Q6 — AWS SAA-C03 Ch.13

Question 6 of 100 | ← Chapter 13

Q906. A company plans to rehost an application to Amazon EC2 instances that use Amazon Elastic Block Store (Amazon EBS) as the attached storage.A solutions architect must design a solution to ensure that all newly created Amazon EBS volumes are encrypted by default. The solution must also prevent the creation of unencrypted EBS volumes.Which solution will meet these requirements?

Correct Answer: A. Configure the EC2 account attributes to always encrypt new EBS volumes.

Explanation

To ensure that all newly created Amazon EBS volumes are encrypted by default and prevent the creation of unencrypted EBS volumes, the following solution will meet the requirements:A. Configure the EC2 account attributes to always encrypt new EBS volumes.By configuring the EC2 account attributes to always encrypt new EBS volumes, any EBS volume created within the account will be automatically encrypted. This setting ensures that all newly created volumes are encrypted, providing data security and compliance.Option B suggests using AWS Config to configure the encrypted-volumes identifier and apply the default AWS Key Management Service (AWS KMS) key. However, this option does not specifically address the requirement to prevent the creation of unencrypted EBS volumes.Option C suggests using AWS Systems Manager to create encrypted copies of the EBS volumes, but this would involve additional steps and would not ensure that newly created volumes are encrypted by default.Option D involves creating a customer managed key in AWS KMS and configuring AWS Migration Hub, which is unrelated to the requirement of ensuring encryption for newly created EBS volumes.In summary, option A is the most appropriate solution as it directly addresses the requirement by configuring the EC2 account attributes to always encrypt new EBS volumes, ensuring that all newly created volumes are encrypted by default and preventing the creation of unencrypted EBS volumes.