AWS Certified Solutions Architect - Professional SAP-C02 — Topic 1 Question 337

Question

A company runs applications in hundreds of production AWS accounts. The company uses AWS Organizations with all features enabled and has a centralized backup operation that uses AWS Backup. The company is concerned about ransomware attacks. To address this concern, the company has created a new policy that all backups must be resilient to breaches of privileged-user credentials in any production account. Which combination of steps will meet this new requirement? (Choose three.)

Accepted Answer

Correct answer: A, B, C. The correct answer is A, B, C. Option A: Implement cross-account backup with AWS Backup vaults in designated non-production accounts. Option B: Add an SCP that restricts the modification of AWS Backup vaults. Option C: Implement AWS Backup Vault Lock in compliance mode. C. Implement least privilege access for the IAM service role that is assigned to AWS Backup. AWS Backup centrally automates and manages backups across AWS services. AWS IAM controls authenticated and authorized access to AWS resources with fine-grained policies. Service Control Policies set guardrails on what accounts in an organization can do. By spanning multiple Availability Zones / adding redundancy, this option provides the high availability and resilience required.

AWS Certified Solutions Architect - Professional SAP-C02 — Question 337