Preparing Practice Exam…
Please wait a moment while the system generates the exam questions, answers, and study session.
Please wait a moment while the system generates the exam questions, answers, and study session.
AWS Certified Solutions Architect - Associate · AWS
Select 2 answers.
This question asks for 2 answers, but our data marks only 1. Compare with the community discussion below for the full answer.
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
D is easy because you have to add permission to use the KMS key C is better than anything else because it is recommended practice to secure your volumes https://aws.amazon.com/blogs/compute/must-know-best-practices-for-amazon-ebs-encryption/?utm_source=chatgpt.com
Why C is Correct: Enabling EBS encryption by default in the Region ensures that all newly created EBS volumes are encrypted automatically. You can specify a customer managed KMS key as the default encryption key. Why D is Correct: The EKS cluster (and its nodes) will need IAM permissions to use the customer managed KMS key for encryption/decryption. Associating the correct IAM role with the EKS cluster ensures this access.
D is clear and as to B vs C? The trade-off is the potential for encrypting other volumes in the Region, but the manual effort and complexity of Option B outweigh this concern when considering operational efficiency.