AWS Certified Security - Specialty SCS-C02 — Topic 1 Question 45

Question

A company has recently recovered from a security incident that required the restoration of Amazon EC2 instances from snapshots. The company uses an AWS Key Management Service (AWS KMS) customer managed key to encrypt all Amazon Elastic Block Store (Amazon EBS) snapshots. The company performs a gap analysis of its disaster recovery procedures and backup strategies. A security engineer needs to implement a solution so that the company can recover the EC2 instances if the AWS account is compromised and the EBS snapshots are deleted. Which solution will meet this requirement?

Accepted Answer

Correct answer: C. The correct answer is C. Option C: Create a new AWS account that has limited privileges. Allow the new account to access the KMS key that encrypts the EBS snapshots. Copy the encrypted snapshots to the new account on a recurring basis. Amazon EBS provides block storage attached to a single EC2 instance. AWS KMS manages encryption keys and integrates with most AWS services for encryption at rest. By spanning multiple Availability Zones / adding redundancy, this option provides the high availability and resilience required.

AWS Certified Security - Specialty SCS-C02 — Question 45