Exam AWS Certified Solutions Architect - Professional SAP-C02 topic 1 question 518 discussion

https://docs.aws.amazon.com/prescriptive-guidance/latest/patterns/automatically-encrypt-existing-and-new-amazon-ebs-volumes.html 1. Use AWS Config to detects an unencrypted EBS volume. Not fleet manager. B and C out. 2. System manager runbook is the automation that create encrypted copy of the EBS snapshot and replace the encrypted EBS with the encrypted copy. The KMS is used for the encryption and it cannot be used to deny creation of unencrypted EBS volume (A is out).

My answer is D Proactive Remediation: The AWS Config rule and Automation runbook identify and remediate existing unencrypted volumes automatically. Preventive Measure: The modified AWS account setting ensures that all new EBS volumes created in the account are automatically encrypted. This approach provides a comprehensive solution that addresses both existing unencrypted volumes and future volume creation. Why not Option A: While it addresses the issue of existing unencrypted volumes, it doesn't prevent future unencrypted volume creation.

D is correct instead of A because AWS support change account setting for EBS encryption

Use config to find unencrypted EBS. Change the default setting.

D Enabling default encryption for EBSs prevents the creation of unencrypted EBSs.

the answer is D