A company has adopted a security policy that requires all customer data to be encrypted at rest. Currently, customer data is stored on a central Amazon EFS file system and accessed by a number of…

Question

Options

• AUpdate the EFS file system settings to enable server-side encryption using AES-256.
• BCreate a new encrypted EFS file system and copy the data from the unencrypted EFS file system
• CUse AWS CloudHSM to encrypt the files directly before storing them in the EFS file system.
• DModify the EFS file system mount options to enable Transport Layer Security (TLS) on each of

• A
  3% (1)
• B
  83% (24)
• C
  10% (3)
• D
  3% (1)

Explanation

Amazon EFS does not support enabling encryption at rest on an existing file system - it is a creation-time only setting, meaning you cannot flip a switch on an existing unencrypted file system. The only supported path is to create a new EFS file system with encryption enabled (using AWS KMS), copy the data across, and redirect applications to the new mount target.

Why the distractors are wrong:

• A - Tempting, but wrong: you cannot retroactively enable encryption at rest on an existing EFS file system through settings; the option simply doesn't exist in the AWS console or API for existing file systems.
• C - CloudHSM is a dedicated hardware key management service; it doesn't directly integrate with EFS to encrypt files at rest and would be an unnecessarily complex, non-standard approach.
• D - TLS mount options encrypt data in transit (between EC2 and EFS over the network), not at rest on disk - these are two distinct encryption requirements.

Memory tip: EFS encryption at rest is "birth certificate only" - it must be declared when the file system is born, not added later. If you need it after the fact, you must migrate, not modify.

No community discussion yet for this question.