A company is designing a new application stack. The design includes web servers and backend servers that are hosted on Amazon EC2 instances. The design also includes an Amazon Aurora MySQL DB…

Question

Options

• AModify EBS default encryption settings in the target AWS Region to enable encryption. Use an
• BModify the launch templates for the web layer and the backend layer to add AWS Certificate
• CCreate a new AWS Key Management Service (AWS KMS) encrypted DB cluster from a snapshot
• DApply AWS Key Management Service (AWS KMS) encryption to the existing DB cluster.
• EApply AWS Certificate Manager (ACM) encryption to the existing DB cluster.

• A
  78% (29)
• B
  3% (1)
• D
  14% (5)
• E
  5% (2)

Explanation

Enabling EBS default encryption at the Region level (Option A) is the correct approach for EC2-backed volumes because it automatically encrypts all newly created EBS volumes in that Region - including those spun up by the Auto Scaling group - without requiring changes to each launch template. For Aurora MySQL, you cannot enable encryption on an existing unencrypted cluster (Option D is a trap); instead, you must snapshot the cluster, restore it as a new encrypted cluster using KMS (Option C) - this is the only AWS-supported migration path for RDS/Aurora encryption at rest.

Why the distractors are wrong:

• B - ACM (Certificate Manager) manages SSL/TLS certificates for encryption in transit, not at rest; it has no role in EBS volume encryption.
• D - Aurora does not support enabling encryption on an existing unencrypted cluster in place; encryption must be set at creation time.
• E - ACM cannot be applied to a DB cluster for at-rest encryption at all; it's a transit-layer tool.

Memory tip: Think of it as two separate jobs - "Region default = EBS auto-encrypt" and "Aurora needs a snapshot resurrection" (snapshot → encrypted copy → restore). If you see ACM in an at-rest encryption answer, it's always a distractor.

No community discussion yet for this question.