ISC2 Systems Security Certified Practitioner (SSCP) Practice Question

Amazon S3 Object Lock lets you place objects in a write-once-read-many (WORM) state. Enabling Object Lock in Compliance mode means no user, not even the root account, can modify or delete protected objects until the retention period or legal hold is cleared, meeting strict litigation-hold and eDiscovery requirements. Adding a legal hold flag allows indefinite protection without setting a retention expiry. Merely suspending lifecycle policies or relying on versioning still allows privileged users to delete object versions, violating preservation obligations. Copying data on-premises and deleting it from S3 breaks chain-of-custody and complicates discovery. An IAM deny statement prevents deletes but cannot block overwrites and is reversible by an administrator, so it lacks the immutability assurances required for legal holds.