Q9 — AWS SAA-C03 Ch.11

Question 9 of 100 | ← Chapter 11

Q709. A company uses AWS Organizations for its multi-account AWS setup. The security organizational unit (OU) of the company needs to share approved Amazon Machine Images (AMIs) with the development OU. The AMls are created by using AWS Key Management Service (AWS KMS) encrypted snapshots.Which solution will meet these requirements? (Select TWO.)

• A. Add the development team's OU Amazon Resource Name (ARN) to the launch permission list for the AMls ✓
• B. Add the Organizations root Amazon Resource Name (ARN) to the launch permission list for the AMls
• C. Update the key policy to allow the development team's OU to use the AWS KMS keys that are used to decrypt the snapshots ✓
• D. Add the development team's account Amazon Resource Name (ARN) to the launch permission list for the AMls
• E. Recreate the AWS KMS key. Add a key policy to allow the Organizations root Amazon Resource Name (ARN) to use the AWS KMS key

Correct Answer: A. Add the development team's OU Amazon Resource Name (ARN) to the launch permission list for the AMls, C. Update the key policy to allow the development team's OU to use the AWS KMS keys that are used to decrypt the snapshots

Explanation

The correct answers are: A. Add the development team's OU Amazon Resource Name (ARN) to the launch permission list for the AMIsC. Update the key policy to allow the development team's OU to use the AWS KMS keys that are used to decrypt the snapshots Explanation: A. Adding the development team's OU ARN to the launch permission list for the AMIs allows the development team to launch the approved AMIs. C. Updating the key policy to allow the development team's OU to use the AWS KMS keys that are used to decrypt the snapshots is necessary because the AMIs are created using AWS KMS encrypted snapshots. The development team needs access to the KMS keys to be able to launch and use the AMIs. B. Adding the Organizations root ARN to the launch permission list for the AMIs is not necessary, as the development team's OU can be granted access directly. D. Adding the development team's account ARN to the launch permission list for the AMIs is not sufficient, as the entire OU needs to be granted access. E. Recreating the AWS KMS key and adding a key policy to allow the Organizations root ARN to use the AWS KMS key is not necessary, as the development team's OU can be granted access directly to the existing KMS key.