AWS Certified Solutions Architect – Associate (SAA-C03) — Question 399

A company is deploying a new application on Amazon EC2 instances. The application writes data to Amazon Elastic Block Store (Amazon EBS) volumes. The company needs to ensure that all data that is written to the EBS volumes is encrypted at rest.

Which solution will meet this requirement?

Answer options

• A. Create an IAM role that specifies EBS encryption. Attach the role to the EC2 instances.
• B. Create the EBS volumes as encrypted volumes. Attach the EBS volumes to the EC2 instances.
• C. Create an EC2 instance tag that has a key of Encrypt and a value of True. Tag all instances that require encryption at the EBS level.
• D. Create an AWS Key Management Service (AWS KMS) key policy that enforces EBS encryption in the account. Ensure that the key policy is active.

Correct answer: B

Explanation

Amazon EBS encryption is applied directly at the volume level during creation, ensuring that all data written to the volume is encrypted at rest. IAM roles and instance tags do not have the capability to enforce or perform EBS encryption. While AWS KMS is used to manage the encryption keys, a key policy alone does not automatically encrypt newly created EBS volumes unless the volumes themselves are configured to be encrypted.