A 200-person SaaS firm keeps customer PostgreSQL on EC2 and file assets in S3, and after a ransomware scare must ensure encrypted cross-Region backups with air-gapped recovery, point-in-time restore, and tested restores without managing scripts. Which backup and replication design gives resilient ransomware protection?

The design using AWS Backup vault lock, encrypted cross-Region copies, PITR, and regular restore testing is the only listed design that combines immutability, regional isolation, point-in-time recovery, and tested restores without custom scripts. Vault lock provides WORM protection: in Compliance mode, even administrators cannot delete protected recovery points during the retention period. Encrypted copies in another Region add isolation from a regional ransomware event, and PITR supports recovery to a chosen point in time where the protected resource supports it. Built-in restore testing plans help verify that recovery works. The design with encrypted cross-Region copies, PITR, and scheduled tests but no vault lock lacks immutability; compromised credentials may still delete backups. The design with vault lock, encrypted cross-Region copies, and testing but no PITR lacks point-in-time granularity, leaving recovery limited to available backup points. The design with vault-locked same-Region copies, PITR, and tests lacks cross-Region isolation, so a regional compromise can affect both production and backups. Exam caveat: AWS Backup does not provide continuous-backup PITR for PostgreSQL running on EC2; EC2 volumes generally use snapshots, so database log archiving is needed to cover that PITR gap. Practical check: verify KMS encryption, cross-Region copy status, Compliance-mode lock, and recent restore-test reports in an isolated account before sign-off.