DEA-C01 Data Security and Governance Practice Question
A company uses Amazon RDS for MySQL to store application data. The database contains personally identifiable information (PII). The security team requires that all data be encrypted at rest using AWS KMS. The database is currently unencrypted. The data engineer needs to enable encryption without significant downtime. Which approach should the data engineer take?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Take a snapshot of the database, copy it with encryption enabled, and restore from the encrypted snapshot.
To enable encryption on an existing unencrypted RDS instance, you must take a snapshot of the database, copy it with encryption enabled (using AWS KMS), and restore from the encrypted snapshot. This process involves downtime during the restore but is the only supported method. Option A is incorrect because AWS DMS can migrate data to a new encrypted RDS instance, but that adds complexity and is not the simplest approach. Option C is incorrect because read replicas cannot be promoted to primary if encryption is enabled on the replica but not on the source; also, the source must be encrypted. Option D is incorrect because you cannot modify an existing RDS instance to enable encryption directly; encryption can only be enabled when creating a new instance from an encrypted snapshot.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use AWS DMS to migrate data to a new encrypted RDS instance continuously.
Why it's wrong here
AWS DMS can migrate data to a new encrypted RDS instance with minimal downtime, but it fails here because the security team requires that *all* data be encrypted at rest using AWS KMS. DMS replicates data in transit and can write to an encrypted target, yet it does not encrypt the source RDS instance itself; any unencrypted backups, snapshots, or temporary storage used during migration remain unencrypted, violating the requirement. This option is tempting because DMS is designed for continuous, near-zero-downtime migrations between databases, and it would be correct if the goal were simply to move data to a new encrypted instance without needing to encrypt the original source.
- ✓
Take a snapshot of the database, copy it with encryption enabled, and restore from the encrypted snapshot.
Why this is correct
Standard procedure to enable encryption on existing RDS.
- ✗
Create a read replica with encryption enabled and promote it to primary.
Why it's wrong here
Read replicas can be encrypted, but the primary remains unencrypted.
- ✗
Modify the RDS instance and enable encryption in the configuration.
Why it's wrong here
Not possible; encryption can only be enabled at creation.
Go deeper
Related to this question
About these practice questions
Courseiva writes every DEA-C01 question from scratch — 1,711 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DEA-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DEA-C01 exam.