Q69 — AWS SAA-C03 Ch.10

Question 69 of 100 | ← Chapter 10

Q669. A company wants to standardize its Amazon Elastic Block Store(Amazon EBS) volume encryption strategy.The company also wants to minimize the cost and configuration effort required to operate the volume encryption check.Which solution will meet these requirements?

Correct Answer: D. Create an AWS Config rule for Amazon EBS to evaluate if a volume is encrypted and to flag the volume if it is not encrypted

Explanation

To standardize the Amazon Elastic Block Store (Amazon EBS) volume encryption strategy, while minimizing cost and configuration effort for operating the volume encryption check, the solution that will meet these requirements is:D. Create an AWS Config rule for Amazon EBS to evaluate if a volume is encrypted and to flag the volume if it is not encrypted.Here's the rationale behind this solution:Option D: Create an AWS Config rule for Amazon EBS to evaluate if a volume is encrypted and to flag the volume if it is not encrypted.AWS Config allows you to define rules that evaluate the configuration of your AWS resources and report any non-compliant resources. By creating a custom AWS Config rule for Amazon EBS, you can evaluate if a volume is encrypted and flag the volume as non-compliant if it is not encrypted. This approach provides an automated and centralized way to enforce encryption compliance for EBS volumes without the need for manual API calls or additional services.Option A: Write API calls to describe the EBS volumes and to confirm the EBS volumes are encrypted. Use Amazon EventBridge to schedule an AWS Lambda function to run the API calls. While this solution involves using API calls and scheduling them with AWS Lambda, it requires more manual configuration and management compared to using AWS Config. AWS Config is specifically designed for evaluating and reporting on resource configurations, including encryption status, and provides a more streamlined and automated approach.Option B: Write API calls to describe the EBS volumes and to confirm the EBS volumes are encrypted. Run the API calls on an AWS Fargate task.Running API calls on an AWS Fargate task can be a solution, but it introduces additional complexity and operational overhead compared to using AWS Config. AWS Config provides a more native and integrated approach for evaluating resource configurations, including encryption status.Option C: Create an AWS Identity and Access Management (IAM) policy that requires the use of tags on EBS volumes. Use AWS Cost Explorer to display resources that are not properly tagged. Encrypt the untagged resources manually.While tagging resources and using AWS Cost Explorer can help with resource management and cost optimization, it is not directly related to enforcing encryption compliance. Additionally, manually encrypting untagged resources may introduce human error, and it does not provide an automated and scalable approach for managing encryption compliance.Therefore, the most suitable solution to standardize the Amazon EBS volume encryption strategy while minimizing cost and configuration effort is to create an AWS Config rule for Amazon EBS to evaluate if a volume is encrypted and flag the volume if it is not encrypted (Option D). This approach provides an automated and centralized solution for enforcing encryption compliance for EBS volumes.