AWS Certified Devops Engineer Professional · Free Practice Question Medium
Question 14
An application running on an Amazon EC2 instance stores sensitive data on an attached Amazon EBS volume. The volume is not encrypted. A DevOps engineer must enable encryption at rest for the data.
Which actions should the engineer take? (Select TWO.)
-
A
Use AWS Data Lifecycle Manager to automatically enable encryption for the EBS volume and encrypt the existing data.
-
B
Upload a self-signed SSL/TLS certificate to the EC2 instance. Use a secure session to encrypt all data transferred to the EBS volume.
-
C
Unmount the EBS volume, take a snapshot and encrypt the snapshot. Re-mount the EBS volume.
-
D
Create and mount a new, encrypted EBS volume. Move the data to the new volume. Delete the old EBS volume.
-
E
Copy an unencrypted snapshot of the volume and encrypt the new snapshot. Volumes restored from this encrypted snapshot will also be encrypted.
Reveal correct answers
Correct answers: D, E
Explanation
You cannot enable encryption for an existing EBS volume. You must enable encryption of the volume at creation time. There are a couple of ways to enable encryption of data stored on an unencrypted volume:
1) Create a snapshot of the volume. The snapshot will also be unencrypted, but you can then copy it and enable encryption. Then, you can create an encrypted volume from the snapshot and attach it to the instance.
2) Create and mount a new, encrypted EBS volume. The engineer would then need to move data onto the volume.
In both cases the engineer will need to update the application to use the new volume.
CORRECT: "Copy an unencrypted snapshot of the volume and encrypt the new snapshot. Volumes restored from this encrypted snapshot will also be encrypted" is a correct answer (as explained above.)
CORRECT: "Create and mount a new, encrypted EBS volume. Move the data to the new volume. Delete the old EBS volume" is also a correct answer (as explained above.)
INCORRECT: "Unmount the EBS volume, take a snapshot and encrypt the snapshot. Re-mount the EBS volume" is incorrect.
This has not resulted in any change to the EBS volume, it is still unencrypted.
INCORRECT: "Use AWS Data Lifecycle Manager to automatically enable encryption for the EBS volume and encrypt the existing data" is incorrect.
You cannot enable encryption for existing volumes through any AWS tools.
INCORRECT: "Upload a self-signed SSL/TLS certificate to the EC2 instance. Use a secure session to encrypt all data transferred to the EBS volume" is incorrect.
SSL/TLS certificates are used for enabling encryption in-transit, not encryption at-rest.
References:
https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSEncryption.html
Save time with our exam-specific cheat sheets:
Discussion
Think the marked answer is wrong, or have a better explanation? Share it below — comments appear after review.
