Restore DB Instances from Encrypted Snapshot

Correct Answer: B.

To restore a DB instance from shared encrypted snapshots, first, you need to create a copy of the DB snapshot & then need to create a DB instance from the copy of the snapshot.

Option A is incorrect as DB instances cannot be directly restored from an encrypted DB snapshot.

First, a copy needs to be created from an encrypted snapshot & then a DB instance can be restored from the copy.

Option C is incorrect as there is no need to create an unencrypted DB snapshot to restore a DB instance from an encrypted DB snapshot.

Option D is incorrect as there is no need to create an unencrypted DB snapshot to restore a DB instance from an encrypted DB snapshot.

For more information on restoring DB instance from an encrypted DB snapshot, refer to the following URL,

https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_ShareSnapshot.html

The correct option to restore a DB instance from an encrypted snapshot in this scenario would be to make a copy of the encrypted DB snapshot and then restore the DB instance from the copy (option B).

There are a few reasons why this is the correct approach:

1. Encryption: The original snapshot is encrypted, and the account that wants to restore the DB instances may not have access to the encryption key. Making a copy of the snapshot allows the account to restore the DB instances without needing access to the encryption key.

2. Data Consistency: When restoring from a snapshot, it is important to ensure that the restored DB instance has consistent data. If the original snapshot is being used by multiple accounts, there is a risk that the snapshot could be modified during the restore process. Creating a copy of the snapshot ensures that the restored DB instance will have a consistent view of the data.

3. Backup: Making a copy of the snapshot provides an additional backup of the data. If something were to go wrong during the restore process, having a copy of the snapshot allows for another attempt at restoring the DB instance.

It is also worth noting that options A, C, and D are not recommended:

• Option A: Directly restoring a DB instance from an encrypted snapshot would require the account to have access to the encryption key, which may not be possible.
• Option C: Creating an unencrypted snapshot from an encrypted snapshot would compromise the security of the data.
• Option D: Creating an unencrypted snapshot from an encrypted snapshot and then restoring a DB instance from the unencrypted snapshot would compromise the security of the data.