Q70 — AWS SAA-C03 Ch.11

Question 70 of 100 | ← Chapter 11

Q770. A company needs a solution to enforce data encryption at rest on Amazon EC2 instances. The solution must automatically identify noncompliant resources and enforce compliance policies on findings.Which solution will meet these requirements with the LEAST administrative overhead?

Correct Answer: A. Use an IAM policy that allows users to create only encrypted Amazon Elastic Block Store (Amazon EBS) volumes. Use AWS Config and AWS Systems Manager to automate the detection and remediation of unencrypted EBS volumes.

Explanation

Option A provides the desired solution with the least administrative overhead:Use an IAM policy that allows users to create only encrypted Amazon EBS volumes:By implementing an IAM policy, you can restrict users' permissions to create only encrypted EBS volumes. This ensures that all new volumes created are encrypted by default and reduces the risk of noncompliant resources.Use AWS Config and AWS Systems Manager to automate the detection and remediation of unencrypted EBS volumes:AWS Config allows you to continuously monitor the configuration of your resources, including EBS volumes, and provide compliance checks based on predefined rules. AWS Systems Manager provides automation capabilities to remediate noncompliant resources. By combining these services, you can automatically detect unencrypted EBS volumes and trigger remediation actions, such as encryption, using Systems Manager automation.Here's why the other options are not the most suitable choices:Option B suggests using AWS Key Management Service (AWS KMS) to manage access to encrypted Amazon EBS volumes and using AWS Lambda and Amazon EventBridge to automate the detection and remediation of unencrypted EBS volumes. While this option provides automation, it requires additional configuration and management of AWS KMS, Lambda functions, and EventBridge rules, which may result in more administrative overhead compared to option A.Option C suggests using Amazon Macie to detect unencrypted Amazon EBS volumes and AWS Systems Manager Automation rules to automatically encrypt existing and new EBS volumes. Amazon Macie is primarily designed for data discovery and classification, and while it can identify unencrypted EBS volumes, it may not provide the same level of automation and control as option A.Option D suggests using Amazon Inspector to detect unencrypted Amazon EBS volumes and AWS Systems Manager Automation rules to automatically encrypt existing and new EBS volumes. Amazon Inspector is a security assessment service that primarily focuses on identifying security vulnerabilities. While it may detect unencrypted EBS volumes, it is not specifically designed for encryption enforcement and may involve additional configuration and management overhead.Therefore, the most appropriate solution to enforce data encryption at rest on Amazon EC2 instances, automatically identify noncompliant resources, and enforce compliance policies with the least administrative overhead is:A. Use an IAM policy that allows users to create only encrypted Amazon Elastic Block Store (Amazon EBS) volumes. Use AWS Config and AWS Systems Manager to automate the detection and remediation of unencrypted EBS volumes.