SAP-C02 · Question #286
A company has an organization in AWS Organizations. The company is using AWS Control Tower to deploy a landing zone for the organization. The company wants to implement governance and policy…
The correct answer is B. Enable the appropriate guardrail from the list of strongly recommended guardrails in AWS Control. AWS Control Tower provides a set of "strongly recommended guardrails" that can be enabled to implement governance and policy enforcement. One of these guardrails is "Encrypt Amazon RDS instances" which will detect RDS DB instances that are not encrypted at rest. By enabling…
Question
A company has an organization in AWS Organizations. The company is using AWS Control Tower to deploy a landing zone for the organization. The company wants to implement governance and policy enforcement. The company must implement a policy that will detect Amazon RDS DB instances that are not encrypted at rest in the company's production OU. Which solution will meet this requirement?
Options
- ATurn on mandatory guardrails in AWS Control Tower. Apply the mandatory guardrails to the
- BEnable the appropriate guardrail from the list of strongly recommended guardrails in AWS Control
- CUse AWS Config to create a new mandatory guardrail. Apply the rule to all accounts in the
- DCreate a custom SCP in AWS Control Tower. Apply the SCP to the production OU.
How the community answered
(35 responses)- A9% (3)
- B83% (29)
- C6% (2)
- D3% (1)
Explanation
AWS Control Tower provides a set of "strongly recommended guardrails" that can be enabled to implement governance and policy enforcement. One of these guardrails is "Encrypt Amazon RDS instances" which will detect RDS DB instances that are not encrypted at rest. By enabling this guardrail and applying it to the production OU, the company will be able to enforce encryption for RDS instances in the production environment.
Community Discussion
No community discussion yet for this question.