A law firm with strict retention faces ransomware and accidental deletions across S3 case files and EBS volumes backing document servers, requiring immutability, locked backups, and time-bound recovery points. Which data-protection design best resists ransomware and deletion?

The design combining S3 Object Lock in Compliance mode with EBS Snapshot Lock and Backup Vault Lock succeeds because it protects both case files and volume recovery points with locked, time-bound retention. Compliance mode blocks deletion or overwrite by any user, including root, until retention expires; Snapshot Lock blocks early deletion of EBS recovery points, and Vault Lock enforces an immutable backup-vault policy. Together, these controls provide recovery points resilient to ransomware and accidental deletion. Governance mode fails the strict immutability requirement because special permissions can bypass its retention, allowing a compromised privileged principal to delete case files. Scheduled EBS snapshots in standard unlocked vaults provide time-bound backups, but without Snapshot Lock and Vault Lock, attacker credentials may still delete or alter them. Cross-region replication alone does not provide independent historical recovery points: it can mirror encrypted or deleted objects rather than preserve an earlier restorable state. For the exam, do not confuse replication or versioning with immutable locked backup; Compliance mode plus Vault Lock denies privileged deletion. As a practical check, verify that retention periods meet legal requirements, then trial a restore from a locked vault and confirm that deletion attempts are denied.