A financial group runs 40 accounts under Organizations with PCI data in RDS and EFS across two Regions. Auditors require centrally enforced backup schedules, immutable copies, and cross-account recovery testing without local overrides. Which centralized backup governance design using AWS Backup meets business continuity needs?
Select an answer to reveal the explanation.
Short Explanation
You need a delegated AWS Backup administrator, Organizations-enforced policies, cross-Region copies, and Vault Lock to govern all accounts and preserve immutable recovery data. Unlike designs without Vault Lock, with local plan changes, or with copies kept only in the source Region, this design supports centralized control and cross-account recovery testing.
Full Explanation
A delegated AWS Backup administrator provides centralized governance, while Organizations backup policies enforce consistent schedules across all 40 accounts for RDS and EFS. Cross-Region copies provide geographic resilience for two-Region continuity, Vault Lock makes retention immutable by blocking early deletion, and cross-account restores enable the required recovery testing without local override rights. A design with a delegated administrator, Organizations policies, cross-Region copies, and restore testing but no Vault Lock fails the immutability requirement: standard vault retention remains mutable and does not meet strict PCI WORM and auditor mandates. Central vaults with Vault Lock and cross-Region copies but locally editable backup plans fail centralized enforcement because member-account changes reintroduce drift and violate the no-local-overrides requirement. Organizations policies and Vault Lock with restores confined to the source Region provide governance and immutability but fail business continuity: a primary-Region loss leaves no recoverable copy elsewhere. For exams, all three controls must coexist; Vault Lock Compliance mode versus Governance mode can be decisive in immutability questions. As a practical check, confirm Vault Lock Compliance mode is active, verify member accounts cannot edit inherited plans, and perform a documented cross-account, cross-Region restore with CloudTrail evidence for auditors.