A law firm stores case files on EFS and S3 and fears ransomware could encrypt primary data and backups together. Partners require immutable, cross-Region copies with tested restores and minimal RPO. Which backup and replication design should the engineer implement to ensure recoverable isolated copies?
Select an answer to reveal the explanation.
Short Explanation
You wouldn't keep your only spare key inside your locked house, so you'll centralize backups in AWS Backup with cross-Region copies and test your restores often. Vault Lock makes those copies unchangeable, so ransomware can't touch them even if it hits your primary data.
Full Explanation
The correct approach defines AWS Backup plans for EFS and S3 with continuous or frequent snapshots, enables Backup Vault Lock in Compliance mode to block early deletion, copies recovery points to a locked vault in another Region and account, and schedules restore drills to verify RPO and integrity isolated from production credentials. Enabling Versioning with replication fails by concept because replication mirrors encryption or deletion variants quickly and versioning alone remains mutable without WORM governance and orchestrated recovery, while attaching EFS Lifecycle policies fails because lifecycle only transitions storage classes for cost savings and does not create application-consistent isolated recovery points. Using DataSync scheduled mirrors fails because synchronization propagates ransomware-encrypted files to the destination and lacks immutable vaulting, cataloging, and point-in-time restore workflows. For the exam, associate Vault Lock plus cross-Region copy with ransomware resilience, and in practice separate backup vault access with Service Control Policies, monitor failed jobs with CloudWatch, and document runbook restore times.