AWS Certified Solutions Architect – Associate (SAA-C03) — Question 650

A company wants to standardize its Amazon Elastic Block Store (Amazon EBS) volume encryption strategy. The company also wants to minimize the cost and configuration effort required to operate the volume encryption check.

Which solution will meet these requirements?

Answer options

• A. Write API calls to describe the EBS volumes and to confirm the EBS volumes are encrypted. Use Amazon EventBridge to schedule an AWS Lambda function to run the API calls.
• B. Write API calls to describe the EBS volumes and to confirm the EBS volumes are encrypted. Run the API calls on an AWS Fargate task.
• C. Create an AWS Identity and Access Management (IAM) policy that requires the use of tags on EBS volumes. Use AWS Cost Explorer to display resources that are not properly tagged. Encrypt the untagged resources manually.
• D. Create an AWS Config rule for Amazon EBS to evaluate if a volume is encrypted and to flag the volume if it is not encrypted.

Correct answer: D

Explanation

AWS Config features a managed rule specifically designed to evaluate whether Amazon EBS volumes are encrypted, which minimizes configuration effort and operational overhead. In contrast, Options A and B require writing, testing, and maintaining custom code on Lambda or Fargate, which increases complexity and cost. Option C relies on manual intervention and tagging rather than automated directly-managed compliance checks, making it inefficient and prone to human error.