DAS-C01 · Question #19
A company is migrating its existing on-premises ETL jobs to Amazon EMR. The code consists of a series of jobs written in Java. The company needs to reduce overhead for the system administrators…
The correct answer is C. Create a custom AMI with encrypted root device volumes. The compliance requirement is root device volume encryption on all EMR cluster nodes. Amazon EMR does not natively encrypt root device (boot) volumes through a simple configuration flag alone - this requires supplying a custom AMI where the root volume is pre-encrypted using…
Question
A company is migrating its existing on-premises ETL jobs to Amazon EMR. The code consists of a series of jobs written in Java. The company needs to reduce overhead for the system administrators without changing the underlying code. Due to the sensitivity of the data, compliance requires that the company use root device volume encryption on all nodes in the cluster. Corporate standards require that environments be provisioned though AWS CloudFormation when possible. Which solution satisfies these requirements?
Options
- AInstall open-source Hadoop on Amazon EC2 instances with encrypted root device volumes.
- BUse a CloudFormation template to launch an EMR cluster.
- CCreate a custom AMI with encrypted root device volumes.
- DUse a CloudFormation template to launch an EMR cluster.
How the community answered
(16 responses)- A6% (1)
- B25% (4)
- C50% (8)
- D19% (3)
Explanation
The compliance requirement is root device volume encryption on all EMR cluster nodes. Amazon EMR does not natively encrypt root device (boot) volumes through a simple configuration flag alone - this requires supplying a custom AMI where the root volume is pre-encrypted using AWS KMS. By creating a custom AMI with encrypted root device volumes, you satisfy the compliance requirement. This custom AMI can then be referenced in a CloudFormation template that launches the EMR cluster, satisfying the CloudFormation provisioning requirement. The existing Java code runs unchanged on EMR (it supports YARN/Hadoop), reducing admin overhead versus managing raw EC2. Options B and D (as presented) reference CloudFormation without addressing root volume encryption at the AMI level, which is the critical compliance gap. Option A abandons managed EMR entirely, increasing admin burden.
Topics
Community Discussion
No community discussion yet for this question.