Courseiva
← DEA-C01
Full test
Data Security and Governance →easyMultiple ChoiceObjective-mapped

DEA-C01 Data Security and Governance Practice Question

A data engineer is setting up an Amazon RDS for MySQL database. The compliance team requires that all data at rest be encrypted. What must the engineer do to enable encryption for this database?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Specify an AWS KMS key when launching the DB instance

Encryption at rest for Amazon RDS can only be enabled at launch time. After creation, you cannot enable encryption; you must create a new encrypted instance and migrate data.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • ✓

    Specify an AWS KMS key when launching the DB instance

    Why this is correct

    Encryption must be enabled at launch by choosing a KMS key.

  • ✗

    Enable encryption after the DB instance is created by modifying the DB instance

    Why it's wrong here

    RDS does not support enabling encryption on an existing unencrypted DB instance.

  • ✗

    Use AWS Secrets Manager to store the encryption key and attach it to the DB instance

    Why it's wrong here

    Secrets Manager does not encrypt the database; it stores secrets.

  • ✗

    Encrypt the underlying EBS volumes after the instance is created

    Why it's wrong here

    RDS does not expose underlying EBS volumes; encryption is managed at the database level.

About these practice questions

This DEA-C01 question is part of Courseiva's 1,711-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This DEA-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DEA-C01 exam.