SAP-C02 Q417 · Security

Question

A company has an application that stores data in a single Amazon S3 bucket. The company must keep all data for 1 year. The company’s security team is concerned that an attacker could gain access to the AWS account through leaked long-term credentials. Which solution will ensure that existing and future objects in the S3 bucket are protected?

Accepted Answer

This question has a critical threat model: **an attacker gains full access to the primary AWS account via leaked long-term credentials**. This means any protection mechanism within the same account can potentially be bypassed by the attacker.

**Answer A addresses every requirement:**

1. **Separate AWS account**: Creates a completely isolated security boundary. Even if the primary account is fully compromised, the attacker cannot access the new account. This is the **blast radius containment** principle.

2. **S3 Object Lock (Compliance mode implied by default retention)**: Once objects are written with Object Lock in Compliance mode, **nobody — not even the root user — can delete or overwrite them** until the retention period expires. This is the strongest immutability guarantee AWS offe

📖 Explanation

✅ Correct Answer

❌ Wrong Answers

📘 Key Concepts

🏗️ Architecture

⚙️ Operations

💰 Cost

🔒 Security

🎯 Exam Tips