DOP-C02 Practice Question 37: Backup Vault Lock Cross Account

AWS Backup supports copying recovery points across accounts and Regions, which covers both the compromised-account and lost-Region scenarios in one plan. Vault Lock in compliance mode supplies the immutability: "If any user (including the root user) attempts to delete a backup or change the lifecycle properties in a locked vault, AWS Backup will deny the operation," and once the grace time expires "the vault and its lock are immutable and cannot be changed or deleted by any user or by AWS." That is the write-once, read-many guarantee the auditors are asking for.

Option A leaves the backups in the compromised account and in one Region, and an SCP is not immutability; it is a policy the organization's management account can change, and the person who compromised the environment may be able to do exactly that.

Option C fails both of the other requirements. A vault in the same account is inside the blast radius of an account compromise, and a vault "locked in governance mode can have the lock removed by users with sufficient IAM permissions", precisely what an attacker with admin credentials would have.

Option D does not describe how these backups work. EBS, RDS, and DynamoDB recovery points are not files you can copy into a bucket, and MFA delete is a bucket-level control on object versions, not a retention lock that survives a privileged insider.

Reference: AWS Backup Vault Lock