How to encrypt EBS volumes for EC2 without impacting performance?
Short answer
A Configure the fleet of EC2 instances to use encrypted EBS volumes to store data.
Question
Key Takeaways
This question tests the understanding that EBS encryption is handled transparently at the hypervisor level, meaning it does not require application modifications and has negligible performance impact compared to application-level or network-based encryption solutions.
Amazon EBS encryption provides transparent encryption at rest for EC2-attached volumes using AWS KMS, ensuring sensitive data is secured without requiring application-level changes or introducing significant performance overhead.
Common mistake: Candidates often choose Option B (S3) because S3 is a common storage service, but writing all data to S3 would introduce significant network latency and impact the performance of a compute-intensive application, violating the requirement.
Expert Analysis
Understanding EBS Encryption
Amazon Elastic Block Store (EBS) encryption provides a simple way to encrypt your EBS volumes and snapshots. When you create an encrypted EBS volume and attach it to a supported instance type, the data stored at rest, disk I/O, and snapshots created from the volume are all encrypted.
Key characteristics of EBS encryption:
- Encryption is handled transparently at the hypervisor level
- Uses AWS Key Management Service (AWS KMS) for key management
- Supports AES-256 encryption algorithm
- Has negligible performance impact on modern instance types
- Requires no application code changes
Why Option A is Correct
Option A directly satisfies all requirements: 1. Encryption requirement: EBS volumes are encrypted at rest using AWS KMS 2. Performance requirement: EBS encryption operates transparently with minimal overhead 3. Application compatibility: No changes needed to the application code 4. Data protection: All data written to the EBS volume is automatically encrypted
Why Other Options Are Wrong
Option B (S3 bucket): While S3 supports encryption, routing all application data through S3 would introduce significant network latency. For a compute-intensive application using attached storage, this would dramatically impact performance and violate the requirement that "the solution should not impact the application's performance."
Option C (Custom encryption): Implementing custom encryption at the application level would require significant code changes, introduce processing overhead, and likely impact performance. Additionally, custom encryption implementations are error-prone and not recommended when AWS provides native encryption solutions.
Option D (Encrypted AMI with ephemeral disks): Ephemeral disks (instance store volumes) cannot be encrypted directly. While the root volume can be encrypted, storing sensitive data on unencrypted ephemeral storage would violate the encryption requirement. Additionally, ephemeral storage is temporary and lost when the instance stops.
Community Consensus
The community unanimously agrees (100% vote distribution) that Option A is correct. As noted by community members, EBS encryption "happens transparently to the applications using the EBS volumes, thus not affecting performance in a manner that would be significant." This aligns with AWS documentation stating that EBS encryption has minimal performance impact on current-generation instance types.
Official Reference
- https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSEncryption.html
- https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html
These links open the official vendor documentation in a new tab.
Exam Strategy
When a question emphasizes 'no performance impact' alongside encryption requirements, look for AWS-native encryption services that operate transparently at the infrastructure level (like EBS encryption, S3 SSE-S3, or RDS encryption) rather than application-level or network-based solutions.
Community Votes
100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 3 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 3
-
CrescentShared 👍 6 Answered AOption B is not ideal because writing all data to an S3 bucket would introduce network latency and might impact performance. By default, Amazon EBS volumes can only be attached to one EC2 instance at a time, and they cannot be mounted to multiple instances simultaneously. However, AWS does offer a feature called Amazon EBS Multi-Attach, which allows you to attach a Provisioned IOPS SSD (io1 or io2) EBS volume to up to 16 Nitro-based EC2 instances within the same Availability Zone. This feature is designed for applications that require concurrent access to the same data from multiple instances, such as clustered databases or parallel file systems.
-
SerialiDr 👍 3 Answered AThis approach directly meets the requirement for encryption without impacting performance significantly. AWS EBS encryption offers encryption at rest and integrates with AWS Key Management Service (AWS KMS) for managing encryption keys. This encryption happens transparently to the applications using the EBS volumes, thus not affecting performance in a manner that would be significant for most compute-intensive applications.
-
65703c1 👍 1 Answered AA is the correct answer.
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.
Related Analysis
Practice All DVA-C02 Questions
Access 100 questions with complete answers and detailed explanations.
View Full DVA-C02 Practice Test →