Q92 — AWS SAA-C03 Ch.16

Question 92 of 100 | ← Chapter 16

Q1292. A company uses Amazon EMR as a data platform. The company has a rule that requires all new EMR clusters to enable encryption in-transit when the clusters are launched. Users must receive notifications immediately if any rule violations are detected.Which solution will meet these requirements?

• A. Create an Amazon EventBridge event that invokes an AWS Lambda function on each new EMR cluster when the cluster launches. Configure the Lambda function to check the encryption configuration of each new cluster and to notify users if there is a rule violation. ✓
• B. Configure Amazon GuardDuty to check for EMR clusters that do not have in-transit encryption enabled.Notify users if there is a rule violation.
• C. Create an AWS Glue job that validates cluster encryption status and notifies users if there is a rule violation.
• D. Configure an Amazon Data Firehose stream. Set Amazon EMR as the source and AWS Lambda as the destination. For each cluster creation stream record, invoke a Lambda function to validate encryption status and to notify users if there is a rule violation.

Correct Answer: A. Create an Amazon EventBridge event that invokes an AWS Lambda function on each new EMR cluster when the cluster launches. Configure the Lambda function to check the encryption configuration of each new cluster and to notify users if there is a rule violation.

Explanation

The correct answer is A. Create an Amazon EventBridge event that invokes an AWS Lambda function on each new EMR cluster when the cluster launches. Configure the Lambda function to check the encryption configuration of each new cluster and to notify users if there is a rule violation.Why Option A is the Best Solution:Real-Time Detection & Immediate NotificationAmazon EventBridge (formerly CloudWatch Events) can detect EMR cluster launch events in real-time. It triggers an AWS Lambda function instantly when a new cluster is created. The Lambda function can check encryption settings (e.g., via DescribeCluster API) and notify users immediately (e.g., via SNS, email, or Slack) if encryption is disabled.Scalable & Event-DrivenEventBridge + Lambda is a serverless, scalable solution that requires no infrastructure management. It works for any number of clusters without manual intervention.Cost-Effective & Low LatencyNo need for continuous monitoring (unlike GuardDuty or Glue jobs). Only triggers when a new cluster is launched, minimizing costs.Why the Other Options Are Incorrect:B. Configure Amazon GuardDuty to check for EMR clusters that do not have in-transit encryption enabled.GuardDuty is for security threats, not compliance checks.It does not monitor EMR encryption settings by default.Not suitable for real-time policy enforcement.C. Create an AWS Glue job that validates cluster encryption status and notifies users if there is a rule violation.Glue is a batch ETL service, not designed for real-time event monitoring.Jobs run on a schedule, causing delays in detection.Overkill for a simple compliance check.D. Configure an Amazon Data Firehose stream with EMR as the source and Lambda as the destination. EMR does not natively stream cluster creation events to Firehose, making this setup unnecessarily complex.EventBridge is the correct service for triggering Lambda on EMR events.Conclusion:Option A is the most efficient, scalable, and cost-effective solution for real-time enforcement of encryption policies on EMR clusters with immediate notifications.Final Answer:A