Topic 1 Question 212

AWS Certified SysOps Administrator - Associate

Topic 1 Question 212
A company is storing backups in an Amazon S3 bucket. The backups must not be deleted for at least 3 months after the backups are created.

What should a SysOps administrator do to meet this requirement?
- Configure an IAM policy that denies the s3:DeleteObject action for all users. Three months after an object is written, remove the policy.
- Enable S3 Object Lock on a new S3 bucket in compliance mode. Place all backups in the new S3 bucket with a retention period of 3 months.
- Enable S3 Versioning on the existing S3 bucket. Configure S3 Lifecycle rules to protect the backups.
- Enable S3 Object Lock on a new S3 bucket in governance mode. Place all backups in the new S3 bucket with a retention period of 3 months.
ユーザの投票
コメント(4)
- 正解だと思う選択肢: B
  Answer is B, governance mode allows some users to delete/modify the data
  
  👍 3
  zolthar_z2023/01/03
- 正解だと思う選択肢: B
  B. Compliance mode is required for this situation. Comparison and reference below:
  
  https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lock-overview.html
  
  In governance mode, users can't overwrite or delete an object version or alter its lock settings unless they have special permissions. With governance mode, you protect objects against being deleted by most users, but you can still grant some users permission to alter the retention settings or delete the object if necessary. You can also use governance mode to test retention-period settings before creating a compliance-mode retention period.
  
  In compliance mode, a protected object version can't be overwritten or deleted by any user, including the root user in your AWS account. When an object is locked in compliance mode, its retention mode can't be changed, and its retention period can't be shortened. Compliance mode helps ensure that an object version can't be overwritten or deleted for the duration of the retention period.
  
  👍 2
  Domdom1202023/03/01
- B The S3 Object Lock feature in compliance mode can be used to enforce a retention period for objects in the bucket. This ensures that the backups are protected from deletion for at least 3 months after they are created, which meets the requirement. The retention period can be set at the bucket level, or at the object level.
  
  👍 1
  awsguru19982023/02/13
シャッフルモード

ユーザの投票

コメント(4)