Exams / SAA-C03 / Centralised backup / Question 1
SAA-C03 practice question: Centralised backup
Design Resilient Architectures A free question from our original SAA-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.
A company runs workloads in 25 AWS accounts in AWS Organizations, using Amazon EBS volumes, Amazon RDS databases and Amazon DynamoDB tables. Auditors require one centrally managed backup policy for every account, a copy of each backup in a second AWS Region, and backups that nobody, including administrators in the management account, can delete or shorten before 35 days have passed. Which solution meets these requirements?
Choose one answer.
- AA. Create Amazon Data Lifecycle Manager policies in each account with cross-Region copy rules, and an SCP that denies deleting snapshots.
- BB. Deploy AWS Backup policies from the management account with a cross-Region copy rule, and an SCP that denies deleting recovery points.
- CC. Turn on RDS backup replication, DynamoDB point-in-time recovery and EBS snapshot schedules in each account, plus an SCP that denies deletes.
- DD. Deploy AWS Backup policies from the management account with a cross-Region copy rule, and lock the backup vaults in compliance mode.
Show the answer and explanation
Answer: D
- A. Wrong: Data Lifecycle Manager manages only EBS snapshots and EBS-backed AMIs, so it cannot back up the RDS databases or DynamoDB tables. It is also configured per account, and an SCP does not restrict users or roles in the management account. Learn more: How Amazon Data Lifecycle Manager works (opens in a new tab)
- B. Wrong: Organization backup policies and copy rules meet the central policy and second-Region needs. However, SCPs do not affect users or roles in the management account, and administrators there can edit or detach the SCP, so the backups are not truly undeletable. Learn more: Service control policies (SCPs) (opens in a new tab)
- C. Wrong: These native features protect each service separately, so there is no single central policy across the 25 accounts, and each must be set up and checked account by account. The SCP has the same weakness as before: it does not bind the management account. Learn more: Replicating automated backups to another AWS Region (opens in a new tab)
- D. Right: Correct. Backup policies in AWS Organizations apply the same backup plan to every member account, and copy actions place copies in a vault in another Region. After its grace time ends, a compliance-mode Vault Lock with a 35-day minimum retention cannot be changed or removed by any user or by AWS. DynamoDB copies across Regions need AWS Backup's advanced DynamoDB features turned on. Learn more: AWS Backup Vault Lock (opens in a new tab)
Explanation
AWS Backup covers EBS, RDS and DynamoDB in one service, Organizations backup policies give one central policy for all accounts, and copy rules add a second-Region copy. The deciding requirement is immutability against management-account administrators: SCPs never restrict the management account, but AWS Backup Vault Lock in compliance mode cannot be altered by anyone once its grace time ends.
Study
Keep practising
Answer questions with a score at the end, or practise just this topic with the explanation after each one. No sign-up needed.