AWS Backup (including the newer Logically Air-Gapped Vault), AWS Vault Lock, and cross-account/cross-region disaster recovery patterns via AWS Elastic Disaster Recovery (DRS). On the Security Specialty exam, resilience isn't really about uptime — it's about whether your recovery data and recovery PATH survive the same incident that took down production, especially ransomware and a fully compromised account.
Resilience questions on this exam are really asking: "if the production account/credentials are fully compromised, does your backup survive?" A standard backup vault in the SAME account as production — even with Vault Lock — is still reachable by a sufficiently privileged compromised identity in that account (Vault Lock protects against accidental/malicious deletion attempts subject to IAM, but doesn't change which account the data lives in). The textbook answer to "ransomware-resilient, cross-account-isolated backup" is almost always a Logically Air-Gapped Vault shared to a separate recovery account via RAM — not just Vault Lock alone.
| Domain | Where This Bundle Shows Up |
|---|---|
| Data Protection | The centerpiece — backup immutability, encryption of recovery points, retention enforcement |
| Threat Detection & Incident Response | Ransomware recovery scenarios, GuardDuty malware scanning of backups before restore |
| Management & Security Governance | Cross-account backup sharing via RAM, Multi-party approval governance, Backup Audit Manager compliance controls |
| Identity & Access Management | Cross-account DRS failback IAM roles, recovery-account access governance |
Ransomware encrypting/deleting production data AND any backups reachable from the compromised account; full account compromise eliminating the owning account's ability to authorize its own recovery; AZ/Region outage
Ensure recovery data is immutable, isolated from the production account's own blast radius, and recoverable even if the production account itself is inaccessible
The Resilience Bundle
Centralize backup policy via Organizations backup policies; copy critical backups to a LAG vault in a separate recovery account; enable Multi-party approval for that vault; replicate critical EC2 workloads via DRS to a separate recovery Region/account.
GuardDuty malware scanning of recovery points before restore; Backup Audit Manager controls for cross-Region/cross-account copy and Vault Lock compliance; failover/failback drill results.
Direct restore from the LAG vault in the isolated recovery account; DRS failover to recovery instances; structured failback (reversed replication) once the primary is clean and restored.
Exam appearance probability: MEDIUM-HIGH
Requirement → Keywords → Expected Answer → why every distractor fails.
Logically Air-Gapped Vault shared via RAM to a separate recovery account
| Distractor | Why it's wrong |
|---|---|
| Vault Lock alone in the production account | Protects against deletion/retention-shortening within IAM rules, but the data still lives in the SAME, now-compromised account — doesn't achieve the cross-account isolation the requirement needs |
| Standard backup vault with cross-Region copy only | Still within the same account — protects against a Regional outage, not an account-level compromise |
Vault Lock in Compliance mode
| Distractor | Why it's wrong |
|---|---|
| Vault Lock in Governance mode | Authorized IAM principals CAN still remove the lock or modify retention — doesn't meet the "not even root" bar |
Multi-Party Approval for the Logically Air-Gapped Vault
| Distractor | Why it's wrong |
|---|---|
| Standard RAM sharing alone | RAM sharing alone doesn't provide a governed approval mechanism specifically designed to function when the OWNING account itself is inaccessible — MPA's approval team/portal is the purpose-built solution |
AWS Elastic Disaster Recovery (DRS)
| Distractor | Why it's wrong |
|---|---|
| AWS Backup with cross-Region copy alone | Backup/restore is generally slower than DRS's continuous block-level replication purpose-built for fast EC2 failover; Backup is point-in-time recovery, not continuous near-real-time replication |
Single-action database snapshot copy directly to the cross-Region LAG vault (Feb 2026 capability)
| Distractor | Why it's wrong |
|---|---|
| Two-step copy (target Region vault, then LAG vault) with a custom Lambda monitor | The OLD, pre-Feb-2026 pattern — now unnecessary; the single-action copy achieves the same outcome faster and cheaper, without custom monitoring scripts |
After a DRS failover, the newly recovered instances are NOT automatically protected against a further incident — reversed replication/failback protection must be deliberately initiated. This is a common "what's the very next step after failover" trap.
| Misconception | Reality |
|---|---|
| "Vault Lock alone makes our backups ransomware-proof" | It prevents deletion/retention-shortening, but the data still lives in the same (potentially compromised) account — a Logically Air-Gapped Vault shared cross-account is what achieves true isolation |
| "Governance mode and Compliance mode provide the same level of immutability" | Governance mode is removable by authorized IAM principals; Compliance mode becomes permanent (not even root can override) after the grace period |
| "LAG vaults require manually configuring Vault Lock after creation" | False — LAG vaults come with automatic Compliance-mode lock by default, no separate configuration step |
| "After a DRS failover, our workload is automatically protected against a second incident" | False — reversed replication/failback protection must be deliberately initiated; recovered instances are unprotected until then |
| "DRS failback works the same way across any two AWS partitions" | False — cross-partition failback (commercial ↔ GovCloud) is explicitly unsupported; only cross-Region failback within the same partition (including within GovCloud) is supported |
| Comparison | What actually differs |
|---|---|
| Standard vault vs Vault Lock vs LAG vault | Reachable/deletable baseline vs WORM-protected (same account) vs immutable AND cross-account-isolated by default — increasing levels of resilience against the same-account compromise threat |
| Vault Lock Governance vs Compliance mode | Removable by authorized IAM principals vs permanently immutable (not even root) after the grace period expires |
| RAM sharing alone vs Multi-Party Approval | Grants cross-account access to the resource generally vs specifically governs and authorizes RECOVERY requests, including when the owning account itself is inaccessible |
| AWS Backup vs AWS DRS | Point-in-time recovery points on a backup schedule vs continuous, near-real-time block-level replication purpose-built for fast EC2 failover — different RPO/RTO profiles for different workload criticality |
| DRS failover vs failback | Launching recovery instances in the target Region/account during a disaster vs the structured, reversed-replication process to return to the original source afterward — failback is NOT just "failover in reverse," it has its own distinct prerequisites |
Click card to flip. Mark right or wrong to track score.
SCS-C02 scenario style, Easy → Specialty. Select an answer to reveal the explanation.