DVA-C02 Development with AWS Services Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  1. Create a KMS key, 2. Create a snapshot of the unencrypted EBS volume, 3. Copy the snapshot with encryption (specifying the KMS key), 4. Create a new encrypted EBS volume from the encrypted snapshot.

  Why this is correct

  This is the correct order because you need a KMS key to encrypt the snapshot copy, then you create a snapshot of the original volume, copy that snapshot with encryption using the KMS key, and finally create a new encrypted volume from the encrypted snapshot.

• ✗

  1. Create a snapshot of the unencrypted EBS volume, 2. Create a KMS key, 3. Copy the snapshot with encryption, 4. Create a new encrypted EBS volume from the encrypted snapshot.

  Why it's wrong here

  Creating a snapshot of an unencrypted EBS volume first, then attempting to create a KMS key, places the key creation step too late in the process. The `CopySnapshot` API call, which is essential for enabling encryption on an unencrypted snapshot, requires a `KmsKeyId` parameter to be specified at the time of the copy operation. Without an existing KMS key, the command to copy the snapshot with encryption would fail, as the encryption key cannot be referenced or applied.

• ✗

  1. Create a KMS key, 2. Create a snapshot of the unencrypted EBS volume, 3. Create a new encrypted EBS volume directly from the unencrypted snapshot.

  Why it's wrong here

  This sequence is incorrect because an unencrypted EBS snapshot cannot be directly used to create an encrypted EBS volume. EBS snapshots inherently retain the encryption status of their source volume, meaning an unencrypted snapshot will always result in an unencrypted volume if used directly. To introduce encryption, the snapshot itself must first undergo a `CopySnapshot` operation where encryption is explicitly enabled and a KMS key is specified, thereby creating an *encrypted* copy of the snapshot.

• ✗

  1. Create an encrypted EBS volume, 2. Attach it to an EC2 instance, 3. Migrate data from the unencrypted volume, 4. Detach and delete the unencrypted volume.

  Why it's wrong here

  While this method describes a valid approach for migrating data to a new encrypted EBS volume, it does not represent the snapshot-based encryption process that the question implicitly asks for. The steps outlined involve manually provisioning a new encrypted volume, attaching it, and then performing a data transfer from the original unencrypted volume. This is a data migration strategy, distinct from the AWS-native process of encrypting an existing volume's data by leveraging snapshot copy functionality with KMS.

Go deeper

Related to this question