Exam AWS Certified Solutions Architect - Professional SAP-C02 topic 1 question 320 discussion

"must implement a solution to encrypt all NEWWW EBS volumes at rest."

there is no direct way to encrypt existing unencrypted EBS volumes or snapshots. https://docs.aws.amazon.com/prescriptive-guidance/latest/patterns/automatically-encrypt-existing-and-new-amazon-ebs-volumes.html

I am not picking an answer, I just wanted to point out that EBS encryption is regions specific. option D says : Turn on EBS encryption by default in all AWS Regions. there is no such feature. Option D still appears to be the best answer

Answer: D Encryption of Amazon Elastic Block Store (Amazon EBS) volumes is important to an organization's data protection strategy. It is an important step in establishing a well-architected environment. Although there is no direct way to encrypt existing unencrypted EBS volumes or snapshots, you can encrypt them by creating a new volume or snapshot. https://docs.aws.amazon.com/prescriptive-guidance/latest/patterns/automatically-encrypt-existing-and-new-amazon-ebs-volumes.html

Option D

The keyword is all NEW EBS volumes. So by make EBS Encryption default, it means all new EBS will be encrypted without additional configuration.

Least effort option

The question states: ' A solutions architect must implement a solution to encrypt all new EBS volumes at rest' reference: https://repost.aws/knowledge-center/ebs-automatic-encryption

https://docs.aws.amazon.com/prescriptive-guidance/latest/patterns/automatically-encrypt-existing-and-new-amazon-ebs-volumes.html