A records archive must prevent object deletion during an enforceable retention period, including by privileged account administrators. Which mode is appropriate when this is the approved requirement?

1. Governance mode while granting every administrator bypass permission.
2. Only a bucket Name tag containing the word immutable.
3. S3 Object Lock compliance mode with the required retention period.
4. Only default server-side encryption.