A company needs its Amazon Elastic Block Store (Amazon EBS) volumes to be encrypted at all times. During a security incident, a security engineer attempts to share a snapshot of a suspicious EBS volume to the company's forensics account for analysis. The security engineer receives the following error:
"Unable to share snapshot: An error occurred (OperationNotPermitted) when calling the ModifySnapshotAttribute operation: Encrypted snapshots with EBS default key cannot be shared."
Which combination of steps should the security engineer take in the incident account to complete the sharing operation? (Choose three.)

A. Create an AWS Key Management Service (AWS KMS) customer managed key. Copy the snapshot of the suspicious EBS volume. Encrypt the copy of the snapshot by using the new KMS key.

B. Allow principals in the forensics account to use the AWS Key Management Service (AWS KMS) customer managed key by modifying the key policy.

C. Launch an Amazon EC2 instance. Attach the encrypted and suspicious EBS volume. Copy the data from the suspicious EBS volume to an unencrypted EBS volume. Create a snapshot of the unencrypted EBS volume.

D. Copy the snapshot to the new decrypted snapshot.

E. Restore an EBS volume from the snapshot of the suspicious EBS volume. Create an unencrypted EBS volume of the same size.

F. Share the encrypted snapshot with the forensics account.




 

Suggested Answer: ABF

Community Answer: ABF




This question is in SCS-C01 AWS Certified Security – Specialty Exam
For getting AWS Certified Security – Specialty Certificate


Disclaimers:
The website is not related to, affiliated with, endorsed or authorized by Amazon.
Trademarks, certification & product names are used for reference only and belong to Amazon.
The website does not contain actual questions and answers from Amazon's Certification Exam.