A healthcare company must back up EBS volumes, RDS databases, EFS file systems, and DynamoDB tables in two Regions. Recovery points must be undeletable for seven years, even by administrators with full account rights. Which setup satisfies this?
Show answer and explanation
Answer: D
AWS Backup covers all four resource types from one backup plan, so scheduling and retention are managed centrally. A copy action sends recovery points to a vault in the second Region. Applying Vault Lock in compliance mode to that destination vault enforces minimum and maximum retention periods that cannot be shortened or removed, even by the root user, once the cooling-off period has passed. A seven-year minimum retention in the plan satisfies the requirement that recovery points survive that long.
Why the other options are wrong
- A. S3 lifecycle rules manage objects stored in buckets, not EBS snapshots or database recovery points. Those four services cannot be protected through S3 lifecycle configuration.
- B. Custom Lambda snapshots need ongoing maintenance and do not provide a locked retention that administrators cannot override. Any script can be altered or disabled by a privileged user.
- C. DLM handles EBS snapshots and AMIs for each service separately. It does not cover RDS, EFS, or DynamoDB, and it offers no compliance-mode immutability across all of them.