A company's SysOps administrator as created an Amazon EC2 instance with custom software that will be used as a template for all new EC2 instances across multiple AWS accounts. The Amazon Elastic…

Question

Options

• AIn the account where the AMI was created, create a customer master key (CMK).
• BIn the account where the AMI was created, create a customer master key (CMK).
• CIn the account where the AMI was created, create a customer master key (CMK).
• DIn the account where the AMI was created, modify the key policy of the AWS managed key to

• A
  5% (2)
• B
  84% (36)
• C
  2% (1)
• D
  9% (4)

Explanation

You have an EC2 instance with encrypted EBS volumes with AWS managed keys (key point right here). Then, you create an AMI from this EC2 instance. This means it will be encrypted with that same AWS managed key. The requirement is simple, use KMS managed keys and only share with authorized accounts. A - This starts good as you need a customer managed KMS key to be able to change the policy and add those kms actions to the other AWS accounts, however, that won't help with your AMI since it's still encrypted with the AWS managed key. C - this sounds good right up until the end, public kills it. even though they won't have the actions, you don't want to make it public. D - can't be D, you cannot modify the policy on a AWS managed key.

No community discussion yet for this question.