Preparing Practice Exam…
Please wait a moment while the system generates the exam questions, answers, and study session.
Please wait a moment while the system generates the exam questions, answers, and study session.
AWS Certified Solutions Architect - Professional · AWS
Select 3 answers.
This question asks for 3 answers, but our data marks only 1. Compare with the community discussion below for the full answer.
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
In a ransomware scenario where an attacker gains highly privileged access, both B and C2 can be bypassed. However, C2 (least privilege) offers a slightly stronger defense in this specific case. Here's why: If the attacker compromises an account with permissions to manage backups but not to manage SCPs, least privilege will still restrict their ability to delete or modify backups directly, even if they can't disable the SCP. An SCP, on the other hand, provides no additional protection if the attacker has the permissions to modify SCPs. The Verdict: While both B and C2 are important security practices, C2 (least privilege) is slightly better than B (SCPs) for mitigating the specific risk of ransomware attacks involving privileged credential compromise. However, neither is as effective as C1 (Vault Lock) and A (Cross-account backups).
Please delete above. Correction to ABC
Why would you store backup of a production environment in a non-production environment? That itself adds a security risk. And in my opinion removes options A and E from my choice. Also, option D it doesn't address the main concern. And options B, C and E look to solve the purpose effectively at least with the given choices and thus those are my choices.