Which encryption options are available for Amazon EFS?

Show answer and explanation

Answer: B

EFS encrypts file data and metadata at rest with KMS keys, and it encrypts data in transit with TLS 1.2. At-rest encryption is selected when the file system is created, while in-transit encryption is requested by the mount helper on the client. You can use either, both, or neither depending on the threat model.

Why the other options are wrong

A. In-transit TLS is available, but so is KMS-backed encryption at rest.
C. EFS supports both modes, so the claim that it supports neither is false.
D. At-rest encryption is not the only option; TLS protects data on the wire as well.

Keep going. 330 SCS-C03 questions, answers explained after each one.

Practise data protection

A company in Account A encrypts its analytics reports with a customer managed KMS key. A data science team in Account B must decrypt those reports, and Account B can already read the bucket that holds them. What must be in place for Account B's decryption calls to succeed?
An analytics pipeline writes millions of small objects per hour to a bucket encrypted with a customer managed KMS key. KMS request charges and throttling are rising. Which bucket setting cuts the number of KMS requests while keeping the same customer key?
A healthcare analytics firm keeps research datasets in S3. Its regulator requires that the cloud provider never be able to read plaintext, and the firm must keep the key material in a location it alone controls. Which design satisfies this?
Amazon Macie reports high-severity sensitive personal data in a production bucket that receives customer uploads. The response must start within minutes, keep a copy of the evidence, and require no manual steps. Which design is best?

Reviewed November 2026. Spotted a problem with this question? Report it from the practice tool.

Which encryption options are available for Amazon EFS?

Why the other options are wrong

More on data protection