Encrypt EBS by default with an instance refresh and build an encrypted Aurora cluster from a snapshot

SCS-C02 By islever Editorial Last updated

Design and implement controls that provide confidentiality and integrity for data at rest. Design and implement controls to protect credentials, secrets, and cryptographic key materials.

Short answer

AC Enable EBS encryption-by-default with an instance refresh and restore a KMS-encrypted Aurora cluster from a snapshot.

Question

A company is designing a new application stack. The design includes web servers and backend servers that are hosted on Amazon EC2 instances. The design also includes an Amazon Aurora MySQL DB cluster. The EC2 instances are in an Auto Scaling group that uses launch templates. The EC2 instances for the web layer and the backend layer are backed by Amazon Elastic Block Store (Amazon EBS) volumes. No layers are encrypted at rest A security engineer needs to implement encryption at rest. Which combination of steps will meet these requirements? (Choose two.)
  1. Modify EBS default encryption settings in the target AWS Region to enable encryption. Use an Auto Scaling group instance refresh. Correct Answer
  2. Modify the launch templates for the web layer and the backend layer to add AWS Certificate Manager (ACM) encryption for the attached EBS volumes. Use an Auto Scaling group instance refresh.
  3. Create a new AWS Key Management Service (AWS KMS) encrypted DB cluster from a snapshot of the existing DB cluster. Correct Answer
  4. Apply AWS Key Management Service (AWS KMS) encryption to the existing DB cluster.
  5. Apply AWS Certificate Manager (ACM) encryption to the existing DB cluster.

Key Takeaways

EBS encryption-by-default plus an instance refresh is the native way to encrypt previously unencrypted instances. Aurora encryption is set at creation, so an existing unencrypted cluster is migrated by snapshotting and restoring into a new KMS-encrypted cluster. Neither task uses ACM, which manages TLS certificates, not at-rest encryption.

Web and backend EC2 layers use EBS that is unencrypted, and an Aurora MySQL cluster is unencrypted. For EBS, enable EBS encryption-by-default in the Region and perform an Auto Scaling group instance refresh so existing instances are replaced by encrypted ones launched from the templates. For Aurora, you cannot encrypt an existing cluster in place; create a new KMS-encrypted cluster restored from a snapshot of the current cluster. ACM is for certificates, not storage encryption, so it does not apply.

Common mistake: Using ACM for EBS or Aurora encryption (options B/E)—ACM issues certificates, not KMS data keys, so it cannot encrypt storage. Or trying to apply KMS encryption to an existing Aurora cluster in place (option D), which AWS does not support; a snapshot-restore to a new encrypted cluster is required.

Expert Analysis

Why the Answer Is Correct

A enables EBS encryption-by-default in the Region and triggers an Auto Scaling group instance refresh, replacing instances with encrypted EBS volumes. C creates a new KMS-encrypted Aurora cluster from a snapshot of the existing one, the supported path since Aurora encryption cannot be added to a live cluster. Both meet encryption-at-rest with native mechanisms.

Why the Other Options Are Wrong

B and E propose ACM encryption for EBS/Aurora; ACM manages certificates, not storage encryption, so they are invalid. D tries to encrypt an existing cluster in place, which Aurora does not allow—snapshot-and-restore to an encrypted cluster (C) is required. A and C are the correct pair.

Community Comment Notes

Community voted A,C (100). Commenters stressed you cannot encrypt EBS with ACM and cannot encrypt an existing Aurora cluster directly—snapshot to a KMS-encrypted cluster is needed. B, D, and E were dismissed as invalid or impossible.

Official Reference

These links open the official vendor documentation in a new tab.

Community Votes

AC
100%

100% of anonymous learners picked answer AC. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 5 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 5

  1. aescudero51 👍 4
    A/C B - You don't use ACM for encryption, it's KMS D - You can't encrypt an existing cluster, you need to snapshot, then encrypt with KMS E - Same as B
  2. danish1234 👍 2
    AC . You can not encrypt ebs with ACM.
  3. danish1234 👍 1
    AC . All other options are joke.
  4. Zek 👍 1
    A,C - Agree
  5. sema2232 👍 1
    why not B?

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

Preserve EC2 forensic evidence by isolating first, then capturing memory before stopping the instance

S-grade

Grant the report Lambda Security Hub read-only access because findings are already in Security Hub

S-grade

Deny inbound MySQL 3306 and allow outbound TLS 443 with ephemeral return in a custom NACL

S-grade

Prepare a PHI/public-bucket audit with Macie, Audit Manager, and Security Hub FSBP

S-grade

← Back to SCS-C02 Study Guide