You are working as a SysOps administrator for a legal organization. All contractual documents need to be archived for 5 years without modifications. You are planning to store these documents in Amazon S3 Glacier with Vault lock. Initiate Vault Lock is initiated to add controls that will deny any user to make changes in these documents. Which of the following additional actions must be initiated to complete the Amazon S3 Glacier Vault lock policy?

Answer options:

A.Initiate Complete Vault Lock operation within 12 hours using customized Lock ID as per security guidelines.
B.Initiate Complete Vault Lock operation within 12 hours using Lock ID generated during Initiate Vault Lock.
C.Initiate Complete Vault Lock operation within 24 hours using customized Lock ID as per security guidelines.
D.Initiate Complete Vault Lock operation within 24 hours using Lock ID generated during Initiate Vault Lock.

 Correct Answer – D
A Vault lock policy can be used to lock the vault for any future changes. Attaching a Vault lock policy is a 2-step process. First, an Initiate Vault Lock is called to attach a vault lock policy to the vault & returns a unique lock ID. Post verification, a Complete Vault Lock must be initiated within 24 hours using lock ID generated from Initiate Vault Lock. If a Complete Vault is not initiated within 24 hours, the vault lock policy is removed.
Option B is incorrect as Complete Vault Operation can be initiated within 24 hours after Initiate Vault lock is created & not within 12 hours.
Options A & C are incorrect as Lock ID should match with that created during Initiate Vault Lock operations & cannot be set manually.
For more information on attaching a vault lock policy to Amazon Glacier vault, refer to the following URL-
https://docs.aws.amazon.com/amazonglacier/latest/dev/vault-lock-how-to-api.html