SOA-C03 Dumps With Exact Questions and Answers

Amazon S3 Object Lock in compliance mode provides immutable storage that prevents objects from being deleted or overwritten for a defined retention period. In compliance mode, even the root user cannot remove the retention or delete the object before the retention period expires. This makes it suitable for regulatory and strict data-protection requirements.

Because Object Lock must be enabled at bucket creation time, a new bucket is required. Setting a retention period of 3 months ensures that backups cannot be deleted before that time under any circumstances.

Option D (governance mode) allows privileged users to bypass retention, which violates the strict “must not be deleted” requirement. Option A relies on IAM policy changes, which are reversible and error-prone. Option C does not prevent deletion; versioning only retains previous versions if objects are deleted, but users can still delete versions unless additional controls are applied.

Therefore, S3 Object Lock in compliance mode is the correct and most secure solution.

Route 53 alias records are designed to map custom domain names to AWS resources such as ALBs, CloudFront distributions, and S3 website endpoints. Alias records behave like A records but point to AWS-managed resources instead of IP addresses.

Alias records are preferred over CNAME records because they can be used at the zone apex (example.com), do not incur additional DNS query charges, and automatically track changes to the underlying AWS resource.

A and AAAA records require fixed IP addresses, which ALBs do not provide. CNAME records cannot be used at the root domain.

Therefore, an alias record is the correct solution.

Per the AWS Cloud Operations and Security Automation documentation, Security Hub integrates with Amazon EventBridge to publish findings in real time. These events can trigger automated responses using AWS Lambda functions or AWS Systems Manager Automation runbooks.

In this scenario, the correct CloudOps approach is to configure the existing EventBridge rule to invoke a Lambda function that inspects the event payload, identifies the affected security group, and removes the offending inbound rule (e.g., port 21 open to 0.0.0.0/0).

This event-driven remediation provides continuous compliance and eliminates manual intervention. Cron jobs (Options B and C) contradict event-driven design and add operational overhead. Stopping instances (Option A) doesn’t address the root cause — the insecure security group.

Thus, Option D aligns with AWS best practices for automated security remediation through EventBridge and Lambda.