SOA-C03 practice question: Encryption at rest and in transit

Security and Compliance A free question from our original SOA-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.

A solar installer's analytics account needs a copy of an EBS snapshot from the production account. The snapshot is encrypted with the AWS managed key aws/ebs because default EBS encryption was turned on with default settings. When the engineer tries to share it with the analytics account, the console does not allow it. What should a CloudOps engineer do to give the analytics account a usable copy?

Choose one answer.

A. Edit the key policy of the aws/ebs key to allow the analytics account, and then share the snapshot with that account.
B. Make the snapshot public for a few minutes so that the analytics account can copy it, then make it private again.
C. Copy the snapshot with a customer managed key, allow the analytics account in its key policy, and share it.
D. Turn off default EBS encryption in the production account and share the snapshot again, because it will then be decrypted.

Show the answer and explanation

Answer: C

A. Wrong: AWS managed keys have key policies that customers cannot edit. That is why snapshots encrypted with aws/ebs cannot be shared with another account. Learn more: Key policies in AWS KMS (opens in a new tab)
B. Wrong: Encrypted snapshots cannot be made public. Even if they could, exposing production data publicly would break basic security practice. Learn more: Share an Amazon EBS snapshot with other AWS accounts (opens in a new tab)
C. Right: Correct. A copy can be re-encrypted with a customer managed key, whose key policy can grant another account permission to use it. The copy can then be shared, and the analytics account can copy it with its own key. Learn more: Copy an Amazon EBS snapshot (opens in a new tab)
D. Wrong: Turning off default encryption affects only new volumes. Existing snapshots stay encrypted with the key they were created with. Learn more: Amazon EBS encryption (opens in a new tab)

Explanation

Snapshots encrypted with an AWS managed key cannot be shared, because other accounts can never be granted use of that key. The fix is to copy the snapshot with a customer managed key, grant the other account in that key's policy, and share the copy. The receiving account usually then makes its own copy encrypted with its own key.

SOA-C03 practice question: Encryption at rest and in transit

Explanation

Study

Keep practicing