ExamPark
Course menuSAA-C03

Exams / SAA-C03 / Encryption at rest and in transit / Question 2

SAA-C03 practice question: Encryption at rest and in transit (2 of 2)

Design Secure Architectures A free question from our original SAA-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.

A company's security policy says that every Amazon EBS volume created from now on must be encrypted with one of the company's own AWS KMS customer managed keys. Developers create volumes by hand in the console, and Auto Scaling groups launch instances from many older AMIs and launch templates that do not set encryption. The company uses two AWS Regions. Which solution meets the policy with the LEAST operational effort?

Choose one answer.

  1. A. Update every launch template and AMI block device mapping to set encryption with the customer managed key, and publish a guide for developers.
  2. B. Deploy the AWS Config encrypted-volumes rule in both Regions, with automatic remediation that replaces unencrypted volumes with encrypted copies.
  3. C. Turn on EBS encryption by default in both Regions, and set a customer managed key in each Region as the default KMS key.
  4. D. Use AWS Systems Manager State Manager to install and configure an operating system disk encryption tool on every EC2 instance in both Regions.
Show the answer and explanation

Answer: C

Explanation

EBS encryption by default is set once per Region and applies to every new volume, whether created by hand or at instance launch from an AMI or launch template. You can make a customer managed KMS key the default. It does not change existing volumes, which is fine here because the policy is for new volumes.

Study

Keep practising

Answer questions with a score at the end, or practise just this topic with the explanation after each one. No sign-up needed.

Take the free SAA-C03 practice examPractise Encryption at rest and in transitAll Encryption at rest and in transit questions