A healthcare company must replicate encrypted EBS volumes and RDS snapshots to a second Region, retain immutable backups for 90 days against ransomware, and automatically expire old recovery points. Which backup design should the storage architect implement to meet ransomware protection?

The design with encrypted EBS and RDS recovery points, cross-Region copy, Vault Lock in compliance mode, and lifecycle expiration meets the requirements: the copy provides geographic separation from regional failure and ransomware blast radius, compliance mode enforces immutable retention for 90 days that privileged users cannot bypass, and expiration automatically removes aged recovery points to control cost. A design that uses compliance-mode Vault Lock and lifecycle expiration but keeps backups only in the source Region provides local protection, yet lacks geographic separation and leaves recovery dependent on a compromised or impaired Region. A design that copies recovery points across Regions and applies lifecycle management in a standard vault provides durability and encryption, but without Vault Lock an attacker with elevated access can delete backups, defeating the immutable-retention requirement. A design that combines cross-Region copy and compliance-mode Vault Lock but retains all recovery points indefinitely preserves recoverability, yet fails the expiration requirement and creates unbounded cost and retention risk. An exam caveat is to distinguish standard vault retention from Vault Lock, and governance mode from compliance mode: only compliance mode prevents retention shortening. As a practical check, verify compliance mode and 90-day retention, cross-Region copy and replicated KMS keys in the backup plan, and reports confirming copies and lifecycle expiration.