A company uses AWS Organizations to manage multiple accounts. Information security policies require that all unencrypted Amazon EBS volumes be marked as non-compliant. A DevOps engineer needs to…

Question

Options

• ACreate an AWS CloudFormation template that defines an AWS Inspector rule to check whether
• BCreate an AWS Config organizational rule to check whether EBS encryption is enabled and
• CCreate an SCP in Organizations. Set the policy to prevent the launch of Amazon EC2 instances
• DDeploy an IAM role to all accounts from a single trusted account. Build a pipeline with AWS

• A
  8% (3)
• B
  76% (28)
• C
  14% (5)
• D
  3% (1)

Explanation

Explanation

AWS Config organizational rules are purpose-built for exactly this use case: they can be deployed automatically across all accounts in an AWS Organization from a single management account, ensuring the compliance check is always present without manual intervention in each account. Config rules continuously evaluate resource configurations against defined policies and mark resources as compliant or non-compliant, which directly satisfies the requirement to flag unencrypted EBS volumes.

Why the distractors are wrong:

• Option A is incorrect because AWS Inspector focuses on vulnerability assessments and software security, not resource configuration compliance like EBS encryption status.
• Option C is incorrect because an SCP prevents launching unencrypted instances but doesn't detect or report non-compliance on existing volumes - it's preventative, not detective.
• Option D is incorrect because manually deploying IAM roles and building a custom pipeline is overly complex when a native, purpose-built solution (Config) exists; it also doesn't guarantee the compliance check is "always present" across all accounts easily.

Memory Tip: Think "Config = Compliance Check" - whenever an exam question asks about detecting, reporting, or marking resources as compliant/non-compliant across an organization, AWS Config organizational rules is almost always the right answer. SCPs prevent actions; Config detects them.

No community discussion yet for this question.