A company stores important business data in Amazon EFS. A ransomware attack encrypted all files in the file system, and the company must recover the data as it was before the attack. What provides this recovery capability?
Show answer and explanation
Answer: C
EFS integrates with AWS Backup, which by default takes automatic daily backups and preserves a point-in-time recovery window in a separate backup vault. Restoring the file system to a moment before the ransomware ran returns clean data, and the backup copies were never reachable through the compromised mount point.
This vault-based recovery is the actual defense against file-level encryption attacks.
Why the other options are wrong
- A. Provisioned throughput mode sets a fixed performance level independent of file-system size; it is purely a performance control with no recovery function.
- B. EFS replication copies current file contents to a secondary file system, so an attacker encrypting the source encrypts an identical replica — it improves availability, not recovery from corruption.
- D. Lifecycle management relocates infrequently accessed files to IA storage classes for cost savings; the files themselves remain the live (now encrypted) data, not backups.