DBS-C01 · Question #140
A company wants to migrate its on-premises MySQL databases to Amazon RDS for MySQL. To comply with the company's security policy, all databases must be encrypted at rest. RDS DB instance snapshots…
The correct answer is A. Create an RDS for MySQL DB instance with an AWS Key Management Service (AWS KMS). You can't share a snapshot that has been encrypted using the default KMS key of the AWS account that shared the snapshot, therefore it must be encrypted with a customer managed key. https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_ShareSnapshot.html
Question
A company wants to migrate its on-premises MySQL databases to Amazon RDS for MySQL. To comply with the company's security policy, all databases must be encrypted at rest. RDS DB instance snapshots must also be shared across various accounts to provision testing and staging environments. Which solution meets these requirements?
Options
- ACreate an RDS for MySQL DB instance with an AWS Key Management Service (AWS KMS)
- BCreate an RDS for MySQL DB instance with an AWS managed CMK.
- CCreate an RDS for MySQL DB instance with an AWS owned CMK.
- DCreate an RDS for MySQL DB instance with an AWS CloudHSM key.
How the community answered
(54 responses)- A78% (42)
- B7% (4)
- C4% (2)
- D11% (6)
Explanation
You can't share a snapshot that has been encrypted using the default KMS key of the AWS account that shared the snapshot, therefore it must be encrypted with a customer managed key. https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_ShareSnapshot.html
Topics
Community Discussion
No community discussion yet for this question.