Regulations require backups that CANNOT be deleted or altered — even by administrators or compromised credentials — for 7 years. Which feature enforces this?
A.IAM policy denying delete
Admin credentials can modify IAM policies — not immutable.
B.AWS Backup Vault Lock in compliance mode
Correct. Compliance-mode WORM locks retention irreversibly.
C.S3 versioning
Versioning keeps old versions but objects remain deletable.
D.A restrictive bucket policy
Bucket policies are editable — the privileged-access hole remains.
Why this answer
Vault Lock in compliance mode applies WORM enforcement that not even the root user can remove — the mechanism designed for immutable-backup regulatory requirements. IAM/bucket policies can be changed by privileged admins; Vault Lock compliance mode cannot.
Correct answer: B · Last reviewed 2026-10-28
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Reliability & DR practice session.
Practice Reliability & DR