- A
Use a custom AWS Key Management Service (KMS) key for encryption.
Using a custom KMS key is not strictly required but is a valid step to control encryption keys, so it is correct.
- B
Enable encryption on the EBS snapshots after creation.
Why wrong: Encryption of snapshots is inherited from the source volume; you cannot enable encryption on a snapshot after creation. This option is incorrect.
- C
Launch EC2 instances with the EBS-optimized attribute set.
Why wrong: EBS-optimized is a performance setting for EC2 instances and does not affect encryption. This option is incorrect.
- D
Enable EBS encryption by default in the AWS account for the region.
Enabling EBS encryption by default in the AWS account ensures all new volumes are encrypted by default. This option is correct.
- E
For existing unencrypted volumes, create an encrypted snapshot and restore from it.
For existing unencrypted volumes, you must create an encrypted snapshot and restore a new volume from it to achieve encryption. This option is correct.
PAS-C01 EBS Encryption Practice Question
This PAS-C01 practice question tests your understanding of operations and maintenance. The scenario asks you to isolate a root cause — eliminate options that address a different problem before choosing. A key principle to apply: eBS Encryption. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A company is running SAP HANA on AWS and uses multiple EBS volumes for data and log storage. The company wants to encrypt all data at rest. Which three steps are required to ensure encryption of all EBS volumes? (Choose THREE.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
Use a custom AWS Key Management Service (KMS) key for encryption.
Option A is correct because using a custom AWS KMS key allows granular control over encryption of EBS volumes. Option D is correct because enabling EBS encryption by default ensures all new volumes are encrypted automatically. Option E is correct because for existing unencrypted volumes, you must create an encrypted snapshot and restore from it to encrypt the volume. Option B is incorrect because you cannot enable encryption on a snapshot after creation; encryption must be set when creating the snapshot copy. Option C is incorrect because the EBS-optimized attribute relates to network performance, not encryption.
Key principle: EBS Encryption
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use a custom AWS Key Management Service (KMS) key for encryption.
Why this is correct
Using a custom KMS key is not strictly required but is a valid step to control encryption keys, so it is correct.
Related concept
EBS Encryption
- ✗
Enable encryption on the EBS snapshots after creation.
Why it's wrong here
Encryption of snapshots is inherited from the source volume; you cannot enable encryption on a snapshot after creation. This option is incorrect.
- ✗
Launch EC2 instances with the EBS-optimized attribute set.
Why it's wrong here
EBS-optimized is a performance setting for EC2 instances and does not affect encryption. This option is incorrect.
- ✓
Enable EBS encryption by default in the AWS account for the region.
Why this is correct
Enabling EBS encryption by default in the AWS account ensures all new volumes are encrypted by default. This option is correct.
Related concept
EBS Encryption
- ✓
For existing unencrypted volumes, create an encrypted snapshot and restore from it.
Why this is correct
For existing unencrypted volumes, you must create an encrypted snapshot and restore a new volume from it to achieve encryption. This option is correct.
Related concept
EBS Encryption
Common exam traps
Common exam trap: answer the scenario, not the keyword
A common trap is thinking that you can directly enable encryption on an existing unencrypted EBS volume or that you can encrypt snapshots after creation. The correct process is to create an encrypted snapshot copy and restore from it.
Detailed technical explanation
How to think about this question
Treat this as a scenario question. Identify the problem, the constraint, and the best action. Then compare each option against those facts.
KKey Concepts to Remember
- EBS Encryption
- AWS Key Management Service (KMS)
- EBS Snapshot Encryption
- Default Encryption Setting
TExam Day Tips
- Watch for words such as best, first, most likely and least administrative effort.
- Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
EBS Encryption
Real-world example
How this comes up in practice
A media company stores terabytes of video archives that are accessed once a year for audit purposes. Moving these objects to a cold storage tier (Azure Archive, S3 Glacier, or Google Nearline) costs a fraction of hot storage. Questions like this test whether you understand storage tiers, access frequency tradeoffs, and retrieval latency requirements.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
What to study next
Got this wrong? Here's your next step.
Review eBS Encryption, then practise related PAS-C01 questions on the same topic to reinforce the concept.
- →
Operations and Maintenance — study guide chapter
Learn the concepts, then practise the questions
- →
Operations and Maintenance practice questions
Targeted practice on this topic area only
- →
All PAS-C01 questions
1,733 questions across all exam domains
- →
AWS Certified SAP on AWS Specialty PAS-C01 study guide
Full concept coverage aligned to exam objectives
- →
PAS-C01 practice test guide
How to use practice tests most effectively before exam day
Related practice questions
Related PAS-C01 practice-question pages
Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.
Design of SAP Workloads on AWS practice questions
Practise PAS-C01 questions linked to Design of SAP Workloads on AWS.
Technology practice questions
Practise PAS-C01 questions linked to Technology.
Migration practice questions
Practise PAS-C01 questions linked to Migration.
Operations and Maintenance practice questions
Practise PAS-C01 questions linked to Operations and Maintenance.
PAS-C01 fundamentals practice questions
Practise PAS-C01 questions linked to PAS-C01 fundamentals.
PAS-C01 scenario practice questions
Practise PAS-C01 questions linked to PAS-C01 scenario.
PAS-C01 troubleshooting practice questions
Practise PAS-C01 questions linked to PAS-C01 troubleshooting.
Practice this exam
Start a free PAS-C01 practice session
Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.
FAQ
Questions learners often ask
What does this PAS-C01 question test?
Operations and Maintenance — This question tests Operations and Maintenance — EBS Encryption.
What is the correct answer to this question?
The correct answer is: Use a custom AWS Key Management Service (KMS) key for encryption. — Option A is correct because using a custom AWS KMS key allows granular control over encryption of EBS volumes. Option D is correct because enabling EBS encryption by default ensures all new volumes are encrypted automatically. Option E is correct because for existing unencrypted volumes, you must create an encrypted snapshot and restore from it to encrypt the volume. Option B is incorrect because you cannot enable encryption on a snapshot after creation; encryption must be set when creating the snapshot copy. Option C is incorrect because the EBS-optimized attribute relates to network performance, not encryption.
What should I do if I get this PAS-C01 question wrong?
Review eBS Encryption, then practise related PAS-C01 questions on the same topic to reinforce the concept.
What is the key concept behind this question?
EBS Encryption
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Keep practising
More PAS-C01 practice questions
- A company runs SAP S/4HANA on AWS. The environment includes an SAP HANA database on an EC2 instance with multiple EBS vo…
- A company runs SAP S/4HANA on AWS with a High Availability (HA) cluster spanning two Availability Zones (us-east-1a and…
- A company is planning to migrate its SAP landscape to AWS. The landscape includes development, quality assurance, and pr…
- A company is using AWS Systems Manager Patch Manager to patch a fleet of EC2 instances. The instances are in a patch gro…
- A company is migrating a legacy on-premises application to AWS. The application uses a MySQL database with a complex sto…
- A company is migrating a large SAP ERP system to AWS using SAP HANA. They want to minimize downtime and ensure consisten…
Last reviewed: Jun 20, 2026
This PAS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PAS-C01 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.