AWS Backup and EBS snapshots: SAA-C03 scenarios

The mechanics the exam tests below the DR-strategy layer — why snapshots are incremental, how a copy reaches a second Region, and what makes a backup un-deletable. Seven scenarios, SAA-C03, 2026 edition.

Try 7 free AWS Backup and EBS snapshot scenarios in the exam's own style — every answer explained, no sign-up.

Straight to the 7 free questions ↓

Below the disaster-recovery strategy tiers the SAA-C03 loves, there is a layer of plain mechanics the exam quietly depends on: how snapshots are stored, how a backup reaches a second Region, and what makes a backup impossible to delete. Miss these and the strategy questions above them get harder than they should. The diagram traces the whole path — an EBS volume, its incremental snapshots in Amazon S3, a cross-Region copy, and an AWS Backup vault with a locked retention policy.

Snapshots are incremental, and they live in S3

The single most tested fact here: EBS snapshots are incremental. The first snapshot of a volume is a full copy; every later snapshot stores only the blocks that changed since the previous one, in Amazon S3 that AWS manages on your behalf — you never see the bucket. So the storage cost of a nightly schedule tracks your change rate, not your volume size. A useful corollary the exam plants as a distractor: deleting an old snapshot does not corrupt newer ones, because AWS keeps any blocks the later snapshots still reference.

Getting a copy where you need it

A snapshot is Regional and lives in one account. When a requirement says “restore in a second Region after a Region outage”, the answer is a cross-Region snapshot copy; when it says “keep an isolated audit copy”, the answer is a cross-account copy or share. These are the two moves that appear whenever a scenario reaches past a single Region or account — and neither is automatic, so any option claiming snapshots are “global” is wrong.

Automating the schedule

Two services create and expire backups on a cadence. Amazon Data Lifecycle Manager (DLM) is the EBS-native, tag-driven scheduler at no extra charge — reach for it when the scope is EBS only and the goal is to remove manual work and code. AWS Backup is the centralized plane: one plan enforcing backups and retention across RDS, EBS, DynamoDB and more, into a backup vault. When a scenario spans several services with a single governance policy, that breadth points to a Backup plan rather than DLM.

Frequency sets your RPO; retention sets how long you keep it

Keep two dials separate. Backup frequency decides your recovery point objective — hourly snapshots cap worst-case loss at an hour, so a one-hour tolerance means scheduling at least that often. Retention and lifecycle decide how long copies survive and when they expire, with automatic transitions to cold storage to save cost. A stem that talks about data loss is asking about frequency; a stem about keeping or cost over time is asking about retention. Answering one with the other is the classic trap.

Restoring to the right point

For RDS, distinguish two restores. A snapshot restore returns you to the snapshot’s timestamp — fine for coarse recovery. Point-in-time restore (PITR) replays automated backups plus transaction logs to land on any second within the retention window, as a new instance. When corruption happens at a known moment and the requirement is “recover to just before it”, PITR is the precise tool.

Making backups un-deletable

Finally, immutability. When the requirement is that no one — not an administrator, not root, not stolen credentials — can delete a backup or shorten its retention early, the answer is a Backup vault protected by Vault Lock in compliance mode: write-once-read-many, enforced until retention expires. An IAM deny is a control someone privileged can edit; Vault Lock is a guarantee.

How to use the seven scenarios below

Answer each before opening the explanation, then name the requirement word that decided it — “second Region”, “cannot be deleted early”, “at most one hour”, “to a specific second”. Every explanation isolates that constraint and takes the plausible distractors apart. For the strategy tiers that sit on top of these mechanics, see Disaster recovery strategies and the Design Resilient Architectures overview.

A data-flow diagram in two Regions. In Region A an EBS volume feeds a set of snapshots stored in S3, labelled incremental because only changed blocks are kept — snapshot one is a full copy and later snapshots are deltas. From the snapshots two arrows lead out: one copies a snapshot into Region B for disaster-recovery restore in a second Region, and the other stores backups in an AWS Backup vault that carries a retention and lifecycle policy plus Vault Lock, marked immutable write-once-read-many so backups cannot be deleted early even by an administrator.

