DEA-C01 · Question #219
A company uses AWS Key Management Service (AWS KMS) to encrypt an Amazon Redshift cluster. The company wants to configure a cross-Region snapshot of the Redshift cluster as part of disaster recovery…
The correct answer is B. In the source AWS Region, enable snapshot copying. Specify the name of the snapshot copy D. Create a KMS key and configure a snapshot copy grant in the destination AWS Region. You must create a customer managed KMS key in the destination Region and then create a snapshot copy grant against that key so Redshift can re- encrypt the incoming snapshot with the destination CMK. In the source Region you then enable cross-Region snapshot copying and…
Question
A company uses AWS Key Management Service (AWS KMS) to encrypt an Amazon Redshift cluster. The company wants to configure a cross-Region snapshot of the Redshift cluster as part of disaster recovery (DR) strategy. A data engineer needs to use the AWS CLI to create the cross-Region snapshot. Which combination of steps will meet these requirements? (Choose two.)
Options
- ACreate a KMS key and configure a snapshot copy grant in the source AWS Region.
- BIn the source AWS Region, enable snapshot copying. Specify the name of the snapshot copy
- CIn the source AWS Region, enable snapshot copying. Specify the name of the snapshot copy
- DCreate a KMS key and configure a snapshot copy grant in the destination AWS Region.
- EConvert the cluster to a Multi-AZ deployment.
How the community answered
(47 responses)- A6% (3)
- B83% (39)
- C2% (1)
- E9% (4)
Explanation
You must create a customer managed KMS key in the destination Region and then create a snapshot copy grant against that key so Redshift can re- encrypt the incoming snapshot with the destination CMK. In the source Region you then enable cross-Region snapshot copying and reference the grant name you created in the destination Region. This tells Redshift which CMK (via the grant) to use when copying the encrypted snapshot into the DR Region.
Topics
Community Discussion
No community discussion yet for this question.