A company keeps backup files in an Amazon S3 bucket and requires that those backups cannot be removed for at least 90 days after creation. What should a SysOps administrator implement to satisfy this constraint?

The correct option is to enable S3 Object Lock in compliance mode with a 90-day retention period. Compliance mode prevents the object from being overwritten or deleted by any user, including the root user, until the retention period expires. This directly satisfies the requirement that backups cannot be removed for at least 90 days. Creating an IAM policy to block s3:DeleteObject is insufficient because the policy can be modified or removed, and it would be impractical to manage for individual objects after 90 days. Enabling S3 Versioning helps protect against accidental deletion but doesn't prevent intentional deletion by authorized users, nor does it enforce a minimum retention period in the same way Object Lock does. Using S3 Object Lock in governance mode allows certain authorized users (with s3:BypassGovernanceRetention permission) to delete objects even during the retention period, which does not meet the strict "cannot be removed" requirement.