Examkin

Question

Difficulty: MediumBackup and Restore Management

A company requires a centralized disaster recovery strategy for its database workloads. A SysOps Administrator must configure AWS Backup to copy snapshots of Amazon RDS DB instances from a production AWS account to a secure backup vault in a separate disaster recovery AWS account. Both accounts are members of the same organization in AWS Organizations. The copied snapshots must be encrypted using a customer managed key in the disaster recovery account.

Which of the following actions must the SysOps Administrator take to configure this copy operation? (Select TWO.)

  1. Enable the cross-account backup feature in the AWS Organizations management account.Answer
  2. Configure the backup vault access policy in the disaster recovery account to allow the production account to perform the copy action.Answer
  3. C
    Configure an Amazon RDS Read Replica in the disaster recovery account to automate the replication and failover of the database backups.
  4. D
    Grant permissions to encrypt the copies by attaching an IAM policy with KMS actions to the source AWS Backup service role, without updating the destination key policy.
  5. E
    Configure Amazon S3 Cross-Region Replication (CRR) to replicate the snapshot exports to the destination account's bucket without enabling versioning.

Answer

To configure AWS Backup cross-account copy operations, the SysOps Administrator must enable cross-account backup in the AWS Organizations management account, and configure the destination backup vault's access policy to allow the source account to perform the copy action.
The correct actions are enabling the cross-account backup feature in the AWS Organizations management account, and configuring the destination backup vault's access policy to allow the source account to perform the copy action. Enabling cross-account backup in the organization management account is required to allow AWS Backup to transfer resources across AWS accounts. In addition, the destination backup vault policy must permit the copy action from the source account or organization.

Step-by-Step Solution

1
Enable cross-account backup in the AWS Organizations management account.
Cross-account backup functionality is enabled for all member accounts within the AWS Organization.
This is a prerequisite for AWS Backup to copy backups across different accounts.
2
Configure the backup vault access policy in the disaster recovery account.
The destination vault accepts incoming copy requests from the source account.
The destination vault policy must explicitly allow the source account or organization to perform the copy action.
3
Configure the customer managed key policy in the disaster recovery account.
The source account service role is authorized to use the KMS key in the destination account.
Cross-account access to KMS keys requires the key policy in the destination account to explicitly authorize the IAM principal from the source account.

Key Concept

Centralized cross-account backup management and replication using AWS Backup in AWS Organizations.
Rate this question

Topics

Backup and Restore Management

More questions from this topic