Tax archives need automated cross-Region backup copies encrypted with KMS keys usable in the destination Region. Which design is appropriate?
Select an answer to reveal the explanation.
Short Explanation
Shipping tax archives to another Region only works if the locksmith there has a key that opens the box. Automate the copy and use destination-usable KMS keys. Laptop mule runs, source-only keys, or plaintext copies fail the DR encryption test.
Full Explanation
Tax archives that need automated cross-Region backup copies must be encrypted with KMS keys usable in the destination Region—replica keys or destination CMKs—so restore operators in the DR Region can decrypt without depending on a source-only key. Automation through AWS Backup copy jobs or snapshot copy pipelines removes reliance on staff memory for regional copies. Together, automation and destination-usable encryption meet both durability and recoverability requirements for municipal tax archives.
Manually downloading backups to a laptop and re-uploading when staff remember is neither automated nor trustworthy custody for tax archives. Copying snapshots cross-Region but encrypting only with a CMK that exists solely in the source Region blocks decryption in the destination when DR is invoked. Leaving destination copies unencrypted to avoid KMS complexity fails encryption requirements for regulated tax data.
Exam caveat: KMS keys are Regional; cross-Region encrypted copies need multi-Region keys or a CMK in the destination—source-only CMKs are a common SAP-C02 trap on backup questions. Operational check: configure automated cross-Region copies, encrypt with a destination-usable key, perform a restore in the DR Region, and confirm decrypt succeeds without calling back to the source Region’s sole key.