A company stores documents in an Amazon EFS file system that is encrypted with a KMS key. The file system is mounted to an EC2 instance running proprietary software. AWS Backup automatic backups are enabled using the AWS Backup default backup plan. The company must be able to recover deleted documents within an RPO of 100 minutes. Which approach will satisfy this requirement?

The correct approach is to create a new IAM role and a new AWS Backup plan, assign the new role to the plan, update the KMS key policy to grant the new role permissions to use the key, and schedule hourly backups. This meets the RPO of 100 minutes because hourly backups ensure that data loss is limited to a maximum of one hour. The default backup plan often has daily schedules, which would not meet the RPO. A new IAM role is needed if the existing default role lacks necessary permissions or if a more granular permission model is desired. Updating the KMS key policy is crucial for AWS Backup to access and encrypt/decrypt the EFS data. Incorrect options: Configuring a custom cron expression for 30-minute backups with the AWSServiceRoleForBackup might work for the RPO, but it relies on the default service role, which may not have the necessary KMS permissions by default for custom keys, and a new backup plan is still needed. Enabling continuous backups for point-in-time recovery is not supported for EFS with AWS Backup. Cross-Region replication enhances disaster recovery but doesn't directly address the RPO for deleted documents within the primary region; it also doesn't solve the scheduling frequency or KMS key access issues.