DVA-C02 · Question #280
A company is building a compute-intensive application that will run on a fleet of Amazon EC2 instances. The application uses attached Amazon Elastic Block Store (Amazon EBS) volumes for storing…
The correct answer is A. Configure the fleet of EC2 instances to use encrypted EBS volumes to store data. Encrypted EBS volumes provide transparent, hardware-accelerated encryption at rest that is fully managed by AWS, with no performance impact on EC2 workloads.
Question
A company is building a compute-intensive application that will run on a fleet of Amazon EC2 instances. The application uses attached Amazon Elastic Block Store (Amazon EBS) volumes for storing data. The Amazon EBS volumes will be created at time of initial deployment. The application will process sensitive information. All of the data must be encrypted. The solution should not impact the application's performance. Which solution will meet these requirements?
Options
- AConfigure the fleet of EC2 instances to use encrypted EBS volumes to store data.
- BConfigure the application to write all data to an encrypted Amazon S3 bucket.
- CConfigure a custom encryption algorithm for the application that will encrypt and decrypt all data.
- DConfigure an Amazon Machine Image (AMI) that has an encrypted root volume and store the data
How the community answered
(20 responses)- A90% (18)
- B5% (1)
- D5% (1)
Why each option
Encrypted EBS volumes provide transparent, hardware-accelerated encryption at rest that is fully managed by AWS, with no performance impact on EC2 workloads.
EBS encryption uses AWS KMS and AES-256 to encrypt data at rest, in transit between the instance and the volume, and in all snapshots. The encryption and decryption are handled transparently by the EBS service using hardware offloading, so there is no measurable performance impact on the application, and no code changes are required.
Writing data to S3 changes the architectural storage model entirely and does not address encrypting EBS volumes that are already part of the design; it also introduces latency not present with locally attached block storage.
Implementing a custom encryption algorithm in the application code adds CPU overhead for encryption/decryption operations, directly impacting performance and violating the no-performance-impact requirement.
Encrypting only the root AMI volume does not encrypt the separately created data EBS volumes where application data is stored, leaving sensitive data unprotected.
Concept tested: EBS volume encryption at rest with no performance impact
Source: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSEncryption.html
Community Discussion
No community discussion yet for this question.