The correct answer is Ensure records are retained for required durations and guarded against unauthorized access.

This option is correct because retention policies formally define how long archived customer files and closed claim records must be kept to meet legal and regulatory obligations and because they require controls that prevent unauthorized modification or access. Retention policies also support auditability by requiring logging and immutable storage or legal holds so that records remain available and verifiable for the entire required period.

In an insurance context regulators and auditors expect firms to prove that records were neither destroyed prematurely nor altered while retained. A clear retention policy ties retention periods to regulatory requirements and specifies technical and administrative controls such as access controls, encryption, immutability features, and audit trails to guard against unauthorized access and tampering.

Cloud Storage lifecycle management is incorrect because lifecycle rules typically manage object transitions between storage tiers and automated deletions. Lifecycle management can be part of an archival strategy but by itself it does not guarantee regulatory retention durations or enforce immutability and access controls required to protect sensitive records.

Permit staff to modify retired records is incorrect because retired records must remain intact and verifiable for the retention period. Allowing staff to modify retired records would undermine data integrity and violate most compliance and evidentiary requirements.

Reduce the need for secure archival storage is incorrect because retention policies do not reduce the need for secure storage. If anything they increase the requirement to maintain secure, controlled archives for defined periods and to ensure those archives cannot be altered or accessed without authorization.

Full AWS Practitioner Certification Question