How to recover an RDS cluster to the last known good version after an attack?
A company recently experienced a malicious attack on its cloud-based environment. The company successfully contained and eradicated the attack A security engineer is performing incident response work. The security engineer needs to recover an Amazon RDS database cluster to the last known good version. The database cluster is configured to generate automated backups with a retention period of 14 days. The initial attack occurred 5 days ago at exactly 3:15 PM Which solution will meet this requirement?
Community Insight
The exam tests whether you choose precise point-in-time recovery over snapshot selection, and the trap is restoring to the full 14-day retention boundary instead of to the moment just before compromise.
This SCS-C03 scenario tests recovery of an Amazon RDS database cluster after a malicious attack using automated backups. The page establishes that point-in-time restore to 3:14 PM five days ago, just before the attack, is the correct recovery action.
A common wrong answer is choosing the snapshot closest to the attack time or restoring to 14 days ago; snapshots are less precise, and the start of the retention window is not the last known good state.
Community Discussion (3 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Amazon RDS automated backups with a 14-day retention period make point-in-time recovery available for the entire retention window, including the point five days ago. Because the attack began at exactly 3:15 PM five days ago, the last known good state is immediately before that time, so restoring to 3:14 PM minimizes data loss while excluding the malicious changes. Option A correctly identifies the Regional cluster ARN and uses the Restore to point in time feature against that cluster. This is the precise recovery mechanism for an RDS database cluster after containment and eradication.Why the Other Options Are Wrong
Option B relies on snapshots closest to the attack time, but snapshots are discrete recovery points and are less precise than point-in-time recovery. Option C is even broader and less controlled because it lists snapshots across all company RDS databases, which does not scope the restore to the affected cluster. Option D uses point-in-time recovery but sets the target to 14 days ago, which restores to the beginning of the retention window rather than the last known good state and needlessly loses valid data. None of these options achieves the required recovery point as accurately as Option A.Community Comment Notes
The comments consistently favor point-in-time recovery. As 7f6aef3 explains, PITR provides second-level precision and setting 3:14 PM five days ago recovers the last good state with minimal data loss. Gonzales notes that "the right recovery method is point-in-time restore (PITR), not snapshot" because the database has automated backups with 14-day retention. Bigdata2ml also points to the official RestoreDBClusterToPointInTime API reference, which supports the PITR approach in Option A.Official Reference
Exam Strategy
When a question gives an exact attack timestamp and automated backup retention, look for point-in-time recovery set just before the attack. Avoid answers that restore to the start of the retention period or depend only on the nearest snapshot, because those are less precise and cause unnecessary data loss.
Frequently Asked Questions
Why is restoring the snapshot closest to the attack time not precise enough?
Snapshots are discrete recovery points and may be hours away from the attack time. Point-in-time recovery can restore to a specific second just before the attack, minimizing data loss.
Why not set point-in-time recovery to 14 days ago?
That restores to the start of the retention window, not the last known good state before the attack. It would discard valid changes made after that earlier point and may hit the retention boundary.
Related Analysis
Practice All SCS-C03 Questions
Access 86 questions with complete answers and detailed explanations.
View Full SCS-C03 Practice Test →