DOP-C02 · Question #213
A company uses Amazon RDS for all databases in its AWS accounts. The company uses AWS Control Tower to build a landing zone that has an audit and logging account. All databases must be encrypted at…
The correct answer is A. Use AWS Control Tower to activate the optional detective control (guardrail) to determine whether. https://docs.aws.amazon.com/controltower/latest/userguide/strongly-recommended- controls.html#disallow-rds-storage-unencrypted
Question
A company uses Amazon RDS for all databases in its AWS accounts. The company uses AWS Control Tower to build a landing zone that has an audit and logging account. All databases must be encrypted at rest for compliance reasons. The company's security engineer needs to receive notification about any noncompliant databases that are in the company's accounts. Which solution will meet these requirements with the MOST operational efficiency?
Options
- AUse AWS Control Tower to activate the optional detective control (guardrail) to determine whether
- BUse AWS CloudFormation StackSets to deploy AWS Lambda functions to every account. Write
- CCreate a custom AWS Config rule in every account to determine whether the RDS storage is
- DLaunch an Amazon C2 instance. Run an hourly cron job by using the AWS CLI to determine
How the community answered
(37 responses)- A76% (28)
- B8% (3)
- C3% (1)
- D14% (5)
Explanation
https://docs.aws.amazon.com/controltower/latest/userguide/strongly-recommended- controls.html#disallow-rds-storage-unencrypted
Topics
Community Discussion
No community discussion yet for this question.