An attacker with stolen credentials encrypted objects in an S3 bucket. Which recovery path is most reliable if the right safeguards were in place beforehand?
Show answer and explanation
Answer: B
S3 Versioning keeps prior object versions, so an overwrite of every object can be rolled back, especially when MFA Delete or Object Lock prevents an attacker from destroying the versions. AWS Backup vaults with vault lock and cross-account or cross-region copies keep a recovery point outside the compromised account's blast radius.
Recovery works only if those protections existed before the attack, which is why they belong in the baseline design.
Why the other options are wrong
- A. Payment funds criminal activity and provides no guarantee of recovery. It is not an accepted recovery strategy.
- C. Batch Operations is a job runner. If it copies from a bucket that was also encrypted, the operation just propagates the damage.
- D. AWS cannot decrypt data encrypted by an attacker who controlled your credentials and keys, and support has no backdoor into customer objects.
Exam tip. Immutable versions or locked backup vaults beat every reactive option.