SAP-C02 · Question #635
A company has multiple AWS accounts. The company recently had a security audit that revealed many unencrypted Amazon Elastic Block Store (Amazon EBS) volumes attached to Amazon EC2 instances. A soluti
The correct answer is A. Create an organization in AWS Organizations. Set up AWS Control Tower, and turn on the C. Create a snapshot of each unencrypted volume. Create a new encrypted volume from the. To encrypt existing unencrypted EBS volumes, create encrypted snapshots and then new encrypted volumes from them. For central multi-account management and automatic detection of unencrypted volumes in the future, AWS Organizations with AWS Control Tower is the comprehensive solut
Question
A company has multiple AWS accounts. The company recently had a security audit that revealed many unencrypted Amazon Elastic Block Store (Amazon EBS) volumes attached to Amazon EC2 instances. A solutions architect must encrypt the unencrypted volumes and ensure that unencrypted volumes will be detected automatically in the future. Additionally, the company wants a solution that can centrally manage multiple AWS accounts with a focus on compliance and security. Which combination of steps should the solutions architect take to meet these requirements? (Choose two.)
Options
- ACreate an organization in AWS Organizations. Set up AWS Control Tower, and turn on the
- BUse the AWS CLI to list all the unencrypted volumes in all the AWS accounts. Run a script to
- CCreate a snapshot of each unencrypted volume. Create a new encrypted volume from the
- DCreate an organization in AWS Organizations. Set up AWS Control Tower, and turn on the
- ETurn on AWS CloudTrail. Configure an Amazon EventBridge rule to detect and automatically
How the community answered
(47 responses)- A64% (30)
- B21% (10)
- D9% (4)
- E6% (3)
Why each option
To encrypt existing unencrypted EBS volumes, create encrypted snapshots and then new encrypted volumes from them. For central multi-account management and automatic detection of unencrypted volumes in the future, AWS Organizations with AWS Control Tower is the comprehensive solution.
AWS Organizations enables central management of multiple AWS accounts, and AWS Control Tower provides a prescriptive multi-account environment with automated guardrails, including detective guardrails that can identify and flag unencrypted EBS volumes to ensure future compliance and security.
Using the AWS CLI and custom scripts to list and encrypt volumes is a manual process and does not provide automatic future detection or central governance for multiple accounts.
To encrypt an existing unencrypted Amazon EBS volume, you must first create a snapshot of the volume. Then, you can create an encrypted copy of that snapshot, and finally, create a new encrypted volume from the encrypted snapshot to replace the original unencrypted volume.
While AWS Config can detect unencrypted volumes, AWS Control Tower provides a more comprehensive multi-account governance solution with integrated guardrails and account provisioning capabilities, making it a better fit for central management and compliance at scale.
AWS CloudTrail logs API calls for auditing, and Amazon EventBridge can react to events, but this is a custom solution for detection and doesn't offer the centralized multi-account management and comprehensive compliance guardrails that AWS Control Tower provides.
Concept tested: EBS encryption, AWS Organizations, AWS Control Tower compliance
Source: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/Using_Tags.html, https://docs.aws.amazon.com/controltower/latest/userguide/control-tower-setup.html
Community Discussion
No community discussion yet for this question.