Q53 — AWS SAA-C03 Ch.16

Question 53 of 100 | ← Chapter 16

Q1253. Alarge company requires a data backup strategy. The solution must replicate long-term backups from a source AWS account to a dedicated backup AWS account.All backups must be encrypted.The encryption keys must be available for both encryption and decryption operations in the source account and the backun account.Only specific AWS accounts,resource,and users must have access permissions for the encryption keys.Which solution will meet these requirements?

• A. Deploy a third-party encryption solution from the AWS Marketplace in the source account to manage the encryption keys. Create an AWS Lambda function that is invoked by a custom event to replicate backups to the backup account.
• B. Use AWS-managed AWS KMS keys that have default policies for encryption.Create an AWS Lambda function that is invoked by AWS Backup events that have a status of COMPLETED in Amazon EventBridge. Configure the function to replicate backups to the backup account.
• C. Deploy an AWS CloudHSM cluster in the source account to manage the encryption keys. Create an AWS Lambda function that is invoked by AWS Backup events that have a status of COMPLETED in Amazon EventBridge. Configure the function to replicate backups to the backup account.
• D. Use customer-managed AWS KMS keys that have appropriate policies attached in both the source account and the backup account. Configure AWS Backup to automate the backup and replication process. ✓

Correct Answer: D. Use customer-managed AWS KMS keys that have appropriate policies attached in both the source account and the backup account. Configure AWS Backup to automate the backup and replication process.

Explanation

The best solution that meets all requirements is Option D, which uses customer-managed AWS KMS keys with appropriate policies and AWS Backup for automation. Here's the detailed analysis:Key Requirements:Replicate long-term backups from a source AWS account to a dedicated backup account. All backups must be encrypted, with keys accessible in both accounts for encryption/decryption. Fine-grained access control (only specific AWS accounts, resources, and users can access keys). Automated and secure replication (no manual intervention).Analysis of Options:A. Third-party encryption + Lambda replicationFails on multiple fronts:Third-party solutions may not integrate seamlessly with AWS Backup or KMS for cross-account key access.Lambda-triggered replication adds complexity (custom event handling, error handling). No native AWS encryption/key management, increasing security risks.B. AWS-managed KMS keys + Lambda replicationFails on key accessibility:AWS-managed KMS keys cannot be shared across accounts (default policies restrict access). Lambda replication is still needed, adding operational overhead.C. AWS CloudHSM + Lambda replicationOverly complex and unnecessary:CloudHSM is a hardware-based solution for high-security compliance (e.g., FIPS 140-2 Level 3), but it's expensive and complex for this use case.Lambda replication is still required, and CloudHSM doesn't simplify cross-account key sharing.D. Customer-managed KMS keys + AWS Backup automationBest Choice:Customer-managed KMS keys allow cross-account access via key policies (grants permissions to the backup account).AWS Backup natively supports:Encryption with KMS keys (both source and backup accounts can use the same key or a key in each account with cross-account trust).Automated replication to another AWS account (via backup vault policies). Fine-grained access control via IAM policies and KMS key policies.Why Option D is Superior:Native AWS Integration: AWS Backup + KMS work seamlessly together. Cross-Account Key Access: KMS key policies can grant decrypt permissions to the backup account. Fully Automated: No Lambda needed--AWS Backup handles replication on a schedule. Cost-Effective: No third-party tools or expensive HSM clusters. Secure & Compliant: KMS provides audit logs (CloudTrail) and FIPS 140-2 Level 2 compliance.Implementation Steps for Option D:Create a Customer-Managed KMS Key in the Source Account:Define a key policy that grants:kms:Encrypt, kms:Decrypt, kms:ReEncrypt* to the source account's IAM roles. kms:Decrypt to the backup account's IAM roles (via Principal ARN).Configure AWS Backup in the Source Account:Create a backup plan with:Backup vault (enable cross-account replication).Lifecycle rules (retain backups for the required period).KMS key selection (use the customer-managed key).Assign resources (e.g., EBS volumes, RDS databases) to the backup plan.Set Up Cross-Account Access:In the backup account, create an IAM role with permissions to access the backup vault. Ensure the source account's backup vault policy allows replication to the backup account.Monitor & Audit:Use AWS Backup Audit Manager and CloudTrail to track backup/restore operations.Final Answer:DThis solution meets all requirements with minimal complexity, strong security, and full automation.