DEA-C01 Data Security and Governance Practice Question
A company must encrypt all data at rest in their Amazon RDS for MySQL instance. Which THREE steps are required to achieve this? (Select THREE.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use an AWS KMS key to encrypt the instance
To encrypt data at rest in Amazon RDS for MySQL, you must enable encryption when creating the DB instance (option C). This uses an AWS KMS key (option B) to manage the encryption. Encrypted instances require that automated backups and snapshots are also encrypted (option E). Option A (SSL/TLS) encrypts data in transit, not at rest. Option D (modifying the DB parameter group) does not enable encryption at rest.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable SSL/TLS for database connections
Why it's wrong here
SSL/TLS encrypts data in transit, not at rest.
- ✓
Use an AWS KMS key to encrypt the instance
Why this is correct
KMS key is used for encryption at rest.
- ✓
Enable encryption at rest when creating the DB instance
Why this is correct
Encryption at rest must be enabled at creation time.
- ✗
Modify the DB parameter group to require encryption
Why it's wrong here
Parameter groups do not control encryption at rest.
- ✓
Ensure that automated backups and snapshots are encrypted
Why this is correct
Backups of encrypted instances must also be encrypted.
Go deeper
Related to this question
About these practice questions
One of 1,711 original DEA-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DEA-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DEA-C01 exam.