A pharmaceutical company must retain clinical trial records in S3 for seven years, prevent deletion by any user including admins, detect accidental overwrites, and prove file authenticity for FDA audits. Which data-at-rest control set should the architect implement to guarantee record integrity?

S3 Object Lock in Compliance mode makes objects immutable for a defined retention period so no user including root can delete or overwrite until expiry, versioning preserves prior versions and aids recovery from overwrites, and CloudTrail S3 data events plus checksum validation provide audit evidence of authenticity and access for regulators. Versioning with MFA Delete protects against accidental deletes and adds resilience but still allows privileged users to delete versions with MFA and does not enforce time-based immutability required for seven-year retention. Lifecycle expiration with SSE-KMS provides encryption and cleanup, not integrity enforcement, and expiration would actually delete records rather than preserve them. Glacier Vault Lock provides vault-level immutability but applies only to Glacier vault archives, not S3 object workflows, and checksums alone prove transfer integrity without retention enforcement. For the exam, Compliance mode equals no one can shorten retention while Governance mode allows privileged bypass, and in practice verify legal hold processes, retention durations, and KMS key policies alongside Object Lock.