A company is hosting critical business data in an Amazon Redshift cluster. Due to the sensitive nature of the data, the cluster is encrypted at rest using AWS KMS. As a part of disaster recovery requi

Question

Options

• ACreate a new KMS customer master key in the source Region. Switch to the destination Region,
• BCreate a new IAM role with access to the KMS key. Enable Amazon Redshift cross-Region
• CEnable Amazon Redshift cross-Region snapshots in the source Region, and create a snapshot
• DCreate a new KMS customer master key in the destination Region and create a new IAM role with

• A
  2% (1)
• B
  14% (6)
• C
  80% (35)
• D
  5% (2)

Explanation

Explanation

Option C is correct because when copying encrypted Amazon Redshift snapshots to another Region, you must enable cross-Region snapshot copy in the source Region and create a snapshot copy grant in the destination Region - this grant allows Redshift to use a KMS key in the destination Region to re-encrypt the snapshot during the copy process.

Why the distractors are wrong:

• Option A is incorrect because creating a KMS key in the source Region and switching to the destination is the wrong sequence - the KMS key for re-encryption must exist in the destination Region, and the copy grant must be configured there before enabling the cross-Region copy.
• Option B is incorrect because an IAM role alone does not satisfy the requirement; the core mechanism is the snapshot copy grant tied to a destination-Region KMS key, not just IAM permissions.
• Option D is partially correct in mentioning a destination-Region KMS key, but is missing the essential step of enabling cross-Region snapshots in the source Region and creating the copy grant properly.

Memory Tip: Think "Grant before Copy, Destination Key for Destination Data" - always create the KMS snapshot copy grant in the destination Region first, then enable cross-Region snapshot copying in the source Region. This order ensures the encryption handoff is ready before any snapshot travels across Regions.

No community discussion yet for this question.