SCS-C02 Data Protection Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Use AWS KMS to rotate the EBS encryption key

  Why it's wrong here

  Rotating the AWS KMS key, even with automatic annual rotation, only replaces the backing CMK material used to decrypt newly created data keys; it has no effect on the encryption state of EBS volumes that already exist. An unencrypted volume remains unencrypted regardless of KMS key rotation because encryption is an attribute assigned when the volume or snapshot is created. KMS rotation also does not cause any new encrypted volumes or snapshots to be provisioned, so it cannot satisfy the requirement.

• ✗

  Use a script to encrypt each volume after creation

  Why it's wrong here

  Writing a script to encrypt volumes after creation is not the native or easiest approach because EBS encryption cannot be enabled in place. You would have to stop the instance, take a snapshot (or copy it to an encrypted snapshot), create a new encrypted volume or instance, and then migrate the data, which is disruptive and error-prone. It also does not enforce encryption for volumes that will be created later, unless you tie the script into your provisioning pipeline, making it a manual safeguard rather than a default rule.

• ✓

  Enable EBS encryption by default in the AWS Region

  Why this is correct

  Enabling EBS encryption by default in the Region is the easiest and most reliable method because it instructs the EC2 service to always encrypt newly created volumes and snapshots at the storage layer. When enabled, every new EBS volume and every new snapshot is encrypted with your default AWS KMS key (either the aws/ebs managed key or a customer-managed key you designate). This setting applies to all volumes created in that Region, including root volumes launched from unencrypted AMIs, without requiring you to modify applications or remember to check an encryption box.

• ✗

  Use application-level encryption

  Why it's wrong here

  Application-level encryption protects data before it writes to disk, but it is independent of EBS and requires developers to explicitly encrypt fields or objects in code, which is far more complex than a storage-layer default. It also creates key-management overhead and affects queryability and performance, whereas EBS encryption is transparent to the application. Because the question asks for the easiest way to ensure EBS data is encrypted, this option is too heavy and indirect.

Go deeper

Related to this question