SAP-C02 · Question #780
A company has deployed applications to thousands of Amazon EC2 instances in an AWS account. A security audit discovers that several unencrypted Amazon Elastic Block Store (Amazon EBS) volumes are…
The correct answer is D. Configure the AWS Config managed rule that identifies unencrypted EBS volumes. Configure an. The company needs an automated solution to encrypt existing unencrypted Amazon EBS volumes and to prevent the future creation of unencrypted EBS volumes across thousands of EC2 instances.
Question
A company has deployed applications to thousands of Amazon EC2 instances in an AWS account. A security audit discovers that several unencrypted Amazon Elastic Block Store (Amazon EBS) volumes are attached to the EC2 instances. The company's security policy requires the EBS volumes to be encrypted. The company needs to implement an automated solution to encrypt the EBS volumes. The solution also must prevent development teams from creating unencrypted EBS volumes. Which solution will meet these requirements?
Options
- AConfigure the AWS Config managed rule that identifies unencrypted EBS volumes. Configure an
- BUse AWS Systems Manager Fleet Manager to create a list of unencrypted EBS volumes, Create
- CUse AWS Systems Manager Fleet Manager to create a list of unencrypted EBS volumes. Create
- DConfigure the AWS Config managed rule that identifies unencrypted EBS volumes. Configure an
How the community answered
(17 responses)- A18% (3)
- B6% (1)
- C6% (1)
- D71% (12)
Why each option
The company needs an automated solution to encrypt existing unencrypted Amazon EBS volumes and to prevent the future creation of unencrypted EBS volumes across thousands of EC2 instances.
While AWS Config can identify and potentially remediate unencrypted volumes, it does not inherently prevent the creation of new unencrypted volumes without an explicit denial policy.
AWS Systems Manager Fleet Manager is primarily for instance management and inventory, not for enforcing encryption compliance or preventing the creation of unencrypted EBS volumes across an organization.
AWS Systems Manager Fleet Manager is primarily for instance management and inventory, not for enforcing encryption compliance or preventing the creation of unencrypted EBS volumes across an organization.
Option D meets both requirements by configuring an AWS Config managed rule to identify existing unencrypted EBS volumes, and crucially, an AWS Organizations Service Control Policy (SCP) to explicitly deny the creation of any new unencrypted EBS volumes, enforcing compliance at the organizational level.
Concept tested: EBS encryption enforcement, AWS Config for compliance, AWS Organizations SCP for prevention
Source: https://docs.aws.amazon.com/config/latest/developerguide/ebs-encrypted-volumes.html
Community Discussion
No community discussion yet for this question.