How can the user encrypt the data at rest?

A user is trying to launch an EBS backed EC2 instance under free usage. The user wants to achieve
encryption of the EBS volume. How can the user encrypt the data at rest?

A.
Use AWS EBS encryption to encrypt the data at rest

B.
The user cannot use EBS encryption and has to encrypt the data manually or using a third party tool

C.
The user has to select the encryption enabled flag while launching the EC2 instance

D.
Encryption of volume is not available as a part of the free usage tier

Explanation:
AWS EBS supports encryption of the volume while creating new volumes. It supports encryption of the data at
rest, the I/O as well as all the snapshots of the EBS volume. The EBS supports encryption for the selected
instance type and the newer generation instances, such as m3, c3, cr1, r3, g2. It is not supported with a micro
instance.

Show Hint

← Previous question

Next question →

Leave a Reply 0

Tom

B is incorrect
http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSEncryption.html#EBSEncryption_supported_instances

Muhammad Soliman

No answer is here as I think, Now you could have encrypted boot volumes through AMIs

– Copy unencrypted AMI with encryption flag, from the newly created encrypted AMI you could simply launch a new instance with an encrypted boot volume

https://aws.amazon.com/blogs/aws/new-encrypted-ebs-boot-volumes/

jason

If you follow the launch instance steps for free tier, you’ll notice that you can’t chose encryption on the disk page.

B. is correct, if you want encryption, you’ll need to do it yourself at free tier.

raysmithvic1978

No one check what the question is asked “free tier”, so only micro instances are eligible on free tire. Other instances can be use but not part of the free tier.

So answer is B. Need to use third party software.

raysmithvic1978

Sorry I think the answer is A. Because t2.micro is supporting encryption for ebs volumes.

sevenkings

http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSEncryption.html

lin

Answer is C , there is option to enable encryption flag when you select new disk (EBS) while launching the EC2 instance .

jcodown5

Correct is B because a free usage instances are t2.micro and these instances types aren´t support by Amazon EBS Encryption.

http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSEncryption.html

Cry

Correct

Eric

t2.micro is supported now

awsmind

A and C are the same answer using different words.
D is false so the only answer left is B

A. false, Cannot encrypt the boot volume but can encrypt additional volumes.
B. True, third party tools will work
C. false, Cannot encrypt the boot volume but can encrypt additional volumes.
D. false, now available to all instances encrypt additional volumes

check out: Instance types that support Amazon EBS encryption
http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSEncryption.html#EBSEncryption_supported_instances

Jiping

The answer WAS supposed to be B.

update – on 15 DEC 2015, official New – Encrypted EBS Boot Volumes.
update – Richard@AWS Posted on: Sep 24, 2015 7:39 AM, We are currently adding support for encryption for some additional instance types, including the t2.micro.
update – current official document supports: |…|t2.nano | t2.micro | t2.small |…|

I agree with AWSMIND that it is B.

All his points are valid.

emma

There is no direct way to encrypt an existing unencrypted volume, or to remove encryption from an encrypted volume. However, you can migrate data between encrypted and unencrypted volumes. You can also apply a new encryption status while copying a snapshot:

While copying an unencrypted snapshot of an unencrypted volume, you can encrypt the copy. Volumes restored from this encrypted copy will also be encrypted.

While copying an encrypted snapshot of an encrypted volume, you can re-encrypt the copy using a different CMK. Volumes restored from the encrypted copy will only be accessible using the newly applied CMK.

nyara

Introvert

The right answer is C , since you can have encrypted volumes with free tier and boot drives.

Cloud Geek

for t2.micro encrypted boot volumes are still not supported, only data volumes can be encrypted

Anuj

neil

While launching a new instance, you will choose a snapshot as the root device. Volumes that are created from encrypted snapshots are automatically encrypted, and volumes that are created from unencrypted snapshots are automatically unencrypted. If no snapshot is selected, you can choose to encrypt the volume.

Thus, the user can’t make it encrypted it the snapshot is not encrypted. If the user wants to encrypt the volume, he has to do it manually, e.g., copy an existing snapshot and encrypt it, then launch the instance based on that snapshot.

neil

So the answer is B

ali

Supported Instance Types

Amazon EBS encryption is available on the instance types listed in the table below. These instance types leverage the Intel AES New Instructions (AES-NI) instruction set to provide faster and simpler data protection. You can attach both encrypted and unencrypted volumes to these instance types simultaneously.

ali

Answer is “A”

charm

A.
Use AWS EBS encryption to encrypt the data at rest
(Encryption is allowed on micro instances)

User cannot use EBS encryption and has to encrypt the data manually or using a third party tool
(Encryption was not allowed on micro instances before)