A ransomware defense requires backups to remain undeletable for a defined period.
Reduce the risk that a backup administrator deletes production and backup data together.
Which feature is most appropriate?
Configure AWS Backup Vault Lock with the required retention controls to prevent early deletion.
Detailed explanation
Vault Lock applies retention boundaries that prevent premature backup deletion.
Vault Lock applies retention boundaries that prevent premature backup deletion.
Broad deletion authority weakens the protection requirement.
Broad deletion authority weakens the protection requirement.
Immediate expiration contradicts the recovery and ransomware requirement.
Immediate expiration contradicts the recovery and ransomware requirement.
Audit-log encryption does not prevent backup deletion.
Audit-log encryption does not prevent backup deletion.
Check official documentation
Compare the following points with the official documentation.
AWS Backup Vault Lock、compliance mode、保持期間、削除防止の公式説明を確認する。
What to confirm
バックアップ保護とS3 Lifecycle・IAM広域権限・監査ログ暗号化を区別できる。
Key points
- Backup Vault Lock
- Immutable backup
- Retention period
- Compliance
Notes
- Environment: AWS公式DEA-C01試験ガイドと各サービスの公式ドキュメントの確認
- Confirm current AWS service behavior in the official DEA-C01 documentation.
Foundation review
Defense in depth
Vault retention complements IAM separation, encryption, and monitored audit logs.
Recovery assurance
Restore tests and retention policies should be validated before an incident occurs.