AWS Certified Solutions Architect Associate · Free Practice Question Medium
Question 7
The DevOps team at a multi-national company is helping its subsidiaries standardize Amazon EC2 instances by using the same Amazon Machine Image (AMI). Some of these subsidiaries are in the same AWS region but use different AWS accounts whereas others are in different AWS regions but use the same AWS account as the parent company. The DevOps team has hired you as a solutions architect for this project.
Which of the following would you identify as CORRECT regarding the capabilities of an Amazon Machine Image (AMI)? (Select three)
-
A
You cannot copy an Amazon Machine Image (AMI) across AWS Regions
-
B
Copying an Amazon Machine Image (AMI) backed by an encrypted snapshot results in an unencrypted target snapshot
-
C
You can copy an Amazon Machine Image (AMI) across AWS Regions
-
D
You can share an Amazon Machine Image (AMI) with another AWS account
-
E
You cannot share an Amazon Machine Image (AMI) with another AWS account
-
F
Copying an Amazon Machine Image (AMI) backed by an encrypted snapshot cannot result in an unencrypted target snapshot
Reveal correct answers
Correct answers: C, D, F
Explanation
Correct options:
You can copy an Amazon Machine Image (AMI) across AWS Regions
You can share an Amazon Machine Image (AMI) with another AWS account
Copying an Amazon Machine Image (AMI) backed by an encrypted snapshot cannot result in an unencrypted target snapshot
An Amazon Machine Image (AMI) provides the information required to launch an instance. An AMI includes the following:
One or more Amazon EBS snapshots, or, for instance-store-backed AMIs, a template for the root volume of the instance.
Launch permissions that control which AWS accounts can use the AMI to launch instances.
A block device mapping that specifies the volumes to attach to the instance when it's launched.
You can copy an AMI within or across AWS Regions using the AWS Management Console, the AWS Command Line Interface or SDKs, or the Amazon EC2 API, all of which support the CopyImage action. You can copy both Amazon EBS-backed AMIs and instance-store-backed AMIs. You can copy AMIs with encrypted snapshots and also change encryption status during the copy process. Therefore, the option - "You can copy an AMI across AWS Regions" - is correct.
Copying AMIs across regions:
The following table shows encryption support for various AMI-copying scenarios. While it is possible to copy an unencrypted snapshot to yield an encrypted snapshot, you cannot copy an encrypted snapshot to yield an unencrypted one. Therefore, the option - "Copying an AMI backed by an encrypted snapshot cannot result in an unencrypted target snapshot" is correct.
You can share an AMI with another AWS account. To copy an AMI that was shared with you from another account, the owner of the source AMI must grant you read permissions for the storage that backs the AMI, either the associated Amazon EBS snapshot (for an Amazon EBS-backed AMI) or an associated S3 bucket (for an instance store-backed AMI). Therefore, the option - "You can share an AMI with another AWS account" - is correct.
Incorrect options:
You cannot copy an Amazon Machine Image (AMI) across AWS Regions
You cannot share an Amazon Machine Image (AMI) with another AWS account
Copying an Amazon Machine Image (AMI) backed by an encrypted snapshot results in an unencrypted target snapshot
These three options contradict the details provided in the explanation above.
Reference:
https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/CopyingAMIs.html
Discussion
Think the marked answer is wrong, or have a better explanation? Share it below — comments appear after review.
