A company needs a solution to enforce data encryption at rest on Amazon EC2 instances. The solution must automatically identify noncompliant resources and enforce compliance policies on findings. Whic

Question

Options

• AUse an IAM policy that allows users to create only encrypted Amazon Elastic Block Store
• BUse AWS Key Management Service (AWS KMS) to manage access to encrypted Amazon Elastic
• CUse Amazon Macie to detect unencrypted Amazon Elastic Block Store (Amazon EBS) volumes.
• DUse Amazon Inspector to detect unencrypted Amazon Elastic Block Store (Amazon EBS)

• A
  81% (26)
• B
  3% (1)
• C
  6% (2)
• D
  9% (3)

Explanation

The best solution to enforce encryption at rest for Amazon EBS volumes is to use anIAM policyto restrict the creation of unencrypted volumes. To automatically identify and remediate unencryptedvolumes, you can use AWS Configrules, which continuously monitor the compliance of resources, and AWS Systems Managerto automate the remediation by encrypting existing unencrypted volumes. This setup requires minimal administrative overhead while ensuring Option B (KMS): KMS is for managing encryption keys, but Config and Systems Manager provide a better solution for automatic detection and enforcement. Option C (Macie): Macie is for data classification and is not suitable for this use case. Option D (Inspector): Inspector is used for security vulnerabilities, not encryption compliance.

No community discussion yet for this question.