S3 Object Lock Compliance Mode for Data Retention

SAA-C03 By islever Editorial Last updated

Determine appropriate data security controls.

Short answer

B Activate S3 Object Lock on the required objects and enable compliance mode.

Question

A company needs to implement a new data retention policy for regulatory compliance. As part of this policy, sensitive documents that are stored in an Amazon S3 bucket must be protected from deletion or modification for a fixed period of time. Which solution will meet these requirements?
  1. Activate S3 Object Lock on the required objects and enable governance mode.
  2. Activate S3 Object Lock on the required objects and enable compliance mode. Correct Answer
  3. Enable versioning on the S3 bucket. Set a lifecycle policy to delete the objects after a specified period.
  4. Configure an S3 Lifecycle policy to transition objects to S3 Glacier Flexible Retrieval for the retention duration.

Key Takeaways

The question tests the difference between governance and compliance modes in S3 Object Lock, with the trap being confusion over whether governance allows overrides (it does) or if versioning alone suffices (it doesn't prevent deletion).

S3 Object Lock in compliance mode is the correct solution for protecting S3 objects from deletion or modification during a fixed retention period to meet regulatory requirements. This feature ensures that even root users cannot alter locked objects.

Common mistake: Many learners choose Governance mode because it seems less restrictive, but governance allows authorized users to override locks, violating strict compliance requirements where no one can delete data early.

Expert Analysis

Why the Answer Is Correct

S3 Object Lock in compliance mode is designed specifically for scenarios where an organization must store data without the risk of alteration or deletion for a fixed time period. In compliance mode, no user, including the AWS account root user, can delete or overwrite the object until the retention period expires. This meets the regulatory requirement perfectly.

Why the Other Options Are Wrong

Governance mode (Option A) allows users with specific permissions to bypass the lock, which violates the 'protected from deletion' requirement for strict compliance. Versioning (Option C) prevents accidental deletion by keeping previous versions but does not strictly prohibit deletion of the current version or provide legal hold capabilities against malicious intent. Lifecycle policies (Option D) manage transitions and expirations but do not inherently protect objects from being deleted before their scheduled transition unless combined with Object Lock, which is not stated here.

Community Comment Notes

The community overwhelmingly agrees on Option B. Users highlight that compliance mode provides the most stringent protection, ensuring that even the root user cannot delete objects. Comments note that governance mode allows overrides, making it unsuitable for strict regulatory compliance where no modifications are allowed during the retention period.

Exam Strategy

When a question mentions 'regulatory compliance' and 'fixed period' with 'no deletion or modification', immediately think of S3 Object Lock. Distinguish between governance (allowable overrides) and compliance (absolute protection) based on whether the scenario implies any flexibility for administrators.

Frequently Asked Questions

Why isn't governance mode sufficient for regulatory compliance?

Governance mode allows users with specific IAM permissions to override the retention lock, meaning data could be deleted or modified before the period ends, which violates strict compliance rules.

Does S3 versioning protect against intentional deletion?

No. While versioning keeps previous versions, it does not prevent the deletion of the current version or provide legal holds. An attacker or admin can still delete the active object.

More SAA-C03 FAQ →

Community Votes

B
100%

100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 5 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 5

  1. swati1508 👍 3
    B compliance mode - no one can delete
  2. JA2018 👍 2 Answered B
    S3 Object Lock: - This feature allows you to lock objects in an S3 bucket, preventing them from being deleted or modified for a specified retention period. Compliance mode: - When enabled, S3 Object Lock in compliance mode provides the most stringent protection, ensuring that once an object is locked, even the account root user cannot delete or modify it, making it ideal for regulatory compliance scenarios where data must be preserved for a fixed period
  3. SmartGil2024 👍 1 Answered C
    The question says : : ''for a fixed period of time.", why not C ? Because the items can be deleted after this fix period of time./ with compliance mode - no one can delete, it is true, but we need to also pay attention to the fixed period of time.
  4. Sarayounisaldossary 👍 1 Answered B
    This is tricky between A and C but-- the question focused on compliance and FIXED Period of time... governance feature will let certain users to override B
  5. komorebi 👍 2 Answered B
    Answer is B

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

S3 Multi-Region Access Point and Replication Strategy

S-grade

Securing NLB with Security Groups for Minimal Change

S-grade

Most Cost-Effective 7-Year Retention for EBS Snapshots?

S-grade

AWS Forecast vs SageMaker for Time-Series Prediction

S-grade

Practice All SAA-C03 Questions

Access 120 questions with complete answers and detailed explanations.

View Full SAA-C03 Practice Test →

← Back to SAA-C03 Study Guide