify deletion and stop from accidental deletion A: Versioning for recovery of objects that were deleted accidentally even with MFA Remember, the solution is not required to STOP from deletion. It just wants to STOP ACCIDENTAL deletion. CDE offer nothing related to accidental deletion
  4. pentium75 👍 3
    You're asked to prevent ACCIDENTAL deletion, not deletion.
  5. mmrakib 👍 3
    AB will be the correct answer.
  6. Testtest123321 👍 3
    I BELIVE A,C IS CORRECT!
  7. CloudGuru99 👍 3
    AB is the correct answer
  8. tt79 👍 3
    AB is correct.
  9. PaulGa 👍 2
    Ans A,B - as per 'kwabsAA' 2 months ago "To protect data from accidental deletion, the correct answers are B and D. Versioning does not prevent accidental deletion; it only allows for recovery after the fact. Multi-Factor Authentication (MFA) helps prevent accidental deletion by requiring an additional confirmation step before deletion, making it deliberate rather than accidental. Option D, which involves encryption, ensures that only individuals with the encryption keys can read or manipulate the data, thus preventing unauthorized access and manipulation, including deletion."
  10. JustEugen 👍 2
    A) https://docs.aws.amazon.com/AmazonS3/latest/userguide/Versioning.html Versioning-enabled buckets can help you recover objects from accidental deletion or overwrite. For example, if you delete an object, Amazon S3 inserts a delete marker instead of removing the object permanently. The delete marker becomes the current object version. If you overwrite an object, it results in a new object version in the bucket. You can always restore the previous version B) https://docs.aws.amazon.com/AmazonS3/latest/userguide/MultiFactorAuthenticationDelete.html
  11. liams123 👍 2
    but it could be C you could use 's3:deleteobject" permission without specific conditions or restricts only to authorized users. B does the same thing tho but B is mainly used to restrict unauthroized access not deletion. does anyone agree. I think it is A and C or A & B. A allows multiple versions of objects to be stored in the bucket. Even if an object is deleted, its previous versions remain intact and accessible. idk the questions weird i could see how it could be all of them except D & E
  12. Chr1s_Mrg 👍 2
    To protect critical data in an Amazon S3 bucket from accidental deletion, a solutions architect should take the following steps: Enable versioning on the S3 bucket: This allows you to recover objects that are accidentally deleted or overwritten by keeping multiple versions of an object. Enable MFA Delete on the S3 bucket: This adds an extra layer of security by requiring multi-factor authentication (MFA) for delete operations, which helps prevent accidental or unauthorized deletions
  13. Guru4Cloud 👍 2
    Enable versioning on the S3 bucket. This will create a history of all object versions in the bucket, including deleted objects. This way, even if an object is deleted, it can be restored from a previous version. Enable MFA Delete on the S3 bucket. This will require users to enter their MFA token in addition to their password in order to delete objects from the bucket. This adds an extra layer of protection against accidental deletion.
  14. jjcode 👍 2
    Yeah so.. encryption is enabled by default on S3, sooooo why is the answer D. --------- Starting today, Amazon Simple Storage Service (Amazon S3) encrypts all new objects by default. Now, S3 automatically applies server-side encryption (SSE-S3) for each new object, unless you specify a different encryption option.
  15. xdkonorek2 👍 2
    A - object must be versioned, so multiple uploads won't cause data loss C - even though objects are version you have to specify deny policy for delete actions on bucket level to ensure they can't be deleted B - MFA helps with authentication, doesn't protect if user has permission to delete
  16. liams123 👍 2
    you do realised B and D are only to stop unauthroized people from deleting it and if they did delete it would be on purpose to cause issues for a business. it says accidental id say A and C. idk the questions worded poorly dont trust half the answers on here
  17. VJ_For_Azure_AWS 👍 2
    A should not be an answer because you can delete version of files, whenever you delete file which has versions it will delete top version so basically it is allowing you to delete, you can keep deleting versions until you delete old file.
  18. Conster 👍 2
    I am getting so confused about what answers I should study. The answers don't match here or in ChatGPT. Can anyone who just took the exam, and passed, point me in the right direction? TIA!
  19. sidharthwader 👍 2
    This could be done if we enable MFA delete on the bucket but in order to enable this bucket versioning must be done. Hence A and B would be the answer.
  20. kwabsAA 👍 2
    BD. For D, When you encrypt data, an unauthorized user (without the encryption key) cannot manipulate the data (ie. decryption, modifying, deletion).
  21. pazabal 👍 2
    A, versioning is a way to protect buckets from accidental deletions B, MFA is a way to protect bucket from accidental deletions
  22. Solarch 👍 2
    AB, Versioning keeps a copy and can be retrieved. MFA ensures you have proper authorization to delete an item.
  23. Marco_St 👍 2
    MFA will add extra security of deleting item from s3 Versioning will make the data recovering
  24. raffaello44 👍 2
    there is no relation between cncryption and delete protection. so D is discarded.
  25. pentium75 👍 2
    $correctAnswer = (@("A","B","C","D") | Get-Random)

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Scheduled scaling for a predictable morning EC2 traffic spike

S-grade

Improving RDS Performance with Provisioned IOPS SSD

S-grade

S3 Multi-Region Access Point and Replication Strategy

S-grade

Securing NLB with Security Groups for Minimal Change

S-grade

Practice All SAA-C03 Questions

Access 120 questions with complete answers and detailed explanations.

View Full SAA-C03 Practice Test →

← Back to SAA-C03 Study Guide