SCS-C03 Data Protection Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Copy the snapshot to an unencrypted state, then share the unencrypted snapshot.

  Why it's wrong here

  Snapshots created with encrypted volumes cannot be converted to unencrypted snapshots. Security best practices dictate that you should never attempt to bypass encryption; instead, you must properly share the existing encrypted resources by modifying the key policy to permit cross-account access for the target entity.

• ✓

  Share the snapshot and update the KMS key policy to permit usage by the partner.

  Why this is correct

  Sharing the snapshot makes it visible to the partner, but they cannot decrypt it without access to the key. Updating the KMS key policy allows the partner's IAM entities to use the key for cryptographic operations, which is required to successfully restore or use the shared encrypted snapshot.

• ✗

  Export the snapshot to an S3 bucket and provide the partner with the S3 URL.

  Why it's wrong here

  Exporting a snapshot to S3 is an unnecessary and complex workaround that introduces potential security risks regarding data exposure in transit. Direct snapshot sharing is the native, secure, and supported method for sharing EBS volume data across accounts while maintaining full integration with AWS IAM and KMS.

• ✗

  Use AWS DataSync to copy the volume data directly to the partner account.

  Why it's wrong here

  DataSync is intended for moving data between storage systems, not for sharing EBS snapshots. Snapshot sharing is a built-in feature designed specifically for this use case, providing a streamlined and secure mechanism to grant access to persistent block storage data across different AWS accounts.