A regional hospital system backs up its electronic health record databases with AWS Backup. Last year an attacker with stolen administrator credentials deleted recovery points before the ransomware was discovered. The CISO wants backups to be immutable for at least 30 days, even to the account administrators.
The restore team needs recovery points to stay available for up to 35 days, and the vault must be in the same account as the databases so that restores run quickly. The change should not wait for a new account structure.
Which solution meets these requirements?
Choose one answer.
AA. Lock the backup vault in governance mode with a 30-day minimum and a 35-day maximum retention. Give only the backup administrators permission to remove the vault lock, so an attacker cannot remove it.
BB. Attach a service control policy to the member accounts that denies backup:DeleteRecoveryPoint for all principals. Exempt the backup service role, and manage recovery points from the organization management account.
CC. Copy every recovery point to a second vault in a separate account each night, without a vault lock. Keep the source vault at its default settings so that restores from the primary vault remain quick.
DD. Lock the backup vault in compliance mode with a 30-day minimum and 35-day maximum retention. After the grace time ends, no one, including the root user, can delete recovery points early.
Show the answer and explanation
Answer: D
A. Wrong: Governance mode lets any principal with the bypass permission delete recovery points, and an attacker with administrator credentials could hold that permission. The backups would not be immutable to administrators, as the CISO requires.
B. Wrong: The policy blocks deletes in member accounts, but it does not stop deletes from the management account. It also does not protect recovery points from a principal who edits the policy, so it does not provide immutability.
C. Wrong: A copy in another account protects against loss in the first account, but the second vault is not locked, so its recovery points can still be deleted. Restores would also run across accounts, which the restore team wants to avoid.
D. Right: Correct. Compliance mode prevents anyone from deleting recovery points or shortening their retention, and the 30 to 35 day range matches both the immutability and restore needs. The vault stays in the same account, so restores remain quick. Learn more: AWS Backup Vault Lock (opens in a new tab)
Explanation
AWS Backup Vault Lock in compliance mode makes recovery points immutable until their retention expires, even for administrators. Setting minimum and maximum retention keeps points in the 30 to 35 day window the team needs. Governance mode, an SCP, and an unlocked copy each leave a way to delete recovery points.
Want more on Secure backup and ransomware recovery (AWS Backup, Vault Lock, Data Lifecycle Manager)? The 5 full-length practice sets have 5 more Secure backup and ransomware recovery (AWS Backup, Vault Lock, Data Lifecycle Manager) questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →