A company hosts frontend services on Amazon EC2 instances behind an Application Load Balancer. The EC2 instances use Amazon Elastic Block Store (Amazon EBS) volumes, and large image and music files are stored in Amazon S3. The company has implemented controls to prevent, detect, and isolate potential ransomware attacks and now wants a disaster recovery strategy to return to normal operations if an attacker bypasses those controls. The recovery point objective (RPO) is 1 hour. Which solution meets these requirements?

The correct solution meets the 1-hour RPO by performing hourly backups of EC2 instances (which include EBS volumes) and S3 buckets using AWS Backup. This ensures data can be restored from a point within the RPO. Storing CloudFormation templates in CodeCommit allows for rapid and consistent recreation of the entire architecture, which is crucial for disaster recovery. Incorrect options: Daily backups for EBS and S3 do not meet the 1-hour RPO. Security Lake is for detection, not direct recovery. Security Lake and Security Hub are for security monitoring and management, not primary disaster recovery mechanisms for data and infrastructure. While CloudFormation templates are good, the RPO is not met. EBS snapshots every 4 hours do not meet the 1-hour RPO. GuardDuty Malware Protection is a detection and prevention tool, not a comprehensive disaster recovery strategy for the entire application. Automating restoration based solely on a GuardDuty finding is too narrow for a full disaster recovery plan.