DEA-C01 Data Security and Governance Practice Question
A company needs to ensure that data stored in Amazon RDS is encrypted at rest. Which action should the data engineer take?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a new RDS instance with encryption enabled using AWS KMS.
Amazon RDS encryption at rest must be enabled when the DB instance is created, using AWS KMS. It cannot be added later. Option A is incorrect because encryption cannot be enabled on an existing RDS instance; you must create a new one with encryption enabled. Option B is incorrect because encrypting the underlying EBS volumes does not encrypt the RDS database; RDS encryption at rest is separate and must be configured at the instance level. Option D is incorrect because SSL/TLS secures data in transit, not at rest.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable encryption at rest by modifying the existing RDS instance.
Why it's wrong here
Encryption at rest cannot be enabled on an existing RDS instance; it must be enabled at creation.
- ✗
Encrypt the underlying EBS volumes using AWS KMS.
Why it's wrong here
RDS manages the underlying storage; encrypting EBS volumes is not supported for RDS.
- ✓
Create a new RDS instance with encryption enabled using AWS KMS.
Why this is correct
Encryption at rest must be enabled at launch time for RDS.
- ✗
Enable SSL/TLS for connections to the RDS instance.
Why it's wrong here
SSL/TLS encrypts data in transit, not at rest.
Go deeper
Related to this question
About these practice questions
Courseiva writes every DEA-C01 question from scratch — 1,711 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DEA-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DEA-C01 exam.