HR department EBS volumes were launched unencrypted and must now be encrypted with minimal downtime. Which remediation approach is appropriate?
Select an answer to reveal the explanation.
Short Explanation
Old unencrypted disks do not magically grow locks when you flip the account default. Snapshot, copy with encryption, attach the new volume, and cut over in a short window. Defaults protect newborns; existing HR drives need a migration lap.
Full Explanation
Remediating encryption gaps on existing EBS volumes typically requires creating encrypted copies via encrypted snapshots (or snapshot copy with a KMS key) and replacing the unencrypted volumes during a controlled cutover—often with a brief stop/start or swap. Encryption by default does not rewrite existing volumes in place, and claiming encryption is impossible is incorrect. Public unencrypted S3 is not an acceptable substitute for HR data. Continuous improvement plans the cutover to minimize downtime while closing the gap.