These questions are independently created for study purposes. They are not official AWS exam questions, actual exam questions, leaked questions, or exam dumps.
SAA-042
For multiple systems that use Amazon EBS, Amazon RDS, Amazon DynamoDB, and Amazon EFS, you want to define backup schedules and retention periods centrally and be able to audit that no backups are missed. Which service is the most appropriate?
Choices
Explanation and answer
Read the explanation and correct answer (spoiler — try answering first)
Correct answer: C. Create a backup plan and a backup vault in AWS Backup and assign resources based on tags
Explanation
AWS Backup is a managed service that centrally manages backups spanning multiple AWS services through a single definition called a backup plan. Because resources can be assigned by tag, it is easy to prevent missed backups, and it also supports auditing through compliance reports.
Per-choice explanations
A. Configure each service's automatic backup feature individually and periodically aggregate and report the settings with a Lambda function
Incorrect. Because each service has a different configuration method and a different way of specifying retention, consistency cannot be maintained and new resources are easily missed. The operational burden of building your own aggregation also remains.
B. Evaluate compliance of backup settings with AWS Config rules and run automatic remediation actions when non-compliant
Incorrect. AWS Config is a service that evaluates whether configurations comply with defined rules; it does not take backups itself. It can support auditing, but it does not satisfy the central requirement of centralized backup management.
C. Create a backup plan and a backup vault in AWS Backup and assign resources based on tags
Correct. A backup plan defines frequency, retention, and copy destinations, and assigning resources by tag means new resources automatically become protected as well.
D. Manage backups for all target services centrally with Amazon Data Lifecycle Manager policies
Incorrect. Amazon Data Lifecycle Manager can only manage EBS snapshots and EBS-backed AMIs. RDS, DynamoDB, and EFS are out of scope.
Practical Use
AWS Backup is a managed service for defining, running, and auditing backups across multiple AWS services. Supported resources include EBS volumes, EC2 instances, RDS / Aurora, DynamoDB, EFS, FSx, Storage Gateway, S3, DocumentDB, and Neptune, and instead of using each service's individual backup feature, a single definition called a backup plan specifies frequency, backup window, retention, transition to cold storage, and copies to another Region or account. The backups taken are stored in a backup vault and encrypted with a KMS key. There are two operational essentials. First, assigning protected resources by tag means newly created resources automatically have the backup plan applied, structurally preventing missed backups, the most common accident. Second, enabling Vault Lock puts backups into a WORM (Write Once Read Many) state that forbids deletion or shortening of retention, achieving the "backups that cannot be erased" required for ransomware protection and regulatory compliance. Combined with AWS Organizations you can apply backup policies across the whole organization, and AWS Backup Audit Manager can generate compliance reports automatically. On SAA-C03, requirements such as "centrally manage backups for multiple services," "standardize retention policies," and "support auditing" make AWS Backup the correct answer. Amazon Data Lifecycle Manager is sometimes offered as a distractor, but you can distinguish it because DLM covers only EBS snapshots and EBS-backed AMIs. It is also worth remembering that AWS Config is a service that evaluates whether configurations comply, not a service that takes backups.