DOP-C02 Security and Compliance Practice Question
A company uses AWS KMS to encrypt EBS volumes. The security team wants to ensure that EBS snapshots are shared with another account without exposing the underlying data. What is the correct approach?
⚠ Common exam trap
Many exam-takers confuse sharing the KMS key itself (which is impossible) with updating the key policy to grant cross-account usage, leading them to select Option C.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Share the encrypted snapshot and update the KMS key policy to allow the target account to use the key.
Sharing an encrypted EBS snapshot requires the KMS key policy to grant the target account permission to use the key (via kms:Decrypt and kms:CreateGrant). Without this, the target account cannot decrypt the snapshot to create volumes or copies. AWS KMS enforces that the key policy explicitly allows cross-account access, and the target account must have the corresponding IAM permissions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Share the encrypted snapshot without modifying the KMS key policy.
Why it's wrong here
Sharing the encrypted snapshot alone does not grant the target account any access to the AWS KMS customer managed key that encrypted it. Without a cross-account statement in the KMS key policy allowing the target account's principal to call kms:Decrypt and kms:CreateGrant, the target account cannot decrypt the snapshot's data and therefore cannot create an encrypted EBS volume from it.
- ✗
Create an unencrypted copy of the snapshot and share it.
Why it's wrong here
Creating an unencrypted copy of the snapshot disables the encryption at rest that AWS KMS provides, directly exposing the volume data as plaintext once a volume is created from the copy. This violates the security requirement that data at rest remain encrypted; moreover, an unencrypted snapshot can be shared without any KMS involvement, but that defeats the entire purpose of using AWS KMS for EBS encryption.
- ✗
Share the encrypted snapshot and also share the KMS key with the target account.
Why it's wrong here
AWS KMS customer managed keys are not shareable objects; you cannot 'share' the key itself with another account. The correct approach is to add the target account's root principal to the KMS key policy, not to transfer or expose the key material. Attempting to share the key would either be impossible or would involve exporting key material, which is unsupported for EBS-encrypted snapshots and would severely compromise the key's security.
- ✓
Share the encrypted snapshot and update the KMS key policy to allow the target account to use the key.
Why this is correct
To securely share an encrypted snapshot, the source account must share the snapshot and modify the KMS key policy to include a statement that grants the target account's root principal the kms:Decrypt and kms:CreateGrant permissions needed to use the customer managed key. After adding this cross-account authorization, the target account can create an encrypted EBS volume from the shared snapshot. The target account's IAM user or role must also have corresponding EBS and KMS permissions, but the key policy is the critical mechanism that enables cross-account decryption.
Go deeper
Related to this question
About these practice questions
One of 1,013 original DOP-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.