How to recover an RDS cluster to the last known good version after an attack?

SCS-C03 By islever Editorial Last updated

Respond to compromised resources and workloads.

Short answer

A Restore the RDS cluster to a point in time at 3:14 PM five days ago, just before the attack, using the Regional cluster ARN.

Question

A company recently experienced a malicious attack on its cloud-based environment. The company successfully contained and eradicated the attack A security engineer is performing incident response work. The security engineer needs to recover an Amazon RDS database cluster to the last known good version. The database cluster is configured to generate automated backups with a retention period of 14 days. The initial attack occurred 5 days ago at exactly 3:15 PM
Which solution will meet this requirement?
  1. Identify the Regional duster ARN for the database. Use the ARN to restore the Regional cluster by using the Restore to point in time feature. Set a target time 5 days ago at 3:14 PM. Correct Answer
  2. Identify the Regional cluster ARN for the database. List snapshots that have been taken of the cluster. Restore the database by using the snapshot that has a creation time that is closest to 5 days ago at 3:14 PM.
  3. List all snapshots that have been taken of all the company's RDS databases. Identify the snapshot that was taken closest to 5 days ago at 3:14 PM and restore it.
  4. Identify the Regional cluster ARN for the database. Use the ARN to restore the Regional cluster by using the Restore to point in time feature. Set a target time 14 days ago.

Key Takeaways

The exam tests whether you choose precise point-in-time recovery over snapshot selection, and the trap is restoring to the full 14-day retention boundary instead of to the moment just before compromise.

This SCS-C03 scenario tests recovery of an Amazon RDS database cluster after a malicious attack using automated backups. The page establishes that point-in-time restore to 3:14 PM five days ago, just before the attack, is the correct recovery action.

Common mistake: A common wrong answer is choosing the snapshot closest to the attack time or restoring to 14 days ago; snapshots are less precise, and the start of the retention window is not the last known good state.

Expert Analysis

Why the Answer Is Correct

Amazon RDS automated backups with a 14-day retention period make point-in-time recovery available for the entire retention window, including the point five days ago. Because the attack began at exactly 3:15 PM five days ago, the last known good state is immediately before that time, so restoring to 3:14 PM minimizes data loss while excluding the malicious changes. Option A correctly identifies the Regional cluster ARN and uses the Restore to point in time feature against that cluster. This is the precise recovery mechanism for an RDS database cluster after containment and eradication.

Why the Other Options Are Wrong

Option B relies on snapshots closest to the attack time, but snapshots are discrete recovery points and are less precise than point-in-time recovery. Option C is even broader and less controlled because it lists snapshots across all company RDS databases, which does not scope the restore to the affected cluster. Option D uses point-in-time recovery but sets the target to 14 days ago, which restores to the beginning of the retention window rather than the last known good state and needlessly loses valid data. None of these options achieves the required recovery point as accurately as Option A.

Community Comment Notes

The comments consistently favor point-in-time recovery. As 7f6aef3 explains, PITR provides second-level precision and setting 3:14 PM five days ago recovers the last good state with minimal data loss. Gonzales notes that "the right recovery method is point-in-time restore (PITR), not snapshot" because the database has automated backups with 14-day retention. Bigdata2ml also points to the official RestoreDBClusterToPointInTime API reference, which supports the PITR approach in Option A.

Official Reference

https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_RestoreDBClusterToPointInTime.html

This link opens the official vendor documentation in a new tab.

Exam Strategy

When a question gives an exact attack timestamp and automated backup retention, look for point-in-time recovery set just before the attack. Avoid answers that restore to the start of the retention period or depend only on the nearest snapshot, because those are less precise and cause unnecessary data loss.

Frequently Asked Questions

Why is restoring the snapshot closest to the attack time not precise enough?

Snapshots are discrete recovery points and may be hours away from the attack time. Point-in-time recovery can restore to a specific second just before the attack, minimizing data loss.

Why not set point-in-time recovery to 14 days ago?

That restores to the start of the retention window, not the last known good state before the attack. It would discard valid changes made after that earlier point and may hit the retention boundary.

More SCS-C03 FAQ →

Discussion 3 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 3

  1. gonzales 👍 1 Answered A
    The database has automated backups with 14-day retention, so the right recovery method is point-in-time restore (PITR), not snapshot. B is wrong, uses snapshots closest to the time. That is less precise than PITR.
  2. 7f6aef3 👍 1 Answered A
    Usa PITR (que permite precisión de segundos dentro de la retención) y fija el momento justo antes del ataque (3:14 PM de hace 5 días), recuperando el último estado bueno con la mínima pérdida de datos.
  3. bigdata2ml 👍 1 Answered A
    https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_RestoreDBClusterToPointInTime.html

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

How should a secured S3 CloudFormation template be shared across AWS Organizations?

S-grade

How to enforce MFA for AWS CLI EC2 commands?

S-grade

How Do You Disable a Compromised IAM Identity Center User and Audit Activity?

S-grade

How to Find S3 Buckets with Sensitive Data Using Macie with Least Overhead?

S-grade

Practice All SCS-C03 Questions

Access 86 questions with complete answers and detailed explanations.

View Full SCS-C03 Practice Test →

← Back to SCS-C03 Study Guide