AWS Certified Solutions Architect – Associate (SAA-C03) — Question 132

A company needs to save the results from a medical trial to an Amazon S3 repository. The repository must allow a few scientists to add new files and must restrict all other users to read-only access. No users can have the ability to modify or delete any files in the repository. The company must keep every file in the repository for a minimum of 1 year after its creation date.
Which solution will meet these requirements?

Answer options

• A. Use S3 Object Lock in governance mode with a legal hold of 1 year.
• B. Use S3 Object Lock in compliance mode with a retention period of 365 days.
• C. Use an IAM role to restrict all users from deleting or changing objects in the S3 bucket. Use an S3 bucket policy to only allow the IAM role.
• D. Configure the S3 bucket to invoke an AWS Lambda function every time an object is added. Configure the function to track the hash of the saved object so that modified objects can be marked accordingly.

Correct answer: B

Explanation

The correct answer is B because S3 Object Lock in compliance mode ensures that files cannot be deleted or modified for a specified retention period of 365 days, meeting the requirement to keep files for a minimum of 1 year. Option A is incorrect because governance mode does not guarantee that files cannot be deleted by users with sufficient permissions. Option C does not enforce the retention requirement, and option D introduces unnecessary complexity without addressing the retention and access requirements effectively.