MENU
A company website hosted on Amazon EC2 instances processes classified data stored in The application writes data to Amazon Elastic Block Store (Amazon EBS) volumes The company needs to ensure that all data that is written to the EBS volumes is encrypted at rest.
Which solution will meet this requirement?
Suggested Answer: B
Get Premium SAA-C03 Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
The simplest and most effective way to ensure that all data that is written to the EBS volumes is encrypted at rest is to create the EBS volumes as encrypted volumes. You can do this by selecting the encryption option when you create a new EBS volume, or by copying an existing unencrypted volume to a new encrypted volume. You can also specify the AWS KMS key that you want to use for encryption, or use the default AWS-managed key. When you attach the encrypted EBS volumes to the EC2 instances, the data will be automatically encrypted and decrypted by the EC2 host. This solution does not require any additional IAM roles, tags, or policies.
43 comments · newest first
CA
Carman
11 months ago
Totally agree with B! Encryption should be default for sensitive data.
RE
Reena
11 months ago
Nah, A won't work. IAM roles don't encrypt data at rest.
GR
Gregg
11 months ago
Wait, can you really just tag instances for encryption? Sounds too easy.
RO
Rolland
11 months ago
I think D is also important for key management, but B is the simplest.
DO
Dorathy
12 months ago
Option B is the way to go! Encrypted EBS volumes are a must.
TU
Tula
12 months ago
I vaguely remember something about tagging instances for encryption, but I don't think option C would actually ensure encryption at rest. It seems too indirect.
SE
Selma
1 year ago
I thought creating an IAM role for EBS encryption was important, but I can't recall if that actually encrypts the data at rest. Maybe option A is not the best choice?
WI
Willow
1 year ago
I'm not entirely sure, but I feel like option D could be relevant too, especially with the KMS key policy. We had a practice question about key management.
LA
Larue
1 year ago
I remember we discussed EBS encryption in class, and I think option B sounds right since it mentions creating encrypted volumes directly.
SH
Sherly
1 year ago
I'm pretty confident that the correct answer is to create the EBS volumes as encrypted volumes and then attach them to the EC2 instances. This ensures that the data is encrypted at the volume level, which seems to be the requirement.
AI
Aide
1 year ago
Okay, I've got this. The solution is to create an IAM role that specifies EBS encryption and attach it to the EC2 instances. That way, the encryption will be applied automatically to all data written to the EBS volumes.
AL
Alison
1 year ago
This seems like a straightforward question about ensuring data encryption on EBS volumes. I think the key is to understand the different options available and choose the most appropriate one.
CA
Caprice
1 year ago
Hmm, I'm a bit confused here. There are a few different solutions presented, and I'm not sure which one is the best approach. I'll need to carefully read through each option and think about the implications.
SE
Selma
1 year ago
The wording of this question is a bit tricky. I'll need to double-check my understanding of each option to ensure I'm selecting the right three. Don't want to overthink it, but I also don't want to miss any important details.
NO
Nobuko
1 year ago
I recall that a failover system is often mentioned in the context of reliability—maybe that's also part of it?
KE
Keith
1 year ago
I'm not entirely sure, but I think it's important for her to inform her employer about outside roles. It sounds like a written disclosure might be necessary.
LY
Lynette
1 year ago
I think the correct answer is storing the hash of the previous block within the current block. I remember studying that in our blockchain module.
OD
Odette
2 years ago
Thanks for the explanation, I think I understand now. I agree with you that D) seems like the best solution.
AL
Alverta
2 years ago
Of course, Creating a KMS key policy ensures encryption at the EBS level, providing a secure solution for data at rest.
GA
Gail
2 years ago
Sure, can you explain why you think D) is the correct answer?
OD
Odette
2 years ago
I'm not sure which one to choose. Can someone explain their rationale for their answer?
AL
Alverta
2 years ago
I disagree with you, I believe the correct answer is D) Create an AWS Key Management Service key policy that enforces EBS encryption.
GA
Gail
2 years ago
I think the answer is B) Create the EBS volumes as encrypted volumes Attach the EBS volumes to the EC2 instances.
EL
Elfriede
2 years ago
I think option D is the way to go. Creating a KMS key policy for encryption gives more control.
KI
Kiley
2 years ago
I agree with Clorinda. Option B seems like the most direct way to ensure encryption.
CL
Clorinda
2 years ago
I disagree, I believe option B is more straightforward.
AS
Ashleigh
2 years ago
I think option A is the best solution.
BE
Bea
3 years ago
But what about the AWS KMS key policy? Doesn't that play a role in enforcing the encryption at the account level?
BI
Billy
3 years ago
Hold on, what about option D? Creating an AWS KMS key policy that enforces EBS encryption could be a good way to ensure encryption across the entire account, not just for these specific instances.
NO
Noemi
3 years ago
Yeah, that seems like the most straightforward approach. I'm not sure the other options would be as effective in meeting the requirement. Plus, option B is nice and simple - no need to mess around with IAM roles or KMS keys.
GE
Gertude
2 years ago
Yeah, creating encrypted volumes and attaching them to the instances sounds like a secure solution.
MU
Murray
2 years ago
I think option B would be the best choice here.
CO
Corazon
3 years ago
Yep, Wilson's got it. Creating the EBS volumes as encrypted volumes and then attaching them to the EC2 instances is the most straightforward solution. No need to mess around with IAM roles or custom tags.
CA
Casie
3 years ago
Haha, you know what they say - when in doubt, encrypt everything! But seriously, option D does seem like a solid choice. It's a bit more complex than option B, but it could provide better long-term protection.
SA
saqib
3 years ago
You know, that's a good point. That might be a more robust and scalable solution, especially if they have other resources that need to be encrypted as well. It's worth considering, for sure.
NA
Narcisa
3 years ago
You know, that's a good point. That might be a more robust and scalable solution, especially if they have other resources that need to be encrypted as well. It's worth considering, for sure.
WI
Wilson
3 years ago
Okay, let's think this through. We need to encrypt the data at rest, so the EBS volumes need to be encrypted. That means option B is the way to go, right?
FR
Franchesca
3 years ago
Haha, yeah, I can already see someone suggesting we write a custom encryption algorithm just to show off their coding skills. Come on, people, let's keep it simple!
DE
Denae
3 years ago
I agree, Sherill. This seems like a straightforward question, but I'm sure some of the candidates will try to get creative and end up picking the wrong answer.
SH
Sherill
3 years ago
Oh man, this is a tricky one! Encrypting data at rest is crucial, especially when dealing with classified information. I wonder how many people are going to overthink this and come up with some convoluted solution.
AS
Ashlee
3 years ago
D) Create an AWS Key Management Service (AWS KMS) key policy that enforces EBS encryption in the account Ensure that the key policy is active
DO
Domitila
3 years ago
A) Create an IAM role that specifies EBS encryption Attach the role to the EC2 instances
RO
Rosenda
3 years ago
B) Create the EBS volumes as encrypted volumes Attach the EBS volumes to the EC2 instances