DEA-C01 Data Store Management Practice Question
A company stores sensitive user data in an Amazon RDS for PostgreSQL DB instance. A security audit requires that all data be encrypted at rest. The database is currently unencrypted. What is the MOST operationally efficient way to enable encryption at rest?
⚠ Common exam trap
Watch out — candidates often assume encryption can be toggled on via a simple 'Modify' operation in the console or CLI, but AWS RDS explicitly requires a snapshot copy and restore for existing unencrypted instances, a detail often overlooked in favor of more familiar modification workflows.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Take a snapshot of the DB instance, copy it with encryption enabled, and restore the snapshot to a new DB instance.
RDS for PostgreSQL does not support enabling encryption at rest on an existing unencrypted DB instance directly. The only way to achieve this is by taking a snapshot of the unencrypted instance, creating an encrypted copy of that snapshot, and then restoring it to a new encrypted DB instance. This method is operationally efficient as it uses native RDS snapshot copy and restore capabilities without requiring additional infrastructure or manual data migration.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create a read replica with encryption enabled and promote it.
Why it's wrong here
The read replica would be encrypted, but the source remains unencrypted, and promoting it doesn't fix the source.
- ✓
Take a snapshot of the DB instance, copy it with encryption enabled, and restore the snapshot to a new DB instance.
Why this is correct
This is the standard method to enable encryption for an existing unencrypted RDS instance.
- ✗
Modify the DB instance and enable encryption in the console.
Why it's wrong here
RDS does not support enabling encryption on an existing instance directly.
- ✗
Modify the DB parameter group to include encryption parameters and reboot the instance.
Why it's wrong here
Parameter groups do not control storage encryption; they control database engine parameters.
Go deeper
Related to this question
About these practice questions
One of 1,711 original DEA-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DEA-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DEA-C01 exam.