Crucial Exams

AWS Certified CloudOps Engineer Associate SOA-C03 Practice Question

An operations engineer must allow an EC2 instance that runs in Account B to download objects from an S3 bucket in Account A. The bucket uses server-side encryption with a customer-managed AWS KMS key that also resides in Account A. The solution must follow least privilege and require no ongoing administration. Which approach satisfies these requirements?

  • In Account A, update the KMS key policy to allow the instance's IAM role from Account B to use kms:Decrypt, add an S3 bucket policy granting that role s3:GetObject, and attach that role to the EC2 instance in Account B.

  • Create a cross-account grant on the KMS key that allows the root user of Account B to decrypt the key and rely on the bucket's default ACLs for object access.

  • In Account B, export a copy of the CMK from Account A, re-encrypt all objects in the bucket with the copied key, and give the instance s3:GetObject permission.

  • Change the bucket's default encryption to SSE-S3 and add a bucket policy permitting the instance role to call s3:GetObject.

AWS Certified CloudOps Engineer Associate SOA-C03
Security and Compliance
Your Score:
Settings & Objectives
Random Mixed
Questions are selected randomly from all chosen topics, with a preference for those you haven’t seen before. You may see several questions from the same objective or domain in a row.
Rotate by Objective
Questions cycle through each objective or domain in turn, helping you avoid long streaks of questions from the same area. You may see some repeat questions, but the distribution will be more balanced across topics.

Check or uncheck an objective to set which questions you will receive.

Wipe Score
Bash, the Crucial Exams Chat Bot
AI Bot