Exams / SAP-C03 / Study guide / Backup governance and ransomware protection (AWS Backup, Object Lock)
Backup governance and ransomware protection (AWS Backup, Object Lock): SAP-C03 study notes and practice questions
What to know about Backup governance and ransomware protection (AWS Backup, Object Lock) for the SAP-C03 exam, from the Resilience, Migration, and Business Continuity domain (15% of the exam guide), then 1 free question to test it. Part of the SAP-C03 study guide.
SAP-C03 backup questions describe a company with many accounts, inconsistent backups and a fear of ransomware or an insider deleting data. You design central governance and immutability.
Central governance
AWS Backup with AWS Organizations: enable cross-account management, register a delegated administrator account, and attach backup policies to OUs. The policies create backup plans (schedule, retention, lifecycle, copy rules) in every member account and select resources by tag.
Cross-account and cross-Region copy rules send recovery points to a vault in a separate, locked-down backup account, ideally in another Region, so a compromised workload account can’t delete them.
Backup Audit Manager frameworks and controls report whether resources are backed up and retained as required, for auditors.
Restore testing restores recovery points on a schedule and validates them, proving that backups are usable.
SCPs can stop anyone in member accounts from deleting vaults, changing backup plans or disabling AWS Backup.
Immutability options
Feature
Protects
Key facts
Backup Vault Lock, compliance mode
Recovery points in a vault
After the grace time, nobody, including the root user or AWS, can delete recovery points before retention ends or change the lock
Backup Vault Lock, governance mode
Recovery points in a vault
Users with specific IAM permissions can remove the lock; good for testing
Logically air-gapped vault
Recovery points isolated from the source account
Locked by default in compliance mode; shared to a recovery account through AWS RAM so you can restore even if the source account is compromised
S3 Object Lock
Object versions
WORM; compliance mode (nobody can delete or shorten), governance mode (special permission overrides), legal holds with no end date; needs versioning
EBS snapshot lock
Individual EBS snapshots
Governance or compliance mode; compliance mode has a cooling-off period before it becomes permanent
Accidental deletion
S3 Versioning plus MFA delete or lifecycle rules for noncurrent versions; Replication keeps copies (it doesn’t replicate deletes of versions).
Recycle Bin retention rules recover deleted EBS snapshots and EBS-backed AMIs for a set period.
DynamoDB deletion protection and PITR; RDS deletion protection and final snapshots.
CloudFormation stack policies and DeletionPolicy: Retain/Snapshot stop updates from wiping data.
Ransomware recovery
Keep immutable, isolated copies; detect with GuardDuty Malware Protection (including for AWS Backup recovery points) and alarms; recover to a known-clean point in time, using Elastic Disaster Recovery point-in-time recovery for servers or older locked recovery points for data.
How to choose
Scenario wording
Pick
“Enforce backups in every account by tag”
AWS Backup policies from Organizations with a delegated admin
“Even administrators must not delete backups for 7 years”
Backup Vault Lock in compliance mode
“Restore even if the whole production account is compromised”
Logically air-gapped vault shared to a recovery account
“WORM storage for financial records in S3”
S3 Object Lock compliance mode
“Recover accidentally deleted EBS snapshots”
Recycle Bin
Common traps
Governance mode when the requirement says no one can delete.
Backups in the same account as the workload only.
Replication as protection from ransomware; encrypted or deleted data replicates too.
A streaming service backs up its media catalog and its subscriber database in several accounts. After a ransomware scare, the security team requires that backups stay unchangeable for 35 days, even by a compromised administrator in a member account, and that a copy of each backup sit in a separate account.
The backup team wants one policy that covers all the accounts, and it wants the protection to be enforced by the service itself rather than by a permission that an administrator could remove.
Which solution meets these requirements?
Choose one answer.
AA. Turn on versioning on the S3 buckets that hold the backups, and grant a deny-delete policy to the administrators' roles in each account.
BB. Use an AWS Organizations backup policy for one plan across all accounts, with vaults locked by Vault Lock in compliance mode for 35 days and a copy of each backup to a locked vault in a separate account.
CC. Create daily EBS snapshots in each account, and set a lifecycle rule to delete them after 35 days so that old backups never accumulate.
DD. Copy each backup to a second Region in the same account with a cross-Region copy rule in the backup plan, and rely on the separation between Regions to keep the copy safe from ransomware and accidental deletion.
Show the answer and explanation
Answer: B
A. Wrong: Versioning keeps old copies, but an administrator who can change bucket policies could remove the deny or the versions. The protection depends on a permission the administrator can edit.
B. Right: Correct. The backup policy applies one plan across the accounts, and Vault Lock in compliance mode is enforced by the service, so no administrator can delete or shorten the locked backups. The cross-account copy keeps a second copy the member accounts cannot remove.
C. Wrong: The lifecycle rule removes backups after 35 days, which is a deletion schedule rather than protection. Snapshots in the same accounts can also be deleted by a compromised administrator.
D. Wrong: A second Region in the same account is still controlled by the same administrators, so a compromised account can delete both copies. The option does not provide an independent copy.
Explanation
An Organizations backup policy gives one plan for all accounts, Vault Lock in compliance mode is enforced by the service, and a cross-account copy keeps an independent copy that member administrators cannot remove. Versioning with a deny policy, a deletion lifecycle and a same-account second Region all leave the protection under the administrators' control.
Want more on Backup governance and ransomware protection (AWS Backup, Object Lock)? The 5 full-length practice sets have 8 more Backup governance and ransomware protection (AWS Backup, Object Lock) questions, 375 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →
Study Backup governance and ransomware protection (AWS Backup, Object Lock)