How to encrypt EBS volumes for EC2 without impacting performance?
A company is building a compute-intensive application that will run on a fleet of Amazon EC2 instances. The application uses attached Amazon Elastic Block Store (Amazon EBS) volumes for storing data. The Amazon EBS volumes will be created at time of initial deployment. The application will process sensitive information. All of the data must be encrypted. The solution should not impact the application's performance. Which solution will meet these requirements?
Community Votes
100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
This question tests the understanding that EBS encryption is handled transparently at the hypervisor level, meaning it does not require application modifications and has negligible performance impact compared to application-level or network-based encryption solutions.
Amazon EBS encryption provides transparent encryption at rest for EC2-attached volumes using AWS KMS, ensuring sensitive data is secured without requiring application-level changes or introducing significant performance overhead.
Candidates often choose Option B (S3) because S3 is a common storage service, but writing all data to S3 would introduce significant network latency and impact the performance of a compute-intensive application, violating the requirement.
Community Discussion (3 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Understanding EBS Encryption
Amazon Elastic Block Store (EBS) encryption provides a simple way to encrypt your EBS volumes and snapshots. When you create an encrypted EBS volume and attach it to a supported instance type, the data stored at rest, disk I/O, and snapshots created from the volume are all encrypted.
Key characteristics of EBS encryption:
- Encryption is handled transparently at the hypervisor level
- Uses AWS Key Management Service (AWS KMS) for key management
- Supports AES-256 encryption algorithm
- Has negligible performance impact on modern instance types
- Requires no application code changes
Why Option A is Correct
Option A directly satisfies all requirements: 1. Encryption requirement: EBS volumes are encrypted at rest using AWS KMS 2. Performance requirement: EBS encryption operates transparently with minimal overhead 3. Application compatibility: No changes needed to the application code 4. Data protection: All data written to the EBS volume is automatically encrypted
Why Other Options Are Wrong
Option B (S3 bucket): While S3 supports encryption, routing all application data through S3 would introduce significant network latency. For a compute-intensive application using attached storage, this would dramatically impact performance and violate the requirement that "the solution should not impact the application's performance."
Option C (Custom encryption): Implementing custom encryption at the application level would require significant code changes, introduce processing overhead, and likely impact performance. Additionally, custom encryption implementations are error-prone and not recommended when AWS provides native encryption solutions.
Option D (Encrypted AMI with ephemeral disks): Ephemeral disks (instance store volumes) cannot be encrypted directly. While the root volume can be encrypted, storing sensitive data on unencrypted ephemeral storage would violate the encryption requirement. Additionally, ephemeral storage is temporary and lost when the instance stops.
Community Consensus
The community unanimously agrees (100% vote distribution) that Option A is correct. As noted by community members, EBS encryption "happens transparently to the applications using the EBS volumes, thus not affecting performance in a manner that would be significant." This aligns with AWS documentation stating that EBS encryption has minimal performance impact on current-generation instance types.
Official Reference
Exam Strategy
When a question emphasizes 'no performance impact' alongside encryption requirements, look for AWS-native encryption services that operate transparently at the infrastructure level (like EBS encryption, S3 SSE-S3, or RDS encryption) rather than application-level or network-based solutions.
Related Analysis
Practice All DVA-C02 Questions
Access 100 questions with complete answers and detailed explanations.
View Full DVA-C02 Practice Test →