A regional hospital runs encrypted EBS volumes and RDS databases supporting emergency care. Ransomware drills require immutable, cross-Region backups with air-gapped retention, lifecycle management, and quarterly restore testing without custom snapshot scripts. Which backup design provides secure replication and ransomware-resilient recovery?
Select an answer to reveal the explanation.
Short Explanation
You need locked, off-site copies you can prove restore cleanly. AWS Backup with Vault Lock gives immutable, cross-Region recovery built for ransomware.
Full Explanation
AWS Backup provides centralized backup plans for EBS, RDS, and other services with lifecycle policies, cross-Region and cross-account copy, Backup Vault Lock for immutable retention that blocks early deletion, and restore testing with compliance reporting to satisfy ransomware resilience without custom scripting. Data Lifecycle Manager automates EBS snapshots with schedules but lacks centralized Vault Lock immutability, cross-service orchestration, and built-in restore testing, and manual copies increase error risk. DataSync replicates live file data efficiently for migration and synchronization but is not an immutable backup solution with point-in-time recovery, vault governance, or protection against deletion by compromised credentials. Retaining default snapshots with broadly shared KMS keys undermines isolation and allows deletion or exposure, failing air-gapped and least-privilege backup requirements. Exam caveat: select Backup Vault Lock for immutability and DataSync only for data movement. Practical check: enable Vault Lock in compliance mode, verify cross-Region copy encryption with separate keys, and review restore-test reports quarterly.