AWS Certified Solutions Architect – Professional (SAP-C02) — Question 354

A company has multiple AWS accounts. The company recently had a security audit that revealed many unencrypted Amazon Elastic Block Store (Amazon EBS) volumes attached to Amazon EC2 instances.

A solutions architect must encrypt the unencrypted volumes and ensure that unencrypted volumes will be detected automatically in the future. Additionally, the company wants a solution that can centrally manage multiple AWS accounts with a focus on compliance and security.

Which combination of steps should the solutions architect take to meet these requirements? (Choose two.)

Answer options

• A. Create an organization in AWS Organizations. Set up AWS Control Tower, and turn on the strongly recommended controls (guardrails). Join all accounts to the organization. Categorize the AWS accounts into OUs.
• B. Use the AWS CLI to list all the unencrypted volumes in all the AWS accounts. Run a script to encrypt all the unencrypted volumes in place.
• C. Create a snapshot of each unencrypted volume. Create a new encrypted volume from the unencrypted snapshot. Detach the existing volume, and replace it with the encrypted volume.
• D. Create an organization in AWS Organizations. Set up AWS Control Tower, and turn on the mandatory controls (guardrails). Join all accounts to the organization. Categorize the AWS accounts into OUs.
• E. Turn on AWS CloudTrail. Configure an Amazon EventBridge rule to detect and automatically encrypt unencrypted volumes.

Correct answer: A, C

Explanation

To encrypt existing unencrypted Amazon EBS volumes, you must take a snapshot of the volume and create a new, encrypted volume from that snapshot, as EBS volumes cannot be encrypted in place. To centrally manage multiple accounts and automatically detect unencrypted volumes, AWS Control Tower can be set up with 'strongly recommended' guardrails, which include detection rules for unencrypted EBS volumes. Mandatory guardrails in AWS Control Tower do not cover EBS encryption detection, making option A correct over option D.