SAP-C02 · Question #602
A company runs applications in hundreds of production AWS accounts. The company uses AWS Organizations with all features enabled and has a centralized backup operation that uses AWS Backup. The compan
The correct answer is A. Implement cross-account backup with AWS Backup vaults in designated non-production C. Implement least privilege access for the IAM service role that is assigned to AWS Backup. E. Configure AWS Backup to write all backups to an Amazon S3 bucket in a designated non-. To protect AWS Backup against ransomware from compromised production account credentials, implement cross-account backup vaults in non-production accounts, enforce least privilege on the AWS Backup service role, and store backups in isolated S3 buckets.
Question
A company runs applications in hundreds of production AWS accounts. The company uses AWS Organizations with all features enabled and has a centralized backup operation that uses AWS Backup. The company is concerned about ransomware attacks. To address this concern, the company has created a new policy that all backups must be resilient to breaches of privileged-user credentials in any production account. Which combination of steps will meet this new requirement? (Choose three.)
Options
- AImplement cross-account backup with AWS Backup vaults in designated non-production
- BAdd an SCP that restricts the modification of AWS Backup vaults.
- CImplement least privilege access for the IAM service role that is assigned to AWS Backup.
- DConfigure the backup frequency, lifecycle, and retention period to ensure that at least one backup
- EConfigure AWS Backup to write all backups to an Amazon S3 bucket in a designated non-
How the community answered
(23 responses)- A65% (15)
- B9% (2)
- D26% (6)
Why each option
To protect AWS Backup against ransomware from compromised production account credentials, implement cross-account backup vaults in non-production accounts, enforce least privilege on the AWS Backup service role, and store backups in isolated S3 buckets.
Implementing cross-account backup with AWS Backup vaults in separate, non-production accounts ensures that even if production account credentials are breached, the backups remain isolated and secure.
An SCP restricts actions at the organization level, but it does not protect against a sufficiently privileged user within an account already possessing excessive permissions to delete or modify backups.
Applying least privilege access to the IAM service role for AWS Backup prevents unauthorized deletion or modification of backups by a compromised privileged user, thus protecting against ransomware.
Configuring backup frequency, lifecycle, and retention ensures data availability and compliance but does not inherently protect against a ransomware attack that compromises the ability to modify or delete existing backups.
Storing backups in an Amazon S3 bucket within a designated non-production account provides an isolated storage target, preventing a breach in a source production account from directly compromising the backup data.
Concept tested: AWS Backup ransomware protection, cross-account, least privilege
Source: https://docs.aws.amazon.com/aws-backup/latest/devguide/cross-account-backups.html
Community Discussion
No community discussion yet for this question.