AWS Certified Data Engineer Associate DEA-C01 Practice Question

Your company's compliance policy states that all Amazon Redshift clusters must remain encrypted at all times. As a data engineer, you must be notified whenever someone disables encryption on any cluster. You want an automated, code-free solution that continuously evaluates existing and new clusters and sends an email alert if non-compliance occurs. Which approach satisfies the requirement?

Set up an hourly AWS CodeBuild job that runs an AWS CLI script to call describe-clusters, evaluates the Encrypted flag, and sends an email through Amazon SNS if any cluster is unencrypted.
Enable AWS CloudTrail data events for Amazon Redshift and create an EventBridge rule that triggers a Lambda function to check each cluster's encryption setting and publish a message to an SNS topic when encryption is disabled.
Enable AWS Config, turn on the managed rule redshift-cluster-configuration-check with the clusterDbEncrypted parameter set to true, and configure the rule to publish compliance change notifications to an SNS topic subscribed to by email.
Enable Amazon GuardDuty and configure it to generate findings whenever a Redshift cluster is not encrypted, then forward the findings to an SNS topic that emails the data engineering team.

Report Issue

Answer Description

AWS Config records resource configuration changes and can evaluate them against managed rules. The managed rule redshift-cluster-configuration-check (or the more specific redshift-cluster-kms-enabled) marks a cluster NON_COMPLIANT if encryption is turned off. AWS Config can be configured to publish compliance-change events to an Amazon SNS topic, which can then send email notifications. This delivers continuous evaluation and alerting without building or maintaining custom code. The CloudTrail/Lambda and CodeBuild options require custom logic and ongoing maintenance, and Amazon GuardDuty has no detection for unencrypted Redshift clusters, so they do not meet the requirements.

Ask Bash

Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.