SAA-C03 Design Secure Architectures Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Run a daily Lambda function to encrypt unencrypted volumes

  Why it's wrong here

  A daily Lambda would need to identify unencrypted volumes and create encrypted snapshots or volume copies to replace them, because EBS volume encryption cannot be enabled in-place on an existing volume. This is a reactive remediation pattern that leaves an exposure window during which sensitive customer data remains unencrypted on disk. Furthermore, copying live production volumes can cause downtime or data consistency issues, making it an unreliable control compared with preventing the noncompliant volume from being created in the first place.

• ✗

  Enable VPC Flow Logs

  Why it's wrong here

  VPC Flow Logs capture metadata about IP traffic within a VPC—source and destination IP addresses, ports, protocol, and whether the traffic was accepted or rejected—but they have no effect on how EBS volumes are encrypted. They are a network visibility and security analysis tool, not a data-at-rest encryption control. Enabling Flow Logs will neither encrypt existing volumes nor influence future volume creation, so it fails to address the stated requirement entirely.

• ✗

  Tag encrypted volumes after creation

  Why it's wrong here

  Tagging encrypted volumes after creation is purely a labeling activity that supports cost tracking and resource organization; it does not alter the underlying volume's encryption state. A tag can claim that a volume is encrypted even when it is not, and it performs no encryption operation. This approach also requires the noncompliant volume to already exist, so it cannot prevent data exposure or provide proactive compliance assurance.

• ✓

  Use an SCP that denies ec2:CreateVolume when the encrypted condition is false

  Why this is correct

  An SCP is an AWS Organizations policy that applies a permission guardrail to all IAM principals in member accounts, and it can deny ec2:CreateVolume when the request does not include the ec2:Encrypted condition key set to true. For example, a statement using the Bool condition on ec2:Encrypted: false will block any attempt to launch an unencrypted volume in every account under the organizational unit, regardless of IAM permissions. This is a preventive control that stops noncompliant resources before creation, which exactly satisfies the requirement, and an SCP cannot be overridden by user or role policies.

Go deeper

Related to this question