SOA-C03 practice question: Encryption at rest and in transit
Security and Compliance A free question from our original SOA-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.
A solar installer's analytics account needs a copy of an EBS snapshot from the production account.
The snapshot is encrypted with the AWS managed key aws/ebs because default EBS encryption was turned on with default settings. When the engineer tries to share it with the analytics account, the console does not allow it.
What should a CloudOps engineer do to give the analytics account a usable copy?
Choose one answer.
AA. Edit the key policy of the aws/ebs key to allow the analytics account, and then share the snapshot with that account.
BB. Make the snapshot public for a few minutes so that the analytics account can copy it, then make it private again.
CC. Copy the snapshot with a customer managed key, allow the analytics account in its key policy, and share it.
DD. Turn off default EBS encryption in the production account and share the snapshot again, because it will then be decrypted.
C. Right: Correct. A copy can be re-encrypted with a customer managed key, whose key policy can grant another account permission to use it. The copy can then be shared, and the analytics account can copy it with its own key. Learn more: Copy an Amazon EBS snapshot (opens in a new tab)
Snapshots encrypted with an AWS managed key cannot be shared, because other accounts can never be granted use of that key. The fix is to copy the snapshot with a customer managed key, grant the other account in that key's policy, and share the copy. The receiving account usually then makes its own copy encrypted with its own key.
Want more on Encryption at rest and in transit? The 5 full-length practice sets have 9 more Encryption at rest and in transit questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →