SAP-C02 Q320 · Storage

Question

A company's compliance audit reveals that some Amazon Elastic Block Store (Amazon EBS) volumes that were created in an AWS account were not encrypted. A solutions architect must implement a solution to encrypt all new EBS volumes at rest. Which solution will meet this requirement with the LEAST effort?

Accepted Answer

**Option D: Turn on EBS encryption by default in all AWS Regions.**

**Why this is correct:**

1. **Requirement: Encrypt all NEW EBS volumes** — EBS encryption by default is a **per-Region, per-account setting** that, once enabled, automatically encrypts every new EBS volume and snapshot created in that Region. This directly addresses the requirement.

2. **Requirement: LEAST effort** — This is a single toggle (API call or console click) per Region. There is no need to build custom rules, Lambda functions, or automation runbooks. It's a native, built-in AWS feature specifically designed for this exact use case.

3. **How it works:** When enabled, any new EBS volume created (including volumes created from unencrypted snapshots or AMIs) will be automatically encrypted using the default KMS k

📖 Explanation

✅ Correct Answer

❌ Wrong Answers

📘 Key Concepts

🏗️ Architecture

⚙️ Operations

💰 Cost

🔒 Security

🎯 Exam Tips