A financial services firm centralises backups for several production accounts into a single AWS Backup vault in eu-west-1. A security review demands that recovery points survive a full Region outage and that nobody, including an administrator with compromised credentials, can delete or shorten the retention of a backup before its retention period expires. Which configuration BEST satisfies both the Region-loss and immutability requirements?
- ACopy recovery points to a second backup vault in the same eu-west-1 Region and attach a restrictive vault access policy that denies delete actions to every principal except the backup administrators.
- BSchedule cross-Region snapshot copies of the underlying EBS and RDS resources to eu-west-2 and rely on an IAM permission boundary on the administrator role to block any delete API calls on those snapshots.
- CCopy recovery points to a backup vault in eu-west-2 and apply AWS Backup Vault Lock in compliance mode on the destination vault so the retention period is enforced and cannot be reduced or removed by anyone. Correct
- DEnable AWS Backup Vault Lock in governance mode on the eu-west-1 vault and turn on continuous point-in-time recovery so the data is protected without copying recovery points to another Region.
Why A is wrong: A same-Region copy does not survive a Region outage, and a vault access policy can be edited or its exceptions abused, so it provides neither the geographic protection nor the true immutability required.
Why B is wrong: Plain cross-Region snapshots survive a Region loss but sit outside the vault, and a permission boundary can be detached or revised by another privileged principal, so the retention is not genuinely immutable.
Why C is correct: A cross-Region copy places recovery points beyond a single Region failure, and Vault Lock in compliance mode makes retention immutable so no principal, even root, can delete or shorten a backup before it expires.
Why D is wrong: Governance mode still lets sufficiently privileged users alter the lock, and keeping everything in eu-west-1 leaves the backups exposed to the very Region outage the review is concerned about.