DEA-C01 Data Security and Governance Practice Question
A company uses Amazon RDS for PostgreSQL with encryption at rest using AWS KMS. The company needs to share a database snapshot with a different AWS account. What must be done to allow the target account to restore the snapshot?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Share the snapshot and update the KMS key policy to allow the target account to use the key
Cross-account snapshot sharing of an encrypted snapshot requires both sharing the snapshot and granting the target account permission to use the KMS key via the key policy. Option A is incorrect because copying does not grant the necessary key access. Option B is incorrect because IAM roles are not used for this purpose; KMS key policies are the mechanism for cross-account access. Option D is incorrect because encryption cannot be disabled on an existing encrypted snapshot.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Copy the snapshot to the target account's region and share it
Why it's wrong here
Copying does not grant access to the encrypted snapshot.
- ✗
Create an IAM role in the source account that allows cross-account snapshot access
Why it's wrong here
IAM roles are not used for snapshot sharing.
- ✓
Share the snapshot and update the KMS key policy to allow the target account to use the key
Why this is correct
The target account needs decrypt permission on the KMS key.
- ✗
Disable encryption on the snapshot before sharing
Why it's wrong here
Encryption cannot be disabled on an existing snapshot.
Go deeper
Related to this question
About these practice questions
One of 1,711 original DEA-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DEA-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DEA-C01 exam.