ISC2 Systems Security Certified Practitioner (SSCP) Practice Question

Amazon S3 Object Lock places objects in a write-once-read-many (WORM) state. When the bucket is configured for Object Lock in Compliance mode with a 90-day retention period, each object version is protected from overwrites or deletions by any user-including the root account-until the timer expires. Because the objects can remain in the S3 Standard storage class (or another instant-access class), investigators can retrieve them immediately.

S3 Versioning alone cannot prevent an administrator from permanently deleting every version of an object, so it does not satisfy the immutability requirement. Storing evidence in an Amazon S3 Glacier vault with a 90-day Vault Lock policy would enforce retention but incurs retrieval times of several hours, failing the requirement for immediate access. Encrypting objects with AWS KMS and enabling server access logging adds confidentiality and auditability but does not stop modification or deletion. Therefore, enabling S3 Object Lock in Compliance mode is the only option that fulfills all stated constraints.