DEA-C01 Data Security and Governance Practice Question
A company uses Amazon RDS for MySQL to store transactional data. The database contains sensitive financial information. The company's security policy requires that all data at rest be encrypted using a customer-managed KMS key. The database was originally launched without encryption at rest. The security team now needs to enable encryption without significant downtime. What should they do?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a snapshot of the database, copy the snapshot with encryption enabled, and restore a new DB instance from the encrypted snapshot.
You cannot enable encryption on an existing RDS instance directly. To encrypt an unencrypted RDS instance, you must create a snapshot, copy it with encryption enabled using a customer-managed KMS key, and then restore a new encrypted DB instance. This method minimizes downtime. Options B and D are incorrect because modifying the DB instance's storage settings does not allow enabling encryption in place. Option C (using DMS) could also achieve encryption but involves more downtime and complexity than the snapshot approach.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create a snapshot of the database, copy the snapshot with encryption enabled, and restore a new DB instance from the encrypted snapshot.
Why this is correct
This is the standard procedure to enable encryption on an existing RDS instance.
- ✗
Enable encryption by modifying the DB instance's storage type to 'encrypted'.
Why it's wrong here
RDS does not support this modification.
- ✗
Use the AWS DMS (Database Migration Service) to migrate data to a new encrypted RDS instance.
Why it's wrong here
While AWS DMS can migrate data to a new encrypted RDS instance, it fails this scenario because the security policy requires encryption at rest using a customer-managed KMS key *without significant downtime*. DMS requires a full table-level migration, which, for a large transactional database, introduces prolonged replication lag and a cutover window that violates the low-downtime requirement. This option is tempting because DMS is the standard tool for migrating between RDS instances with different configurations, such as enabling encryption, and would be correct if the business could tolerate a scheduled maintenance window.
- ✗
Modify the DB instance and enable encryption under the 'Storage' settings.
Why it's wrong here
RDS does not allow enabling encryption on an existing instance.
Go deeper
Related to this question
About these practice questions
One of 1,711 original DEA-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DEA-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DEA-C01 exam.