Exams / SCS-C03 / Study guide / Secure backup and ransomware recovery (AWS Backup, Vault Lock, Data Lifecycle Manager)
Secure backup and ransomware recovery (AWS Backup, Vault Lock, Data Lifecycle Manager): SCS-C03 study notes and practice questions
What to know about Secure backup and ransomware recovery (AWS Backup, Vault Lock, Data Lifecycle Manager) for the SCS-C03 exam, from the Data Protection domain (18% of the exam guide), then 1 free question to test it. Part of the SCS-C03 study guide.
These questions describe an attacker who has stolen administrator credentials, then ask which copy of the data survives and can be restored. The right answer almost always separates the backup from the account and permissions that run production.
Protection layers
AWS Backup Vault Lock sets retention rules on a vault. In compliance mode, no one can change the settings or delete recovery points before retention ends. A cooling-off period lets you undo the lock before it becomes permanent. In governance mode, authorized users can still change the settings.
Logically air-gapped vaults in AWS Backup hold copies that are isolated from the source account and protected by a separate access model, for recovery after a compromise.
Cross-account backup copies send recovery points to a dedicated backup account that a separate team controls, so production administrators cannot delete them.
EBS snapshot lock blocks deletion of snapshots for a retention period, in governance or compliance mode.
Data Lifecycle Manager creates and retains EBS snapshots on a schedule and can copy them to another account or Region. It schedules copies; it is not a locked vault.
S3 versioning with Object Lock keeps every version recoverable. Replication to a separate account or Region adds a second copy.
Keys: a backup encrypted with a key that an attacker disables or schedules for deletion is lost. Limit who can change key state, and keep a copy under a key in the backup account.
How to choose
Scenario wording
Pick
Backups must not be deleted, even by the account administrator
AWS Backup Vault Lock, compliance mode
Copy must be isolated from a compromised account
Logically air-gapped vault or cross-account copy
Keep EBS snapshots from being deleted for a period
EBS snapshot lock
Schedule EBS snapshots and copy them to another account
Data Lifecycle Manager
Restore any earlier version of files
S3 versioning with Object Lock
Attacker might disable the key that encrypts backups
Key policy that limits key changes, plus a copy under a key in the backup account
Common traps
Backups only in the production account. An attacker with administrator rights can delete them.
Governance mode described as ransomware-proof. Users with the bypass permission can still delete.
Locking a vault without testing. Compliance mode is permanent after the cooling-off period.
Snapshots with no copy elsewhere. A snapshot in the same account shares the same blast radius.
Forgetting the KMS key. Deleting or disabling it makes the backups unreadable, even if the copies still exist.
A regional hospital system backs up its electronic health record databases with AWS Backup. Last year an attacker with stolen administrator credentials deleted recovery points before the ransomware was discovered. The CISO wants backups to be immutable for at least 30 days, even to the account administrators.
The restore team needs recovery points to stay available for up to 35 days, and the vault must be in the same account as the databases so that restores run quickly. The change should not wait for a new account structure.
Which solution meets these requirements?
Choose one answer.
AA. Lock the backup vault in governance mode with a 30-day minimum and a 35-day maximum retention. Give only the backup administrators permission to remove the vault lock, so an attacker cannot remove it.
BB. Attach a service control policy to the member accounts that denies backup:DeleteRecoveryPoint for all principals. Exempt the backup service role, and manage recovery points from the organization management account.
CC. Copy every recovery point to a second vault in a separate account each night, without a vault lock. Keep the source vault at its default settings so that restores from the primary vault remain quick.
DD. Lock the backup vault in compliance mode with a 30-day minimum and 35-day maximum retention. After the grace time ends, no one, including the root user, can delete recovery points early.
Show the answer and explanation
Answer: D
A. Wrong: Governance mode lets any principal with the bypass permission delete recovery points, and an attacker with administrator credentials could hold that permission. The backups would not be immutable to administrators, as the CISO requires.
B. Wrong: The policy blocks deletes in member accounts, but it does not stop deletes from the management account. It also does not protect recovery points from a principal who edits the policy, so it does not provide immutability.
C. Wrong: A copy in another account protects against loss in the first account, but the second vault is not locked, so its recovery points can still be deleted. Restores would also run across accounts, which the restore team wants to avoid.
D. Right: Correct. Compliance mode prevents anyone from deleting recovery points or shortening their retention, and the 30 to 35 day range matches both the immutability and restore needs. The vault stays in the same account, so restores remain quick. Learn more: AWS Backup Vault Lock (opens in a new tab)
Explanation
AWS Backup Vault Lock in compliance mode makes recovery points immutable until their retention expires, even for administrators. Setting minimum and maximum retention keeps points in the 30 to 35 day window the team needs. Governance mode, an SCP, and an unlocked copy each leave a way to delete recovery points.
Want more on Secure backup and ransomware recovery (AWS Backup, Vault Lock, Data Lifecycle Manager)? The 5 full-length practice sets have 5 more Secure backup and ransomware recovery (AWS Backup, Vault Lock, Data Lifecycle Manager) questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →
Study Secure backup and ransomware recovery (AWS Backup, Vault Lock, Data Lifecycle Manager)