7 free SAA-C03 practice questions

Answers and explanations — no email wall

SAA-C03 Question 1 of 7

A team snapshots a 2 TB EBS volume every night and worries the backups will store a fresh 2 TB each time. Which statement most accurately describes how EBS snapshot storage actually works?

Answer: A — Snapshots are incremental — after the first full snapshot, each one stores only the blocks that changed, in Amazon S3.

EBS snapshots are incremental and held in Amazon S3 that AWS manages for you: the first snapshot captures the whole volume, and every later one stores only the blocks that changed since the previous snapshot, so nightly cost tracks change rate, not volume size. Why not the others: snapshots are not written back onto the source volume, and they live in S3, not in a single Availability Zone like the volume itself. And deleting an old snapshot is safe — AWS keeps any blocks that later snapshots still reference, so removing one never breaks the chain. Incremental-in-S3 is the fact every backup-cost question rests on.

SAA-C03 Question 2 of 7

A company must be able to restore an EBS-backed workload in a second Region after a Region-wide outage, and separately keep an audit copy of each backup in a locked-down security account. Which capability meets both needs?

Answer: A — Copy the snapshot cross-Region for DR and cross-account into the security account for the audit copy.

Snapshots are Regional and account-scoped, but you can copy a snapshot to another Region (to restore there after a Region loss) and copy or share it into another account (for an isolated audit or security account) — the two mechanics that cover this requirement, with a Region-specific KMS key if the snapshot is encrypted. Why not the others: snapshots are not global and do not replicate everywhere on their own; an EBS volume cannot be attached across Regions; and Multi-AZ is an RDS availability feature, not an EBS or cross-Region one. 'Second Region' means copy the snapshot; 'separate account' means copy or share it cross-account.

SAA-C03 Question 3 of 7

A team manages EBS snapshot creation and deletion by hand on a rota and keeps missing runs. They want a native, tag-driven schedule for EBS snapshots and their expiry, with no code and no extra service charge. What should a solutions architect recommend?

Answer: A — Amazon Data Lifecycle Manager, with a tag-targeted policy that creates and expires EBS snapshots on a schedule.

Amazon Data Lifecycle Manager (DLM) is the EBS-native, policy-based scheduler: you target volumes by tag and it creates snapshots on a cadence and deletes them by retention rule, at no additional charge and with no infrastructure to run. Why not the others: a cron job on EC2 and a hand-written Lambda both reintroduce the operational overhead and code you are trying to remove; and RDS automated backups apply to RDS databases, not to raw EBS volumes. AWS Backup could also schedule EBS, but for an EBS-only, no-cost, tag-based lifecycle the exam points at DLM.

SAA-C03 Question 4 of 7

A workload's recovery plan allows losing at most one hour of data, and it is protected only by scheduled EBS snapshots. Which setting most directly determines whether that objective is met?

Answer: A — The snapshot frequency — snapshots must be taken at least hourly so worst-case loss stays within the hour.

The recovery point objective is set by how often you back up: with hourly snapshots the most you can lose is the hour since the last one, so meeting a one-hour RPO means scheduling at least that frequently. Why not the others: retention decides how far back you can go and for how long copies survive, not how much data a failure loses; cross-Region copy count is about where you can restore, not the freshness of the restore point; and the volume type affects performance, not backup timing. Match the loss-tolerance requirement to backup frequency, and everything else to a different objective.

SAA-C03 Question 5 of 7

A compliance rule requires daily backups kept for 35 days and monthly backups kept for seven years, with old copies expiring automatically at the lowest storage cost and no manual pruning. What is the right way to implement this?

Answer: A — A backup plan with lifecycle rules — tiered retention that transitions to cold storage and deletes each copy automatically when its rule expires.

