A company runs applications across hundreds of production AWS accounts in an AWS Organization and uses AWS Backup centrally. They want all backups to remain resilient even if privileged credentials in any production account are compromised. Which combination of measures will meet this requirement? (Choose three.)

To ensure backup resilience against compromised credentials, a multi-layered approach is necessary. Storing AWS Backup vaults in designated non-production accounts (cross-account backup) isolates backups from the production environment, preventing a compromise in a production account from directly affecting the backup storage. An SCP restricting modification of AWS Backup vaults at the AWS Organization level provides a guardrail, preventing even root users in member accounts from deleting or altering critical backup configurations. Implementing AWS Backup Vault Lock in compliance mode makes backups immutable for a defined retention period, even by the account root user, offering the strongest protection against deletion. Finally, implementing least-privilege access for the AWS Backup IAM service role minimizes the blast radius if that specific role is compromised. The option to configure backup frequency and lifecycle for cold tier storage doesn't directly address the resilience of backups against credential compromise, though it is good practice for cost and recovery. Configuring AWS Backup to write to an S3 bucket with Object Lock is not the primary mechanism for AWS Backup itself; AWS Backup vaults are the native, more integrated solution for this purpose.