AWS Certified DevOps Engineer - Professional DOP-C02 — Topic 1 Question 52

Question

A company uses AWS Organizations to manage multiple accounts. Information security policies require that all unencrypted Amazon EBS volumes be marked as non-compliant. A DevOps engineer needs to automatically deploy the solution and ensure that this compliance check is always present. Which solution will accomplish this?

Accepted Answer

Correct answer: B. The correct answer is B. Option B: Create an AWS Config organizational rule to check whether EBS encryption is enabled and deploy the rule using the AWS CLI. Create and apply an SCP to prohibit stopping and deleting AWS Config across the organization. Amazon EBS provides block storage attached to a single EC2 instance. Service Control Policies set guardrails on what accounts in an organization can do. AWS Config tracks resource configuration changes and evaluates compliance.

AWS Certified DevOps Engineer - Professional DOP-C02 — Question 52