AWS Backup and snapshots: SOA-C03 study notes and practice questions
What to know about AWS Backup and snapshots for the SOA-C03 exam, from the Reliability and Business Continuity domain (22% of the exam guide), then 2 free questions to test it. Part of the SOA-C03 study guide.
Copy rules send recovery points to vaults in other Regions or accounts.
Cross-account copies require AWS Organizations: the management account turns on cross-account backup, and the destination vault’s access policy must allow the source account to copy in.
Organizations backup policies apply plans to all accounts centrally.
Backup Vault Lock:compliance mode makes retention and recovery points unchangeable by anyone after the grace period; governance mode can be removed by users with specific permissions.
Logically air-gapped vaults add isolation for recovery after an account compromise.
Restore testing runs scheduled test restores to prove backups work.
Backup Audit Manager reports on compliance with your backup policies.
Snapshots and other tools
EBS snapshots are incremental and stored in S3. Copy them to other Regions; share them with accounts (encrypted snapshots need a customer managed KMS key shared with the other account).
Amazon Data Lifecycle Manager automates EBS snapshot and EBS-backed AMI creation and deletion by tag.
RDS automated backups keep up to 35 days for point-in-time recovery; manual snapshots stay until you delete them.
Recycle Bin keeps deleted EBS snapshots and AMIs for a retention period so accidental deletions can be undone.
Common traps
Sharing a snapshot encrypted with the AWS managed key. Not possible; re-encrypt with a customer managed key.
Governance mode when “no one” may delete backups. That’s compliance mode.
Scripts with cron for snapshots. Use AWS Backup or Data Lifecycle Manager.
A regional bank uses AWS Backup to back up its core banking databases.
A new regulation requires that recovery points be kept for seven years and that nobody, including administrators with full permissions and the account's root user, can delete them early or shorten their retention.
The bank has tested its settings and is ready to make them permanent.
What should a CloudOps engineer configure?
Choose one answer.
AA. Apply AWS Backup Vault Lock in governance mode to the vault, with a minimum retention of seven years.
BB. Apply Vault Lock in compliance mode with a seven-year minimum retention, and let the grace time end.
CC. Attach a service control policy that denies backup:DeleteRecoveryPoint to every account in the bank's organization.
DD. Copy the recovery points to an S3 bucket with S3 Object Lock in compliance mode and a seven-year retention period.
Show the answer and explanation
Answer: B
A. Wrong: Governance mode stops most users from deleting recovery points, but users with the right IAM permissions can still remove the lock. That does not meet the requirement that nobody can delete them. Learn more: AWS Backup Vault Lock (opens in a new tab)
B. Right: Correct. After the grace time ends, a compliance-mode lock cannot be changed or removed by any user, including the root user, or by AWS. Recovery points cannot be deleted before their retention ends. Learn more: AWS Backup Vault Lock (opens in a new tab)
C. Wrong: An SCP can be edited or detached by administrators of the management account, and it does not restrict the management account itself. It does not give the permanent guarantee the regulation asks for. Learn more: Service control policies (SCPs) (opens in a new tab)
AWS Backup Vault Lock enforces write-once-read-many protection for recovery points. Governance mode can be removed by sufficiently privileged users, while compliance mode becomes immutable after its grace time, even for the root user. SCPs and S3 Object Lock do not protect recovery points in the same way.
A pet insurer's AWS Backup plan in its production account must also copy each nightly recovery point into a vault in a separate backup account in the same AWS Organization.
When the copy job runs, it fails with an access denied error. The production resources are encrypted with customer managed KMS keys that the backup account can use.
Which TWO actions should a CloudOps engineer take to make the copy succeed? (Choose two.)
Choose two answers.
AA. Turn on cross-account backup in the AWS Backup settings of the organization's management account.
BB. Share the destination vault with the production account by using AWS Resource Access Manager.
CC. Add an access policy to the destination vault that allows the production account to perform backup:CopyIntoBackupVault.
DD. Turn on S3 Cross-Region Replication from the production vault's bucket to a bucket in the backup account.
EE. Create an IAM user in the backup account and give its access keys to the AWS Backup service in the production account.
Cross-account copies in AWS Backup need the organization to allow them and the destination to accept them. The management account turns on cross-account backup, and the destination vault's access policy allows backup:CopyIntoBackupVault from the source account. Resources encrypted with customer managed keys also need key permissions for the destination, which this scenario already has.
Want more on AWS Backup and snapshots? The 5 full-length practice sets have 10 more AWS Backup and snapshots questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →