Exam AWS Certified Solutions Architect - Professional SAP-C02 topic 1 question 518 discussion

Option D meet the requirements of automatically encrypting existing unencrypted EBS volumes and preventing development teams from creating unencrypted EBS volumes, you can configure an AWS Config managed rule that identifies unencrypted EBS volumes. The automatic remediation action should be to create a new encrypted EBS volume and replace the old one. Additionally, modifying the AWS account setting for EBS encryption to always encrypt new EBS volumes ensures that no more unencrypted EBS volumes are created in the future.

Issue is that NONE prevent new EBS volumes to be launched without encryption, albiet systems manager can remediate it isn't ideal. regardless you need a solution to PREVENT 100% unecrypted drives, and this is only done via SCP. other items can be circumvented by CLI

https://docs.aws.amazon.com/prescriptive-guidance/latest/patterns/automatically-encrypt-existing-and-new-amazon-ebs-volumes.html 1. Use AWS Config to detects an unencrypted EBS volume. Not fleet manager. B and C out. 2. System manager runbook is the automation that create encrypted copy of the EBS snapshot and replace the encrypted EBS with the encrypted copy. The KMS is used for the encryption and it cannot be used to deny creation of unencrypted EBS volume (A is out).

My answer is D Proactive Remediation: The AWS Config rule and Automation runbook identify and remediate existing unencrypted volumes automatically. Preventive Measure: The modified AWS account setting ensures that all new EBS volumes created in the account are automatically encrypted. This approach provides a comprehensive solution that addresses both existing unencrypted volumes and future volume creation. Why not Option A: While it addresses the issue of existing unencrypted volumes, it doesn't prevent future unencrypted volume creation.

D is correct instead of A because AWS support change account setting for EBS encryption

Use config to find unencrypted EBS. Change the default setting.

D Enabling default encryption for EBSs prevents the creation of unencrypted EBSs.

the answer is D