A regional bank stores loan records in S3 that must remain unchangeable for seven years, then move to cheaper storage and expire safely. Auditors require WORM enforcement plus automated transitions without custom code. Which lifecycle and retention design should the architect implement to satisfy immutable long-term record keeping?
Select an answer to reveal the explanation.
Short Explanation
You'll keep your loan files sealed like they're in a vault for seven years, yet they'll still glide to cheaper storage on their own. That's why Compliance mode paired with Lifecycle rules gives you tamper-proof archiving without custom code.
Full Explanation
The correct approach creates the bucket with S3 Object Lock enabled, applies a Compliance mode retention period of seven years to enforce write-once-read-many protection even against root, and layers S3 Lifecycle policies to transition objects to S3 Glacier tiers and expire them after retention, satisfying immutability plus cost optimization without custom jobs. Enabling Versioning with MFA Delete fails by concept because versioning preserves history and MFA Delete adds deletion friction but neither provides regulatory WORM enforcement that blocks privileged overwrites during retention, while storing on EFS with Lifecycle Management fails because EFS lifecycle only optimizes file storage classes and AWS Backup retention lacks S3 Object Lock legal-hold semantics required for strict financial records. Using Cross-Region Replication with expiration fails because replication improves durability and availability but does not make objects immutable, allowing deletion or overwrite to propagate if versioning controls are insufficient. For the exam, remember only Object Lock Compliance mode meets non-erasable retention, and in practice verify bucket creation allowed Object Lock, test legal holds separately, and confirm Lifecycle does not attempt expiry before retention ends.