SAA-C03 practice question: Encryption at rest and in transit (2 of 2)
Design Secure Architectures A free question from our original SAA-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.
A company's security policy says that every Amazon EBS volume created from now on must be encrypted with one of the company's own AWS KMS customer managed keys.
Developers create volumes by hand in the console, and Auto Scaling groups launch instances from many older AMIs and launch templates that do not set encryption. The company uses two AWS Regions.
Which solution meets the policy with the LEAST operational effort?
Choose one answer.
AA. Update every launch template and AMI block device mapping to set encryption with the customer managed key, and publish a guide for developers.
BB. Deploy the AWS Config encrypted-volumes rule in both Regions, with automatic remediation that replaces unencrypted volumes with encrypted copies.
CC. Turn on EBS encryption by default in both Regions, and set a customer managed key in each Region as the default KMS key.
DD. Use AWS Systems Manager State Manager to install and configure an operating system disk encryption tool on every EC2 instance in both Regions.
Show the answer and explanation
Answer: C
A. Wrong: This covers the Auto Scaling groups only after a lot of editing, and relies on developers remembering to encrypt volumes they make by hand. Any template or volume that is missed breaks the policy. Encryption by default enforces it for every new volume. Learn more: Amazon EBS encryption (opens in a new tab)
B. Wrong: The rule only flags volumes after they exist. EBS cannot encrypt a volume in place, so remediation has to snapshot, copy and swap volumes, which is complex and disruptive. Encryption by default stops unencrypted volumes from being created. Learn more: encrypted-volumes (AWS Config rule) (opens in a new tab)
C. Right: Correct. Encryption by default is a per-Region setting. Once it is on, every new volume, including those created at instance launch, is encrypted, and you can choose a customer managed key in place of aws/ebs. Learn more: Enable Amazon EBS encryption by default (opens in a new tab)
D. Wrong: Operating system encryption protects data inside the guest, but the EBS volumes themselves are not encrypted with the company's KMS key. It also adds an agent and configuration to manage on every instance. EBS encryption by default is a single setting per Region. Learn more: AWS Systems Manager State Manager (opens in a new tab)
Explanation
EBS encryption by default is set once per Region and applies to every new volume, whether created by hand or at instance launch from an AMI or launch template. You can make a customer managed KMS key the default. It does not change existing volumes, which is fine here because the policy is for new volumes.
Want more on Encryption at rest and in transit? The 5 full-length practice sets have 11 more Encryption at rest and in transit questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →