ISC2 Systems Security Certified Practitioner (SSCP) Practice Question

Using Amazon S3 Object Lock in Compliance mode places every log object in a write-once, read-many (WORM) state; no one, including the root user, can delete or alter the object until the retention date passes. A lifecycle rule can still move the objects to a colder, less expensive storage class such as S3 Glacier Instant Retrieval after 30 days, reducing cost while leaving the WORM protection in place for the full 400-day period. Versioning alone cannot stop a privileged user from permanently deleting all versions, AWS Backup for S3 does not protect the original objects from deletion, and moving the data to EFS introduces higher cost and lacks WORM protection. Therefore, enabling Object Lock in Compliance mode with an appropriate retention period and adding a transition rule provides both immutability and cost efficiency.