Automating EBS Volume Encryption Compliance

SAA-C03 By islever Editorial Last updated

Determine appropriate data security controls.

Short answer

D Create an AWS Config rule for Amazon EBS to evaluate if a volume is encrypted and to flag the volume if it is not encrypted.

Question

A company wants to standardize its Amazon Elastic Block Store (Amazon EBS) volume encryption strategy. The company also wants to minimize the cost and configuration effort required to operate the volume encryption check. Which solution will meet these requirements?
  1. Write API calls to describe the EBS volumes and to confirm the EBS volumes are encrypted. Use Amazon EventBridge to schedule an AWS Lambda function to run the API calls.
  2. Write API calls to describe the EBS volumes and to confirm the EBS volumes are encrypted. Run the API calls on an AWS Fargate task.
  3. Create an AWS Identity and Access Management (IAM) policy that requires the use of tags on EBS volumes. Use AWS Cost Explorer to display resources that are not properly tagged. Encrypt the untagged resources manually.
  4. Create an AWS Config rule for Amazon EBS to evaluate if a volume is encrypted and to flag the volume if it is not encrypted. Correct Answer

Key Takeaways

The question tests knowledge of native AWS governance tools; the trap is over-engineering with Lambda or Fargate when a managed service like AWS Config already handles this compliance check out-of-the-box.

AWS Config managed rules provide the most efficient method to audit and flag unencrypted Amazon EBS volumes, minimizing both cost and configuration effort compared to custom code solutions.

Common mistake: Candidates often choose Lambda (Option A) because they think 'automation' requires code, failing to recognize that AWS Config Managed Rules are pre-built, serverless, and require zero maintenance for standard checks.

Expert Analysis

Why the Answer Is Correct

AWS Config is designed specifically for assessing, auditing, and evaluating resource configurations against desired standards. It offers a library of Managed Rules, including ebs-volume-encrypted, which automatically evaluates EBS volumes for encryption status. This meets the requirement to minimize configuration effort because no code needs to be written, deployed, or maintained. It also minimizes operational cost as it is a fully managed service.

Why the Other Options Are Wrong

Options A and B involve writing custom API calls using Lambda or Fargate. While functional, this approach requires significant development, testing, and ongoing maintenance effort, directly contradicting the requirement to 'minimize configuration effort.' Option C suggests using tags and Cost Explorer, but Cost Explorer is for billing analysis, not real-time security compliance checking, and manual remediation does not automate the strategy.

Community Comment Notes

The community consensus strongly supports Option D. As user mestule noted, AWS Config enables assessment and evaluation of configurations, which aligns perfectly with the exam objective. Another commenter highlighted that managed rules allow you to quickly start assessing resources without building custom infrastructure, reinforcing the 'minimize effort' constraint.

Official Reference

https://docs.aws.amazon.com/config/latest/developerguide/evaluate-config_use-managed-rules.html

This link opens the official vendor documentation in a new tab.

Exam Strategy

When an exam question asks to 'minimize effort' or 'standardize' a security/compliance check, always look for AWS Managed Services (like Config Managed Rules, GuardDuty, or Security Hub) before considering custom Lambda/Fargate solutions. Built-in rules are cheaper to operate and easier to maintain.

Frequently Asked Questions

Why not use Lambda to check encryption?

Lambda requires custom code, deployment, and maintenance. AWS Config Managed Rules are pre-built, serverless, and require zero configuration effort, better meeting the prompt's constraints.

Can AWS Config automatically encrypt unencrypted volumes?

The default managed rule only evaluates and flags non-compliance. To automatically fix it, you would need to create a custom rule or trigger a remediation action via Systems Manager Automation.

More SAA-C03 FAQ →

Community Votes

D
100%

100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 6 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 6

  1. betttty 👍 4
    D : you could use a managed rule to quickly start assessing whether your Amazon Elastic Block Store (Amazon EBS) volumes are encrypted or whether specific tags are applied to your resources. https://docs.aws.amazon.com/config/latest/developerguide/evaluate-config_use-managed-rules.html
  2. mestule 👍 4 Answered D
    AWS Config is a service that enables you to assess, audit, and evaluate the configurations of your AWS resources. It can check whether your resources comply with certain conditions (such as being encrypted), and it can flag or take action on resources that do not comply.
  3. bodakrishna 👍 3
    AWS Config allows you to define rules to automatically check the configuration of AWS resources against desired configurations. By creating a custom AWS Config rule specifically for Amazon EBS volumes to evaluate if they are encrypted, you can ensure consistent encryption across all volumes. If a volume is found to be unencrypted, it can be flagged for further action. This solution automates the process of encryption checking, minimizing manual effort and ensuring standardization across the environment. Additionally, AWS Config provides a cost-effective solution compared to continuously running scripts or tasks.
  4. Andy_09 👍 3
    Correct answer is D
  5. asdfcdsxdfc 👍 3 Answered D
    D looks right
Show 1 more comment
  1. MatAlves 👍 1
    D: no-brainer.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

S3 Multi-Region Access Point and Replication Strategy

S-grade

Securing NLB with Security Groups for Minimal Change

S-grade

Most Cost-Effective 7-Year Retention for EBS Snapshots?

S-grade

AWS Forecast vs SageMaker for Time-Series Prediction

S-grade

Practice All SAA-C03 Questions

Access 120 questions with complete answers and detailed explanations.

View Full SAA-C03 Practice Test →

← Back to SAA-C03 Study Guide