SAP-C03 practice question: Backup governance and ransomware protection (AWS Backup, Object Lock)
Resilience, Migration, and Business Continuity A free question from our original SAP-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.
A streaming service backs up its media catalog and its subscriber database in several accounts. After a ransomware scare, the security team requires that backups stay unchangeable for 35 days, even by a compromised administrator in a member account, and that a copy of each backup sit in a separate account.
The backup team wants one policy that covers all the accounts, and it wants the protection to be enforced by the service itself rather than by a permission that an administrator could remove.
Which solution meets these requirements?
Choose one answer.
AA. Turn on versioning on the S3 buckets that hold the backups, and grant a deny-delete policy to the administrators' roles in each account.
BB. Use an AWS Organizations backup policy for one plan across all accounts, with vaults locked by Vault Lock in compliance mode for 35 days and a copy of each backup to a locked vault in a separate account.
CC. Create daily EBS snapshots in each account, and set a lifecycle rule to delete them after 35 days so that old backups never accumulate.
DD. Copy each backup to a second Region in the same account with a cross-Region copy rule in the backup plan, and rely on the separation between Regions to keep the copy safe from ransomware and accidental deletion.
Show the answer and explanation
Answer: B
A. Wrong: Versioning keeps old copies, but an administrator who can change bucket policies could remove the deny or the versions. The protection depends on a permission the administrator can edit.
B. Right: Correct. The backup policy applies one plan across the accounts, and Vault Lock in compliance mode is enforced by the service, so no administrator can delete or shorten the locked backups. The cross-account copy keeps a second copy the member accounts cannot remove.
C. Wrong: The lifecycle rule removes backups after 35 days, which is a deletion schedule rather than protection. Snapshots in the same accounts can also be deleted by a compromised administrator.
D. Wrong: A second Region in the same account is still controlled by the same administrators, so a compromised account can delete both copies. The option does not provide an independent copy.
Explanation
An Organizations backup policy gives one plan for all accounts, Vault Lock in compliance mode is enforced by the service, and a cross-account copy keeps an independent copy that member administrators cannot remove. Versioning with a deny policy, a deletion lifecycle and a same-account second Region all leave the protection under the administrators' control.
Want more on Backup governance and ransomware protection (AWS Backup, Object Lock)? The 5 full-length practice sets have 8 more Backup governance and ransomware protection (AWS Backup, Object Lock) questions, 375 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →