PAS-C01 Design of SAP Workloads on AWS Practice Question
An SAP environment on AWS uses a shared /sapmnt file system via Amazon EFS. The company wants to encrypt data at rest for the entire stack. Which services require separate encryption configurations?
⚠ Common exam trap
Test-takers frequently assume a single encryption setting (like enabling EBS default encryption) covers all storage services, but AWS requires separate encryption configurations for each service (EBS, EFS, S3, etc.) because they use independent encryption mechanisms and KMS key policies.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
EBS volumes and EFS file system
Amazon EBS volumes and Amazon EFS file systems each require separate encryption configurations because they use distinct encryption mechanisms. EBS uses AWS KMS keys per volume at the block level, while EFS uses a different KMS key configuration at the file system level. Both must be explicitly enabled to achieve full at-rest encryption for the SAP stack.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
EBS volumes and EFS file system
Why this is correct
Both require separate encryption enablement.
- ✗
Application Load Balancer and EFS
Why it's wrong here
ALB does not store data at rest.
- ✗
EFS file system and S3 bucket
Why it's wrong here
S3 is not mentioned in the stack.
- ✗
CloudWatch Logs and EBS volumes
Why it's wrong here
CloudWatch Logs can be encrypted with KMS but is not part of the stack.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PAS-C01 question from scratch — 1,616 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PAS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PAS-C01 exam.