A healthcare company must survive ransomware that compromises admin credentials and deletes backups, meet 7-year immutable retention, and allow recovery testing without altering locked data. Primary data lives in S3 and EBS-backed databases. Which data protection design ensures recoverable immutable backups?
Select an answer to reveal the explanation.
Short Explanation
You're protected when your backups work like a time-locked safe that even stolen admin keys can't crack open. With Compliance mode locks on S3, snapshots, and vaults, you'll keep 7-year copies you can test without touching the originals.
Full Explanation
S3 Object Lock in Compliance mode enforces write-once-read-many retention that even root cannot shorten, EBS Snapshot Lock sets retention that blocks deletion, and AWS Backup Vault Lock enforces a vault policy with minimum and maximum retention preventing deletion of recovery points, together satisfying immutable retention and recovery testing via restores without mutating originals. Versioning plus cross-Region copy preserves versions but without Object Lock privileged attackers can delete versions and snapshots. Lifecycle expiration with encryption and IAM policies relies on identity controls that compromised admins can alter and may expire needed data. Replication with fast restore and MFA Delete improves availability but replication can propagate encrypted ransomware objects and MFA Delete does not provide time-based WORM compliance. Exam caveat is Compliance mode versus Governance mode and Vault Lock governance, and practical check is to verify lock durations cover seven years and test restores to isolated VPCs.