The production Region may be unavailable during a disaster.
Backups must be stored in another Region and remain encrypted there.
Choose TWO appropriate design elements.
Configure AWS Backup cross-Region copies and encrypt the destination copy with a KMS key in the destination Region.
Detailed explanation
Moving a plaintext backup weakens data protection and is unnecessary for cross-Region copy.
Moving a plaintext backup weakens data protection and is unnecessary for cross-Region copy.
A destination key preserves an explicit encryption boundary in the Region that stores the recovery point.
A destination key preserves an explicit encryption boundary in the Region that stores the recovery point.
Backups in the failed Region do not provide independent recovery from a regional outage.
Backups in the failed Region do not provide independent recovery from a regional outage.
Cross-Region copy stores recovery points outside the production Region for regional disaster recovery.
Cross-Region copy stores recovery points outside the production Region for regional disaster recovery.
Check official documentation
Compare the following points with the official documentation.
AWS Backupのクロスリージョンコピーと暗号化の公式説明を確認する。
What to confirm
バックアップの複製先と暗号化キーをリージョン単位で設計できる。
Key points
- AWS Backup
- Cross-Region copy
- Destination KMS key
Notes
- Environment: AWS公式Backup・KMSドキュメントの確認
- Confirm current AWS service behavior in the official documentation.
Foundation review
Independent failure domain
A destination Region provides recovery data outside the failure domain of production.
Encryption locality
Using a destination key makes the protection boundary explicit where the copy is stored.