SOA-C03 practice question: AWS Backup and snapshots (2 of 2)

Reliability and Business Continuity A free question from our original SOA-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.

A pet insurer's AWS Backup plan in its production account must also copy each nightly recovery point into a vault in a separate backup account in the same AWS Organization. When the copy job runs, it fails with an access denied error. The production resources are encrypted with customer managed KMS keys that the backup account can use. Which TWO actions should a CloudOps engineer take to make the copy succeed? (Choose two.)

Choose two answers.

A. Turn on cross-account backup in the AWS Backup settings of the organization's management account.
B. Share the destination vault with the production account by using AWS Resource Access Manager.
C. Add an access policy to the destination vault that allows the production account to perform backup:CopyIntoBackupVault.
D. Turn on S3 Cross-Region Replication from the production vault's bucket to a bucket in the backup account.
E. Create an IAM user in the backup account and give its access keys to the AWS Backup service in the production account.

Show the answer and explanation

Answers: A, C

A. Right: Correct. Cross-account copy must be allowed for the organization from the management account. Until it is turned on, copy jobs between member accounts fail. Learn more: Creating backup copies across AWS accounts (opens in a new tab)
B. Wrong: Backup vaults are not shared through AWS RAM. Cross-account access to a vault is granted with the vault's own access policy. Learn more: What is AWS Resource Access Manager? (opens in a new tab)
C. Right: Correct. The destination vault must allow the source account to copy recovery points into it. A vault access policy grants that permission. Learn more: Access policies for backup vaults (opens in a new tab)
D. Wrong: Backup vaults are not S3 buckets you manage, so they cannot be replicated with S3 replication. Copies are made with copy actions in the backup plan. Learn more: Replicating objects within and across Regions (opens in a new tab)
E. Wrong: AWS Backup uses service roles and vault policies, not stored access keys. Long-term keys would also weaken security without fixing the copy. Learn more: Creating backup copies across AWS accounts (opens in a new tab)

Explanation

Cross-account copies in AWS Backup need the organization to allow them and the destination to accept them. The management account turns on cross-account backup, and the destination vault's access policy allows backup:CopyIntoBackupVault from the source account. Resources encrypted with customer managed keys also need key permissions for the destination, which this scenario already has.

SOA-C03 practice question: AWS Backup and snapshots (2 of 2)

Explanation

Study

Keep practicing