A municipal database backup must be copyable to a second AWS Region for disaster recovery while remaining encrypted throughout. Which approach best meets that requirement at Associate depth?
Select an answer to reveal the explanation.
Short Explanation
DR copies should travel like sealed evidence bags—encrypted snapshots or Backup copies into Region B, still locked with KMS-aware patterns. Unencrypted emails and “we’ll encrypt after the breach” are not a municipal DR plan.
Full Explanation
Municipal database backups that must be copyable to a second AWS Region for disaster recovery while remaining encrypted should use encrypted snapshots or AWS Backup cross-Region copy workflows that preserve encryption with appropriate KMS key patterns in the destination Region. At Associate depth, that means understanding that CMKs are Region-scoped, so cross-Region copies typically involve a destination CMK (or an AWS Backup plan that specifies encryption) rather than shipping plaintext disks "to encrypt later." Encrypted-in, encrypted-across, encrypted-at-rest in Region B is the sealed evidence-bag model.
Copying unencrypted snapshots over the public internet and encrypting only after a breach is confirmed fails proactive confidentiality. Disabling snapshots and relying on a single AZ live volume fails DR entirely—no second Region, no backup set. Emailing nightly mysqldump files with passwords in the message body fails secrecy, transport security, and operational scale.
Exam caveat: restoring in Region B requires IAM principals and KMS grants in that Region; a perfect copy is useless if the DR role cannot decrypt. Operational check: create an encrypted backup/snapshot, copy it to the DR Region with a destination key, restore to a DR instance in an isolated account/VPC drill, and verify application login works without ever having disabled encryption on the copy path.