Exam AWS Certified Security - Specialty SCS-C02 topic 1 question 52 discussion

To meet the requirement of preserving several petabytes of data for 7 years in a cost-effective manner while ensuring that the data cannot be changed or deleted, option C is the most suitable solution. Here's why: Creating a vault in Amazon S3 Glacier and implementing a Vault Lock policy ensures that the data is stored using a write-once-read-many (WORM) model, which prevents any changes or deletions during the specified retention period. S3 Glacier is designed for long-term storage of infrequently accessed data, making it a cost-effective choice for this use case. The Vault Lock policy will enforce compliance with regulatory requirements by ensuring that the data remains immutable for the entire retention period. This approach leverages the cost benefits of S3 Glacier for long-term storage while providing the necessary security and compliance features to meet the company's requirements.

For the folks voting for C with the link in the comment, it clearly says "This page is only for existing customers of the S3 Glacier service using Vaults and the original REST API from 2012."

C. Right here ! https://docs.aws.amazon.com/amazonglacier/latest/dev/getting-started-upload-archive.html

C. Petabytes of data takes a lot of storage, therefore require the cheapest storage: Glacier, if looking for a cost efficiency. The vault policy will keep it safe. D is not realistic. Uploading petabytes of data to a bucket would require a AWS Snowmobile

https://docs.aws.amazon.com/amazonglacier/latest/dev/vault-lock-policy.html

The data is already there, we just want to keep it for COMPLIANCE for SEVEN years. There's no need to place the date in S3 bucket then use lifecycle to move it to Glacier. Option C is correct.

Exam on 2023-12-18

https://docs.aws.amazon.com/amazonglacier/latest/dev/vault-lock-policy.html

Both A and C work here but C is the MOST cost-effective.

Question doesn't ask for a backup solution, so Glacier is not a good fir here.

Correction, answer C

The correct answer here is C. This option ticks all the boxes. Several petabytes of data + 7 years + Regulatory Compliance + MOST cost-effective solution. D is close but we don't S3 at all.

Answer A. Compliance mode will prevent anyone from changing or deleting the data including the root user. Requested by the company's compliance team. https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lock-overview.html