How to Encrypt Cross-Region EBS Backups with Least Overhead?

SOA-C03 By islever Editorial Last updated

Implement backup and restore strategies. Implement strategies to protect data and infrastructure.

Short answer

A Use an Amazon Data Lifecycle Manager lifecycle policy with cross-Region backups enabled and encrypt the snapshot copies with AWS KMS for all volumes.

Question

A company is expanding globally and needs to back up data on Amazon EBS volumes to a different AWS Region. Most of the EBS volumes that store the data are encrypted, but some of the EBS volumes are unencrypted. The company needs the backup data from all the EBS volumes to be encrypted.
Which solution will meet these requirements with the LEAST management overhead?
  1. Configure a lifecycle policy in Amazon Data Lifecycle Manager (Amazon DLM) to create the EBS volume snapshots with cross-Region backups enabled. Encrypt the snapshot copies by using AWS KMS. Correct Answer
  2. Create a point-in-time snapshot of the EBS volumes. When the snapshot status is COMPLETED, copy the snapshots to another Region and set the Encrypted parameter to False.
  3. Create a point-in-time snapshot of the EBS volumes. Copy the snapshots to an Amazon S3 bucket that uses server-side encryption. Turn on S3 CrossRegion Replication on the S3 bucket.
  4. Schedule an AWS Lambda function with the Python runtime. Configure the Lambda function to create the EBS volume snapshots, encrypt the unencrypted snapshots, and copy the snapshots to another Region.

Key Takeaways

This question tests least-overhead automation for encrypted cross-Region EBS backups, and the trap is choosing a custom Lambda workflow or a manual copy with Encrypted=False.

Cross-Region EBS snapshot backups must be encrypted even when some source volumes are unencrypted. This page establishes that an Amazon Data Lifecycle Manager lifecycle policy with KMS-encrypted cross-Region copies is the least-overhead solution.

Common mistake: The most common wrong answer is D, a Lambda function, because it sounds flexible, but it adds code, IAM, scheduling, and error-handling management that DLM eliminates.

Expert Analysis

Why the Answer Is Correct

Option A is correct because Amazon Data Lifecycle Manager is the managed EBS snapshot lifecycle service designed to create and copy snapshots on a schedule. A DLM lifecycle policy can create EBS volume snapshots and enable cross-Region backups, and the cross-Region copy action can specify encryption with a KMS key in the destination Region. Because DLM handles encrypted and unencrypted source volumes through the same policy, it satisfies the requirement that all backup data be encrypted. It also minimizes operational work: no custom code, no manual snapshot orchestration, and no separate cleanup process.

Why the Other Options Are Wrong

Option B is manual and explicitly sets Encrypted to False when copying the snapshot, which leaves the destination backup unencrypted and fails the core requirement. Option C incorrectly assumes EBS snapshots can be copied directly into an S3 bucket and then protected by S3 Cross-Region Replication; S3 CRR does not encrypt EBS snapshot backups or provide the required cross-Region EBS snapshot copy. Option D uses a custom Lambda function to create, encrypt, and copy snapshots, which adds code maintenance, IAM permissions, scheduling, monitoring, and failure handling compared with a DLM lifecycle policy. A point-in-time snapshot also does not provide the ongoing backup workflow that DLM manages.

Community Comment Notes

The only visible community input is from Bad_Mat, who selected option A. That aligns with the DLM-based answer and does not introduce any conflicting technical argument. Because there is no vote distribution or substantive debate in the comments, the decision rests on the AWS documentation and the least-overhead requirement.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

When the question asks for the least management overhead for recurring EBS backups and cross-Region copies, prefer the managed DLM lifecycle policy over custom Lambda automation. Also check the encryption direction: cross-Region snapshot copies must be encrypted with a KMS key in the destination Region, not left with Encrypted=False.

Frequently Asked Questions

Why is Encrypted=False in option B incorrect for cross-Region copies?

Setting Encrypted=False leaves the destination snapshot unencrypted; to encrypt a copy, the copy operation must specify Encrypted=True and a KMS key in the destination Region.

Why not use an AWS Lambda function instead of Amazon DLM for EBS snapshots?

A custom Lambda workflow requires maintaining code, IAM permissions, scheduling, and error handling, while DLM is a managed service built for snapshot lifecycle and cross-Region copy.

More SOA-C03 FAQ →

Discussion 1 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 1

  1. Bad_Mat 👍 1 Answered A
    A. Configure a lifecycle policy in Amazon Data Lifecycle Manager (Amazon DLM) to create the EBS volume snapshots with cross-Region backups enabled. Encrypt the snapshot copies by using AWS KMS

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Resolving Private IPv4 Exhaustion in AWS VPCs

S-grade

How Do You Ramp ALB Traffic Gradually During EC2 Cache Warm-Up?

S-grade

Avoiding Permanent Credentials with AWS STS

S-grade

Automate EC2 Reboot with Systems Manager Maintenance Windows

S-grade

Practice All SOA-C03 Questions

Access 100 questions with complete answers and detailed explanations.

View Full SOA-C03 Practice Test →

← Back to SOA-C03 Study Guide