ExpertMedium1 markMultiple Choice
AWS SAA-C03 · Question 18 · Domain 1.3: Data Security
A company requires that all EBS volumes attached to new EC2 instances must be encrypted. How can a solutions architect ensure this requirement is met with the LEAST operational overhead? (Select TWO.)
A company requires that all EBS volumes attached to new EC2 instances must be encrypted. How can a solutions architect ensure this requirement is met with the LEAST operational overhead? (Select TWO.)
Answer options:
A.
Create an IAM policy that denies the ec2:RunInstances action if the volume is not encrypted.
B.
Enable EBS encryption by default in the EC2 console for the AWS Region.
C.
Use an AWS KMS Customer Managed Key (CMK) or the AWS managed key for EBS.
D.
Write a Lambda function triggered by CloudTrail to encrypt unencrypted volumes after creation.
E.
Use AWS Config to automatically terminate instances with unencrypted volumes.
How to approach this question
Look for the 'EBS encryption by default' feature, which is the easiest way to enforce this.
Full Answer
You can enable EBS encryption by default for your AWS account in a specific Region. This ensures all new volumes are encrypted using a specified KMS key.
Common mistakes
Choosing complex IAM policies or Lambda functions when a simple regional toggle exists.
Practice the full AWS SAA-C03 Practice Exam 7
65 questions · hints · full answers · grading
More questions from this exam
Q01A company has multiple AWS accounts in an AWS Organizations organization. The security team needs...MediumQ02An application runs on Amazon EC2 instances and needs to access an Amazon S3 bucket. What is the ...EasyQ03A company wants to implement federated access to the AWS Management Console for its employees usi...MediumQ04A company is building a mobile application that requires users to sign in using their social medi...EasyQ05A security team wants to enforce MFA for all IAM users before they can terminate EC2 instances. H...Medium