Exam AWS Certified Solutions Architect - Professional topic 1 question 879 discussion

Exam question from Amazon's AWS Certified Solutions Architect - Professional

Question #: 879
Topic #: 1

[All AWS Certified Solutions Architect - Professional Questions]

A company's compliance audit reveals that some Amazon Elastic Block Store (Amazon EBS) volumes that were created in an AWS account were not encrypted.
A solutions architect must implement a solution to encrypt all new EBS volumes at rest.
Which solution will meet this requirement with the LEAST effort?

A. Create an Amazon EventBridge (Amazon CloudWatch Events) rule to detect the creation of unencrypted EBS volumes. Invoke an AWS Lambda function to delete noncompliant volumes.
B. Use AWS Audit Manager with data encryption.
C. Create an AWS Config rule to detect the creation of a new EBS volume. Encrypt the volume by using AWS Systems Manager Automation.
D. Turn on EBS encryption by default in all AWS Regions.

Show Suggested Answer

Suggested Answer: D 🗳️

by gnic at Aug. 31, 2022, 9:03 p.m.

Disclaimers:

- ExamTopics website is not related to, affiliated with, endorsed or authorized by Amazon.
- Trademarks, certification & product names are used for reference only and belong to Amazon.

Comments

Submit Cancel

devilman222

10 months, 1 week ago

Selected Answer: D

The question asks how to encrypt "new" volumes. I guess we are not worrying about the older stuff for now.

upvoted 1 times

...

evargasbrz

2 years, 5 months ago

Selected Answer: D

D is correct.

upvoted 2 times

...

AwsBRFan

2 years, 8 months ago

Selected Answer: D

https://aws.amazon.com/premiumsupport/knowledge-center/ebs-automatic-encryption/

upvoted 3 times

...

dcdcdc3

2 years, 8 months ago

Selected Answer: D

Agree with D for all New volumes

upvoted 2 times

...

sb333

2 years, 8 months ago

Selected Answer: D

D is correct. The question is looking for the LEAST effort for encrypting "new" volumes. This is accomplished by turning on encryption by default, which will only allow encryption to be used unless it is turned off again. https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSEncryption.html#encryption-by-default If you want to correct current volumes, which the questions is not asking you to do, then you could follow-up with answer C as a solution (which requires a bit of configuration). Remember to only answer what the question is asking for and not try to solve things that it doesn't ask for.

upvoted 2 times

...

JohnPi

2 years, 8 months ago

Selected Answer: D

New Amazon EBS volumes aren't encrypted by default. However, there is a setting in the EC2 console that turns on encryption by default for all new Amazon EBS volumes and snapshot copies created within a specified Region.

upvoted 1 times

...