A company manages its multi-account environment by using AWS Organizations. The company needs to automate the creation of daily incremental backups of any Amazon Elastic Block Store (Amazon EBS)…

Question

Options

• ACreate a daily snapshot of all EBS volumes by using Amazon Data Lifecycle Manager. Specify
• BAssociate a service control policy (SCP) with the account to deny users the ability to delete EBS
• CCreate a daily snapshot of all EBS volumes by using AWS Backup. Specify Lifecycle as the tag
• DCreate a daily Amazon Machine Image (AMI) of every production EC2 instance within the AWS

• A
  4% (1)
• B
  4% (1)
• C
  79% (19)
• D
  13% (3)

Explanation

Option C is correct because AWS Backup natively supports tag-based backup plans, creates daily incremental snapshots of EBS volumes matching the Lifecycle: Production tag, and - critically - stores those backups in a Backup Vault that can be protected with a resource-based policy or Vault Lock, preventing deletion even by users who hold broad ec2:* permissions.

Option A (DLM) is wrong because while Amazon Data Lifecycle Manager can target volumes by tag and schedule snapshots, the resulting snapshots are ordinary EBS snapshots deletable by anyone with ec2:DeleteSnapshot - there is no vault-level protection.

Option B (SCP) is wrong because an SCP alone only addresses deletion prevention; it doesn't create the backups, making it an incomplete solution. The question requires a single solution covering both creation and protection.

Option D (AMI) is wrong because AMIs capture full EC2 instance images - not targeted EBS volume backups - and are not incremental; this is the wrong tool for the stated requirement.

Memory tip: When you see "prevent deletion even with EC2 permissions," think AWS Backup Vault Lock - it acts like a safe that EC2 IAM permissions cannot open, whereas DLM snapshots live in EC2-land where EC2 permissions still rule.

No community discussion yet for this question.