nerdexam
Amazon

SAP-C02 · Question #820

A company needs to copy backups of 40 RDS for MySQL databases from a production account to a central backup account within AWS Organizations. The databases usedefault AWS-managed KMS encryption…

The correct answer is A. Restore the databases with customer-managed KMS keys and use AWS Backup with cross-. To enable cross-account backup of RDS MySQL databases encrypted with default AWS-managed KMS keys into a WORM-compliant central backup account, the databases must first be restored or re-encrypted using customer-managed KMS keys. Subsequently, AWS Backup, with its cross-account…

Submitted by ahmad_uae· Mar 6, 2026Continuous Improvement for Existing Solutions

Question

A company needs to copy backups of 40 RDS for MySQL databases from a production account to a central backup account within AWS Organizations. The databases usedefault AWS-managed KMS encryption keys. The backups must be stored in a WORM (Write Once Read Many)backup account. What is the correct approach to enable cross-account backup?

Options

  • ARestore the databases with customer-managed KMS keys and use AWS Backup with cross-
  • BShare the default KMS keys with the central account and create backup vaults in the central
  • CUse a Lambda function to decrypt and copy the snapshots to the central account.
  • DUse a Lambda function to share and re-encrypt snapshots across accounts using the default

How the community answered

(16 responses)
  • A
    75% (12)
  • B
    13% (2)
  • C
    6% (1)
  • D
    6% (1)

Why each option

To enable cross-account backup of RDS MySQL databases encrypted with default AWS-managed KMS keys into a WORM-compliant central backup account, the databases must first be restored or re-encrypted using customer-managed KMS keys. Subsequently, AWS Backup, with its cross-account management capabilities and support for immutable backup vaults (WORM), can be used to manage and store these backups in the central account.

ARestore the databases with customer-managed KMS keys and use AWS Backup with cross-Correct

Default AWS-managed KMS keys cannot be shared across accounts, so the databases must first be restored using customer-managed KMS keys to enable cross-account snapshot sharing and copying. AWS Backup then provides the functionality for centralized, cross-account backup management and supports WORM storage through immutable backup vaults.

BShare the default KMS keys with the central account and create backup vaults in the central

Default AWS-managed KMS keys (e.g., `aws/rds`) cannot be directly shared across AWS accounts, making this option technically impossible.

CUse a Lambda function to decrypt and copy the snapshots to the central account.

Decrypting snapshots would expose unencrypted data, which is a security risk and contradicts the goal of secure, encrypted WORM backups.

DUse a Lambda function to share and re-encrypt snapshots across accounts using the default

You cannot use default AWS-managed KMS keys for re-encryption or direct sharing of snapshots across accounts; a Customer Managed Key (CMK) is required for cross-account encryption operations.

Concept tested: Cross-account encrypted RDS snapshot backup

Source: https://aws.amazon.com/premiumsupport/knowledge-center/share-encrypted-rds-snapshot/

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full SAP-C02 Practice