Q63 — AWS SAA-C03 Ch.11

Question 63 of 100 | ← Chapter 11

Q763. A company uses Amazon EC2 instances and Amazon Elastic Block Store (Amazon EBS) volumes to run an application. The company creates one snapshot of each EBS volume every day to meet compliance requirements. The company wants to implement an architecture that prevents the accidental deletion of EBS volume snapshots. The solution must not change the administrative rights of the storage administrator user.Which solution will meet these requirements with the LEAST administrative effort?

• A. Create an IAM role that has permission to delete snapshots. Attach the role to a new EC2 instance. Use the AWS CLI from the new EC2 instance to delete snapshots.
• B. Create an IAM policy that denies snapshot deletion. Attach the policy to the storage administrator user.
• C. Add tags to the snapshots. Create retention rules in Recycle Bin for EBS snapshots that have the tags.
• D. Lock the EBS snapshots to prevent deletion. ✓

Correct Answer: D. Lock the EBS snapshots to prevent deletion.

Explanation

To implement an architecture that prevents the accidental deletion of EBS volume snapshots with the least administrative effort, the most suitable solution is:D. Lock the EBS snapshots to prevent deletion.Option D provides the desired solution with the least administrative effort:Lock the EBS snapshots to prevent deletion:Amazon EBS supports the ability to lock snapshots to prevent accidental deletion. By enabling the lock on EBS snapshots, you can ensure that they cannot be deleted until the lock is explicitly removed. This prevents accidental deletions and helps meet compliance requirements.Here's why option D is the best choice:\1. Least administrative effort: Locking the EBS snapshots requires minimal administrative effort. It does not involve creating or managing additional IAM roles, policies, or tags. The locking feature is built into Amazon EBS, allowing you to easily enable and disable the lock directly on the snapshots.\2. No change in administrative rights: Option D explicitly states that the solution must not change the administrative rights of the storage administrator user. Locking the EBS snapshots does not affect the administrative rights or privileges of any user. It provides an additional layer of protection without altering the existing access controls.Options A, B, and C are not the most suitable choices in this scenario:Option A suggests creating an IAM role that has permission to delete snapshots, attaching the role to a new EC2 instance, and using the AWS CLI from the new instance to delete snapshots. This approach introduces additional complexity and administrative overhead by creating a new EC2 instance and managing IAM roles and permissions.Option B suggests creating an IAM policy that denies snapshot deletion and attaching the policy to the storage administrator user. While this approach can prevent the storage administrator user from deleting snapshots, it requires modifying the administrative rights of the user, which is not allowed according to the requirements.Option C suggests adding tags to the snapshots and creating retention rules in Recycle Bin for EBS snapshots that have the tags. Although using tags and retention rules can help manage the lifecycle of snapshots, it does not prevent accidental deletions. It relies on manual configuration and management of retention rules, which may add administrative overhead.Therefore, the most appropriate solution to prevent accidental deletion of EBS volume snapshots with the least administrative effort is D: Lock the EBS snapshots to prevent deletion.