AWS Certified Sysops Administrator Associate · Free Practice Question Medium
Question 6
A company’s security team requested that all Amazon EBS volumes should be encrypted with a specific AWS KMS customer master key (CMK). A SysOps Administrator is tasked with verifying that the security team’s request has been implemented.
What is the MOST efficient way for the Administrator to verify the correct encryption key is being used?
-
A
Create an AWS Lambda function to run on a daily schedule, and have the function run the aws ec2 describe-volumes --filters encrypted command.
-
B
Use AWS Config to configure the encrypted-volumes managed rule and specify the key ID of the CMK.
-
C
Log in to the AWS Management Console on a daily schedule, then filter the list of volumes by encryption status, then export this list.
-
D
Create an AWS Organizations SCP that only allows encrypt API actions that use the specific KMS CMK.
Reveal correct answer
Correct answer: B
Explanation
The AWS Config encrypted-volumes rule Checks whether the EBS volumes that are in an attached state are encrypted. If you specify the ID of a KMS key for encryption using the kmsId parameter, the rule checks if the EBS volumes in an attached state are encrypted with that KMS key.
CORRECT: "Use AWS Config to configure the encrypted-volumes managed rule and specify the key ID of the CMK" is the correct answer.
INCORRECT: "Create an AWS Lambda function to run on a daily schedule, and have the function run the aws ec2 describe-volumes --filters encrypted command" is incorrect. This is not an efficient solution.
INCORRECT: "Log in to the AWS Management Console on a daily schedule, then filter the list of volumes by encryption status, then export this list" is incorrect. This is not an efficient solution.
INCORRECT: "Create an AWS Organizations SCP that only allows encrypt API actions that use the specific KMS CMK" is incorrect. This is not possible. You cannot restrict API actions by KMS key.
References:
https://docs.aws.amazon.com/config/latest/developerguide/encrypted-volumes.html
Save time with our AWS cheat sheets:
Discussion
Think the marked answer is wrong, or have a better explanation? Share it below — comments appear after review.
