PAS-C01 Operations and Maintenance Practice Question
An SAP administrator is troubleshooting a failed backup of an SAP HANA database running on an EC2 instance. The backup is configured to use AWS Backup with a backup vault. The error log shows: 'AccessDenied: User: arn:aws:sts::123456789012:assumed-role/AWSBackupRole/backup-job is not authorized to perform: kms:Decrypt on resource: arn:aws:kms:us-east-1:123456789012:key/abcd1234-...' Which IAM policy modification is required to resolve this issue?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add kms:Decrypt permission to the backup role on the KMS key.
The error indicates that the backup role is missing the kms:Decrypt permission on the KMS key used to encrypt the backup vault. This permission is necessary to decrypt the data during the backup process. Option A is incorrect because cloudhsm:Decrypt is unrelated to KMS keys. Option C is incorrect because kms:CreateGrant is used to create grants for cross-account access, not for decryption. Option D is incorrect because kms:Encrypt is used for encryption, not decryption.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Add cloudhsm:Decrypt permission to the backup role.
Why it's wrong here
CloudHSM is a different service; this error is related to KMS, not CloudHSM.
- ✓
Add kms:Decrypt permission to the backup role on the KMS key.
Why this is correct
The error shows that the backup role is not authorized to perform kms:Decrypt on the KMS key; adding this permission will resolve the issue.
- ✗
Add kms:CreateGrant permission to the backup role.
Why it's wrong here
kms:CreateGrant is not required for accessing the backup vault; it is used for creating grants for other AWS services.
- ✗
Add kms:Encrypt permission to the backup role.
Why it's wrong here
The error indicates a failure to decrypt, not encrypt; kms:Encrypt would not resolve the issue.
Visual reference
Go deeper
Related to this question
About these practice questions
This PAS-C01 question is part of Courseiva's 1,616-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PAS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PAS-C01 exam.