ISC2 Systems Security Certified Practitioner (SSCP) Practice Question

Amazon S3 Glacier Deep Archive is AWS's lowest-cost storage class for long-term retention. When combined with S3 Object Lock in compliance mode, each object is placed in a write-once, read-many (WORM) state that cannot be altered or deleted until the retention period expires, meeting immutability requirements. Server-side encryption with KMS keys ensures that data remains encrypted at rest. Standard retrieval from Glacier Deep Archive is typically available within 12 hours, which satisfies the audit retrieval window at minimal cost.

Storing data on encrypted EBS volumes, even if snapshots are taken, does not provide WORM protection and incurs higher ongoing storage costs. Keeping data in S3 Standard with versioning is far more expensive over seven years and versioning alone does not prevent tampering. AWS Backup warm storage offers longer retention, but it is priced higher than Glacier Deep Archive and does not inherently enforce object-level immutability. Therefore, the Glacier Deep Archive solution with Object Lock and KMS encryption is the only option that addresses all security, cost, and retrieval requirements.