DAS-C01 · Question #65
A financial company uses Amazon EMR for its analytics workloads. During the company's annual security audit, the Security team determined that none of the EMR clusters' root volumes are encrypted…
The correct answer is B. Specify local disk encryption in a security configuration. Re-create the cluster using the newly. EMR root volumes are EBS volumes attached to each node. Encrypting them requires configuring local disk encryption within an EMR security configuration, then re-creating the cluster with that security configuration applied - encryption settings cannot be applied to a running…
Question
A financial company uses Amazon EMR for its analytics workloads. During the company's annual security audit, the Security team determined that none of the EMR clusters' root volumes are encrypted. The Security team recommends the company encrypt its EMR clusters' root volume as soon as possible. Which solution would meet these requirements?
Options
- AEnable at-rest encryption for EMR File System (EMRFS) data in Amazon S3 in a security
- BSpecify local disk encryption in a security configuration. Re-create the cluster using the newly
- CDetach the Amazon EBS volumes from the master node. Encrypt the EBS volume and attach it
- DRe-create the EMR cluster with LZO encryption enabled on all volumes.
How the community answered
(30 responses)- A3% (1)
- B73% (22)
- C7% (2)
- D17% (5)
Explanation
EMR root volumes are EBS volumes attached to each node. Encrypting them requires configuring local disk encryption within an EMR security configuration, then re-creating the cluster with that security configuration applied - encryption settings cannot be applied to a running cluster. Option A encrypts EMRFS data in S3, which is not the root volume. Option C (manually detaching and re-attaching EBS) is not supported for EMR root volumes and would break the cluster. Option D (LZO) is a compression codec, not an encryption mechanism.
Topics
Community Discussion
No community discussion yet for this question.