Retention and lifecycle rules in a backup plan express exactly this: different rules for daily and monthly copies, automatic transition of long-term copies to cold storage to cut cost, and automatic expiry when each rule's period ends — no human in the loop. Why not the others: keeping everything forever ignores the cost requirement and the defined retention; manual monthly deletion is the error-prone overhead the requirement rules out; and you cannot attach an S3 Lifecycle rule to the hidden, AWS-managed storage behind snapshots — the lifecycle lives in the backup or DLM policy, not on a bucket you own.

SAA-C03 Question 6 of 7

An RDS database is corrupted by a faulty deployment at 14:32. The team must recover it to its state at 14:31, immediately before the corruption, losing as little data as possible. Which recovery method fits best?

Answer: A — Point-in-time restore, which uses automated backups plus transaction logs to restore to any second in the retention window as a new instance.

Point-in-time restore (PITR) replays RDS automated backups and archived transaction logs to spin up a new instance at any chosen second within the retention window — so you can land on 14:31 exactly and lose almost nothing. Why not the others: restoring a snapshot only returns you to that snapshot's timestamp, which is coarser and likely minutes or hours stale; last night's manual snapshot loses a whole day; and a Multi-AZ failover copies the same corrupted data to the standby — it protects against an AZ failure, not a logical corruption. 'Recover to a specific second' is the PITR tell; 'recover to a backup point' is snapshot restore.

SAA-C03 Question 7 of 7

A security team must guarantee that backups spanning RDS, EBS and DynamoDB cannot be deleted or have their retention shortened before it expires — even by an administrator or a compromised set of credentials. What enforces this?

Answer: A — Store the backups in an AWS Backup vault protected by Vault Lock in compliance mode, making retention immutable.

Vault Lock in compliance mode makes an AWS Backup vault write-once-read-many: once locked, the retention rules cannot be shortened and backups cannot be deleted early by anyone — not an administrator, not the root user — until each recovery point's retention expires. Why not the others: an IAM deny can be edited or bypassed by whoever holds sufficient privilege, so it is a control, not a guarantee; MFA delete is an S3 bucket-versioning feature, not a Backup vault one; and KMS encryption protects confidentiality of the data, not immutability against deletion. When the requirement is 'cannot be removed early, no exceptions', it is Vault Lock.

That is exactly how every question in the course works — answer, explanation, why-not. The real set continues in the practice player: 10 free questions, no sign-up.

Continue with the 10 free questions →

Those 7 questions were the start.

The exam does not test whether you recognise a term — it tests whether you can rule out three plausible answers under time pressure. That is what the explanations above are for, and there are 780 more questions built exactly like them.

Collecting questions yourself

Scattered across forums, of unknown age
Answer keys without reasoning
No idea which domain you are weak in

Practising with a system

780 questions in 12 full tests, SAA-C03 (2026)
Every option explained — including the wrong ones
Readiness per exam domain, and drills for your weakest

Start free — 10 questions

Straight into the player. No account, no email.

Frequently asked questions

Are EBS snapshots incremental?

Yes. The first snapshot of a volume is a full copy; every snapshot after it stores only the blocks that changed since the previous one, all in Amazon S3 that AWS manages. That is why cost scales with how much data changes rather than with volume size, and why deleting an old snapshot is safe — AWS retains any blocks later snapshots still need.

AWS Backup or manual snapshots — which does the exam prefer?

It depends on scope. Manual snapshots and Amazon Data Lifecycle Manager suit EBS-only, low-overhead lifecycles. AWS Backup is the centralized plane when a single plan must enforce backups and retention across several services with a vault — and it adds Vault Lock immutability. Match the service breadth and the governance requirement in the stem to the right one.

Are these real exam questions?

No. They are original scenarios written for this page in the exam's style and difficulty. Reproducing real exam items violates the AWS certification agreement and can cost a candidate their certification — ours come with the reasoning attached instead.

Updated for SAA-C03 (July 2026). The sample questions above are our own work in the style of the exam — not real exam items. The exam itself is set and marked by the certification body.