SOA-C02 · Question #565
A company has an application that uses Amazon DynamoDB tables. The tables are spread across AWS accounts and AWS Regions. The company uses AWS CloudFormation to deploy AWS resources. A new team at…
The correct answer is B. Enable deletion protection for the DynamoDB tables. C. Enable point-in-time recovery for the DynamoDB tables. Restore the tables if they are. B is correct because DynamoDB's native deletion protection feature blocks DeleteTable API calls directly - meaning the Lambda function's API call would fail even with valid IAM permissions, preventing the outage entirely. C is correct because Point-in-Time Recovery (PITR)…
Question
A company has an application that uses Amazon DynamoDB tables. The tables are spread across AWS accounts and AWS Regions. The company uses AWS CloudFormation to deploy AWS resources. A new team at the company is deleting unused AWS resources. The team accidentally deletes several production DynamoDB tables by running an AWS Lambda function that makes a DynamoDB DeleteTable API call. The table deletions cause an application outage. A SysOps administrator must implement a solution that minimizes the chance of accidental deletions of tables. The solution also must minimize data loss that results from accidental deletions. Which combination of steps will meet these requirements? (Choose two.)
Options
- AEnable termination protection for the CloudFormation stacks that deploy the DynamoDB tables.
- BEnable deletion protection for the DynamoDB tables.
- CEnable point-in-time recovery for the DynamoDB tables. Restore the tables if they are
- DSchedule daily backups of the DynamoDB tables. Restore the tables if they are accidentally
- EExport the DynamoDB tables to Amazon S3 every day. Use Import from Amazon S3 to restore
How the community answered
(42 responses)- A10% (4)
- B83% (35)
- D5% (2)
- E2% (1)
Explanation
B is correct because DynamoDB's native deletion protection feature blocks DeleteTable API calls directly - meaning the Lambda function's API call would fail even with valid IAM permissions, preventing the outage entirely. C is correct because Point-in-Time Recovery (PITR) maintains continuous backups for up to 35 days with per-second granularity, enabling restoration to moments before the deletion with minimal data loss.
A is wrong because CloudFormation termination protection only blocks stack-level deletions through CloudFormation - it does nothing to stop a Lambda function making a direct DeleteTable API call, which bypassed CloudFormation entirely in this scenario. D and E are wrong compared to C because daily backups and daily S3 exports both introduce up to 24 hours of potential data loss, while PITR offers continuous, near-zero data loss recovery - PITR is strictly superior for minimizing data loss.
Memory tip: Think "Prevention + Recovery" - B blocks the deletion (the guard), C undoes it (the safety net). Whenever a scenario involves accidental API-level deletions, CloudFormation termination protection is a red herring because it only protects against CloudFormation-driven changes.
Topics
Community Discussion
No community discussion yet for this question.