How to Encrypt Amazon EFS at Rest and In Transit
A company is migrating on-premises file servers to Amazon EFS. The data must be encrypted at rest and in transit. Which THREE steps should the company take to meet these requirements?
Quick Answer
The correct answer involves three steps: enabling encryption at rest on the EFS file system, mounting the file system using TLS, and using a KMS customer managed key for encryption. Encryption at rest is a file-system-level attribute that you enable at creation time, ensuring all data written to the underlying storage is automatically encrypted using AES-256. Encryption in transit, on the other hand, is achieved by enforcing TLS when clients mount the file system, which protects data as it moves over the network. On the AWS Certified Security Specialty SCS-C02 exam, this question tests your understanding that EFS encryption at rest is not retroactive and that TLS is the required protocol for in-transit protection, not SSL certificates or AWS Certificate Manager. A common trap is assuming you can add encryption at rest later or that ACM plays a role in EFS mounts. Memory tip: think “EFS = Encrypt at File System creation, TLS for Transit, KMS for Key control.”
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use a KMS customer managed key for encryption at rest
To meet the requirements for encryption at rest and in transit on Amazon EFS, you need three steps: (1) Use a KMS customer managed key for encryption at rest (option A). (2) Enable encryption at rest on the EFS file system (option E). (3) Mount the EFS file system using TLS to ensure encryption in transit (option D). Option B (using AWS Certificate Manager) is not needed because EFS does not require certificates for its TLS implementation. Option C (installing an SSL certificate on the EFS file system) is incorrect because EFS does not support installing certificates directly; TLS is handled at the client side during mounting.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use a KMS customer managed key for encryption at rest
Why this is correct
Using a KMS customer managed key is a way to control the encryption key for at-rest encryption, but it requires that encryption at rest is enabled first. This is a necessary step.
- ✗
Use AWS Certificate Manager to issue a certificate
Why it's wrong here
AWS Certificate Manager issues certificates for services like CloudFront or ALB, but EFS does not require certificates for TLS; TLS is handled via the EFS mount helper.
- ✗
Install an SSL certificate on the EFS file system
Why it's wrong here
EFS does not support installing SSL certificates directly on the file system; TLS encryption in transit is configured on the client side during mounting.
- ✓
Mount the EFS file system using TLS
Why this is correct
Mounting the EFS file system with TLS ensures encryption in transit between the client and the EFS service.
- ✓
Enable encryption at rest on the EFS file system
Why this is correct
Enabling encryption at rest on the EFS file system is the first step to ensure data is encrypted when stored.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SCS-C02 question from scratch — 376 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on SCS-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company needs to implement data protection for Amazon EFS file systems. Which TWO features should be configured?
easy- A.Configure EFS Block Public Access.
- B.Enable EFS versioning.
- ✓ C.Enable encryption in transit using TLS.
- D.Configure EFS lifecycle management to transition files to Infrequent Access.
- ✓ E.Enable encryption at rest using AWS KMS.
Why C: Options C and E are correct. For data protection, EFS supports encryption in transit using TLS (option C) and encryption at rest using AWS KMS (option E). Option A is incorrect because EFS uses security groups for network access control, not Block Public Access which is an S3 feature. Option B is wrong because EFS does not support versioning. Option D is incorrect because lifecycle management transitions files to Infrequent Access for cost optimization, not data protection.
Variation 2. A company is migrating its on-premises file server to Amazon EFS. The data includes sensitive financial records. The security team requires encryption at rest and in transit. The team plans to mount the EFS file system on EC2 instances using the NFS client. They have enabled encryption at rest on the EFS file system. However, they are unsure how to enforce encryption in transit. What should they do to ensure all data transferred between the EC2 instance and EFS is encrypted?
medium- ✓ A.Mount the EFS file system using the `mount -t nfs4 -o tls` command on the EC2 instance.
- B.Enable encryption in transit in the EFS file system policy and rely on the default NFS client behavior.
- C.Set up a VPN connection between the VPC and the on-premises network to encrypt all traffic.
- D.Use AWS Certificate Manager to issue a certificate for the EFS file system.
Why A: To enforce encryption in transit for EFS, you must use the `mount` command with the `tls` option, which ensures the NFS client uses TLS encryption for all data transferred. Option B is incorrect because enabling encryption in transit in the EFS file system policy only allows encrypted connections; the client must explicitly request TLS via the mount option. Option C is incorrect because a VPN is not necessary for EFS encryption in transit and does not address the client configuration. Option D is incorrect because AWS Certificate Manager is not used for EFS encryption in transit; it is used for SSL/TLS certificates for other services like ALB or CloudFront.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.