AWS Certified Security – Specialty — Question 163

A company needs to retain log data archives for several years to be compliant with regulations. The log data is no longer used, but it must be retained.
What is the MOST secure and cost-effective solution to meet these requirements?

Answer options

• A. Archive the data to Amazon S3 and apply a restrictive bucket policy to deny the s3:DeleteObject API.
• B. Archive the data to Amazon S3 Glacier and apply a Vault Lock policy.
• C. Archive the data to Amazon S3 and replicated it to a second bucket in a second AWS Region. Choose the S3 Standard-Infrequent Access (S3 Standard-IA) storage class and apply a restrictive bucket policy to deny the s3:DeleteObject API.
• D. Migrate the log data to a 16 TB Amazon Elastic Block Store (Amazon EBS) volume. Create a snapshot of the EBS volume.

Correct answer: B

Explanation

The correct answer is B because Amazon S3 Glacier is designed for long-term data archiving and offers lower storage costs along with the ability to enforce a Vault Lock policy that prevents deletion. Option A does not provide the same level of cost-effectiveness for long-term storage, while Option C introduces unnecessary complexity and costs with replication. Option D is not suitable for compliance because EBS volumes are not designed for long-term archival storage.