The correct answers are Enable versioning on the bucket and Enable MFA Delete on the bucket.

Enable versioning on the bucket ensures that every version of a document is retained in Amazon S3. When a file is updated or deleted, previous versions remain available, allowing the company to recover accidentally overwritten or deleted documents. This is essential for auditability and rollback scenarios in a document management system.

Enable MFA Delete on the bucket adds an extra layer of protection against accidental or unauthorized deletions by requiring multi-factor authentication (MFA) for any delete operations of objects or versions. This provides strong protection for critical documents and helps enforce intentional, verified deletion processes.

Enable a read-only bucket ACL is incorrect because users must be able to modify and re-upload documents. A read-only ACL would prevent those actions.

Attach an IAM policy to the bucket is too vague and not directly tied to the specific needs in the question. IAM policies are essential for access control, but by themselves, they dont guarantee version retention or prevent accidental deletion unless specifically designed to do so, and IAM policies are typically attached to users or rolesnot buckets.

Encrypt the bucket using AWS KMS helps with data protection but is not relevant to preventing deletions or retaining multiple versions of a file. Encryption is a security best practice, but not part of the solution to the requirements described here.

Why this question matters: It evaluates your understanding of data durability and protection features within Amazon S3, especially versioning and deletion controls. These are critical for compliance and operational integrity in content storage systems.

Tip: For applications needing rollback or retention of all changes, enabling versioning is a must. When deletion control is needed, combine versioning with MFA Delete for maximum protection against data loss.

Full AWS Practitioner Certification Question