SAP-C02 Practice Question 48: Immutable Backup Retention
AWS Certified Solutions Architect – Professional (SAP-C02) · Test 5 · question 8 of 10
After a ransomware incident at a competitor in which the attacker deleted the victim's backups before encrypting production, a brokerage has been told by its regulator to make its own backups undeletable for seven years. The brokerage protects Amazon EBS volumes, Amazon RDS databases, and Amazon EFS file systems across 200 accounts with AWS Backup.
The control must hold even against an attacker who obtains administrator credentials or the account root user, must be applied consistently to every account including ones created next quarter, and must stand up to a records-retention audit under SEC 17a-4. The security team accepts that backups will occupy storage for the full seven years.
Which configuration meets the requirement?
Show answer and explanation
Answer:
Vault Lock in compliance mode is the only option here that produces genuine write-once, read-many immutability. AWS states that once the cooling-off grace period expires, the vault and its lock are immutable and cannot be changed or deleted by any user or by AWS, and that if any user including the root user attempts to delete a backup or change lifecycle properties in a locked vault, AWS Backup denies the operation. That is what defeats an attacker holding administrator or root credentials. Setting a minimum retention period makes backup and copy jobs that do not meet the seven-year lifecycle fail rather than silently creating short-lived recovery points. For the audit, AWS notes that Vault Lock has been assessed by Cohasset Associates for environments subject to SEC 17a-4, CFTC, and FINRA regulations. Distributing the plan through an AWS Organizations backup policy is what makes the control land on all 200 accounts and on accounts added later.
Option B is the same feature in the weaker mode. A vault locked in governance mode can be managed or deleted by users with sufficient IAM permissions, which is exactly the capability a compromised administrator would have.
Option C protects only what lands in that bucket and does not cover recovery points that AWS Backup manages for EBS, RDS, and EFS. MFA delete is configured per bucket by the root user and does not extend across 200 accounts, and versioning alone does not prevent permanent deletion of versions by a privileged caller.
Option D is a guardrail, not immutability. An SCP can be modified or detached by someone with management-account access, and SCPs do not restrict principals in the management account at all, so the control fails against the very threat model it was written for.
Reference: AWS Backup Vault Lock