Get Your CertDEA-C01PlayCompete
‹ All DEA-C01 questions

DEA-C01 Practice Question 77: S3 Object Lock Compliance Mode

AWS Certified Data Engineer – Associate (DEA-C01) · Test 8 · question 7 of 10

Data Store Managementmedium

A regulation requires that financial records stored in an Amazon S3 bucket cannot be deleted or overwritten by anyone, including the AWS account root user, for seven years. Which configuration meets this requirement?

Select one answer
Show answer and explanation

Answer:

  • B. S3 Object Lock in compliance mode with a seven-year retention period

In compliance mode, *"a protected object version can't be overwritten or deleted by any user, including the root user in your AWS account"*, and its retention mode can't be changed nor its retention period shortened. AWS recommends it if *"you never want any user, including the root user in your AWS account, to be able to delete the objects during a pre-defined retention period"* (option B). Object Lock requires S3 Versioning to be enabled on the bucket.

- A is wrong because in governance mode, users with the s3:BypassGovernanceRetention permission can override or remove the retention settings, so it does not stop everyone. - C is wrong because a legal hold has no retention period and can be removed at any time by any user with the s3:PutObjectLegalHold permission. - D is wrong because a bucket policy can be edited or removed by an administrator, so it is not a WORM guarantee and does not meet the requirement.

Reference: Locking objects with Object Lock

Practice Test 8 ›

Study guides for DEA-C01

AWS Developer Associate exam guide: DVA-C02 to DVA-C03AWS Developer Associate exam: DVA-C02 ends 30 November 2026 and DVA-C03 starts 1 December. What changes, which to sit, format, price and study plan.
How AWS Certification Exams Work: Scoring and RenewalHow AWS certification exams work: levels, booking, question types, unscored questions, scaled scores, pass marks, validity and how recertification works.
What Is Amazon RDS? Multi-AZ, Read Replicas and BackupsWhat is Amazon RDS? Engines, Multi-AZ, read replicas, backups, RDS Proxy, Aurora and pricing explained, with the traps that AWS exams set around each one.
Microsoft Fabric certification: DP-700 vs DP-600Microsoft Fabric certification means two exams, DP-600 and DP-700. Their roles, skills, format, cost in India, and which one to take first.
Databricks Data Engineer Associate vs AWS DEA-C01Databricks Data Engineer Associate vs AWS Certified Data Engineer – Associate - format, cost, topics and which one to take for your job, as of 2026.
Which AWS certification should you get? 2026 roadmapWhich AWS certification to get first, by role and experience, with each exam's status in October 2026, what is changing, and prices in USD and INR.
What Is AWS Glue? Data Catalog, Crawlers and ETL JobsWhat is AWS Glue? The Data Catalog, crawlers, ETL jobs and DPUs, workflows, streaming, job bookmarks, Flex and Data Quality, plus the traps AWS exams set.