SCS-C02 Question 166
Select 2Your organization is running a sensitive workload on Amazon EC2 instances. To meet compliance requirements, you need to ensure that all data stored on the root and attached EBS volumes is encrypted. Additionally, you want to enforce encryption for any new EBS volumes created in the future. What steps should you take to meet these requirements?
- A
Enable EBS encryption by default for the AWS account.
- B
Manually create a new KMS key and use it to encrypt existing EBS volumes.
- C
Use the AWS CLI or AWS Management Console to encrypt existing unencrypted EBS volumes.
- D
Create an IAM policy that denies the creation of unencrypted volumes and attach it to all IAM users.
- E
Ensure that all new EC2 instances are launched with the 'Encrypt Root Volume' option enabled.
Show answer and explanation
Correct answers: A, C
Explanation
To meet the compliance requirement of encrypting existing and future EBS volumes, you need to encrypt current unencrypted volumes and enforce default encryption for new volumes. Enabling EBS encryption by default ensures that future volumes are automatically encrypted, while using the AWS CLI or Management Console to encrypt existing volumes addresses the current compliance gap. Other options, while potentially helpful, do not fully meet the requirements outlined in the scenario.
- A. Correct.
Enabling EBS encryption by default ensures that all new EBS volumes created in the account are automatically encrypted. This addresses the requirement for future volume encryption.
- B. Incorrect.
Manually creating a new KMS key is not necessary unless you need a specific customer-managed key. The question does not specify this requirement.
- C. Correct.
Encrypting existing unencrypted EBS volumes ensures that current data is protected. This step is necessary to meet compliance requirements for existing workloads.
- D. Incorrect.
Creating an IAM policy to deny unencrypted volume creation is an additional security measure but is not explicitly required in this scenario. Enabling EBS encryption by default achieves the same outcome.
- E. Incorrect.
The 'Encrypt Root Volume' option ensures root volume encryption for individual EC2 instances, but enabling EBS encryption by default is the more comprehensive solution for all future volumes.