SOA-C03 practice question: AWS Backup and snapshots (1 of 2)

Reliability and Business Continuity A free question from our original SOA-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.

A regional bank uses AWS Backup to back up its core banking databases. A new regulation requires that recovery points be kept for seven years and that nobody, including administrators with full permissions and the account's root user, can delete them early or shorten their retention. The bank has tested its settings and is ready to make them permanent. What should a CloudOps engineer configure?

Choose one answer.

A. Apply AWS Backup Vault Lock in governance mode to the vault, with a minimum retention of seven years.
B. Apply Vault Lock in compliance mode with a seven-year minimum retention, and let the grace time end.
C. Attach a service control policy that denies backup:DeleteRecoveryPoint to every account in the bank's organization.
D. Copy the recovery points to an S3 bucket with S3 Object Lock in compliance mode and a seven-year retention period.

Show the answer and explanation

Answer: B

A. Wrong: Governance mode stops most users from deleting recovery points, but users with the right IAM permissions can still remove the lock. That does not meet the requirement that nobody can delete them. Learn more: AWS Backup Vault Lock (opens in a new tab)
B. Right: Correct. After the grace time ends, a compliance-mode lock cannot be changed or removed by any user, including the root user, or by AWS. Recovery points cannot be deleted before their retention ends. Learn more: AWS Backup Vault Lock (opens in a new tab)
C. Wrong: An SCP can be edited or detached by administrators of the management account, and it does not restrict the management account itself. It does not give the permanent guarantee the regulation asks for. Learn more: Service control policies (SCPs) (opens in a new tab)
D. Wrong: AWS Backup stores recovery points in backup vaults and does not export them to buckets you manage. Object Lock protects S3 objects, not AWS Backup recovery points. Learn more: Locking objects with Object Lock (opens in a new tab)

Explanation

AWS Backup Vault Lock enforces write-once-read-many protection for recovery points. Governance mode can be removed by sufficiently privileged users, while compliance mode becomes immutable after its grace time, even for the root user. SCPs and S3 Object Lock do not protect recovery points in the same way.

Study

AWS Backup Vault Lock

SOA-C03 practice question: AWS Backup and snapshots (1 of 2)

Explanation

Study

Keep practicing