SAP-C02 Q601 · Database

Question

A company needs to copy backups of 40 RDS for MySQL databases from a production account to a central backup account within AWS Organizations. The databases usedefault AWS-managed KMS encryption keys. The backups must be stored in a WORM (Write Once Read Many) backup account. What is the correct approach to enable cross-account backup?

Accepted Answer

**Answer A is correct for these critical reasons:**

**Requirement 1: Cross-account backup of RDS databases**
→ AWS Backup natively supports cross-account backup when used within AWS Organizations. It can copy recovery points from a source account vault to a destination account vault.

**Requirement 2: The databases currently use AWS-managed (default) KMS keys**
→ This is the KEY constraint. **AWS-managed KMS keys (aws/rds) CANNOT be shared across accounts.** Their key policy is locked and cannot be modified to grant cross-account access. This means snapshots encrypted with these default keys cannot be directly copied or shared to another account.

**Requirement 3: WORM storage in backup account**
→ AWS Backup Vault Lock provides WORM compliance, making backups immutable once written.

**T

📖 Explanation

✅ Correct Answer

❌ Wrong Answers

📘 Key Concepts

🏗️ Architecture

⚙️ Operations

💰 Cost

🔒 Security

🎯 Exam Tips