FinSec engages an external auditor operating in a separate AWS account to analyze an encrypted EBS volume from a compromised instance. FinSec must maintain encryption and limit the auditor’s access to only this evidence. Which steps are required to provide the auditor a usable copy of the snapshot? (Choose two.)

To share an encrypted EBS snapshot across AWS accounts while maintaining encryption and limiting access, two key steps are required. First, the FinSec account must share the encrypted snapshot with the auditor's account. Crucially, the FinSec account must also grant the auditor's account permission to use the Customer Master Key (CMK) that encrypted the snapshot. This permission is necessary for the auditor to copy the snapshot. Second, in the auditor's account, the shared encrypted snapshot must be copied and re-encrypted using a CMK controlled by the auditor. This re-encryption ensures that the auditor has full control over the snapshot's encryption key within their own account, preventing FinSec from revoking access to the CMK and rendering the snapshot unusable for the auditor. Making the snapshot public is insecure and violates the requirement to limit access. Exporting to S3 via DataSync and then importing is an overly complex and indirect method for sharing an EBS snapshot. Creating and sharing an AMI is incorrect because encrypted AMIs, like encrypted snapshots, require sharing the underlying KMS key for the recipient to launch instances from them.