Amazon Exam DOP-C02 Topic 4 Question 55 Discussion

Actual exam question for Amazon's DOP-C02 exam

Question #: 55
Topic #: 4

A company must encrypt all AMIs that the company shares across accounts. A DevOps engineer has access to a source account where an unencrypted custom AMI has been built. The DevOps engineer also has access to a target account where an Amazon EC2 Auto Scaling group will launch EC2 instances from the AMI. The DevOps engineer must share the AMI with the target account.

The company has created an AWS Key Management Service (AWS KMS) key in the source account.

Which additional steps should the DevOps engineer perform to meet the requirements? (Choose three.)

AIn the source account, copy the unencrypted AMI to an encrypted AMI. Specify the KMS key in the copy action.

BIn the source account, copy the unencrypted AMI to an encrypted AMI. Specify the default Amazon Elastic Block Store (Amazon EBS) encryption key in the copy action.

CIn the source account, create a KMS grant that delegates permissions to the Auto Scaling group service-linked role in the target account.

DIn the source account, modify the key policy to give the target account permissions to create a grant. In the target account, create a KMS grant that delegates permissions to the Auto Scaling group service-linked role.

EIn the source account, share the unencrypted AMI with the target account.

FIn the source account, share the encrypted AMI with the target account.

Show Suggested Answer

Suggested Answer: A, D, F

The Auto Scaling group service-linked role must have a specific grant in the source account in order to decrypt the encrypted AMI. This is because the service-linked role does not have permissions to assume the default IAM role in the source account.

The following steps are required to meet the requirements:

In the source account, copy the unencrypted AMI to an encrypted AMI. Specify the KMS key in the copy action.

In the source account, create a KMS grant that delegates permissions to the Auto Scaling group service-linked role in the target account.

In the source account, share the encrypted AMI with the target account.

In the target account, attach the KMS grant to the Auto Scaling group service-linked role.

The first three steps are the same as the steps that I described earlier. The fourth step is required to grant the Auto Scaling group service-linked role permissions to decrypt the AMI in the target account.

by Eden at Oct 28, 2025, 07:24 PM

Limited Time Offer

25%

Off

Get Premium DOP-C02 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Tawanna

2 hours ago

Based on the question, I believe the right steps are A, C, and F. Copying the AMI to an encrypted version, creating a KMS grant in the source account, and then sharing the encrypted AMI.

upvoted 0 times

...