A company stores PDF documents in an Amazon S3 bucket and must legally retain all existing and new objects for 7 years. Which solution meets this requirement with the LEAST operational overhead?

The correct solution uses S3 Object Lock in compliance mode, which prevents any user, including the root account, from deleting or altering an object until the retention period expires. This meets the legal retention requirement. Setting the retention period to 7 years directly addresses the specified duration. S3 Batch Operations is the most efficient way to apply Object Lock settings to existing objects, minimizing operational overhead compared to recopying them. The other options are incorrect because: Enabling S3 Versioning and a Lifecycle rule with MFA delete does not prevent deletion by a malicious actor with appropriate credentials or a compromised root account, as MFA delete only protects against accidental deletion, not intentional circumvention of retention policies. Enabling S3 Object Lock with governance mode allows users with specific permissions to override or delete objects, which does not meet strict legal retention requirements. Also, recopying objects is less efficient than S3 Batch Operations. Recopying all existing objects is less efficient and involves more operational overhead than using S3 Batch Operations to apply Object Lock settings to existing objects in place.