DBS-C01 Database Security Practice Question
A company has a compliance requirement to encrypt all RDS snapshots at rest using a customer-managed KMS key. The RDS instance is already encrypted with an AWS-managed key. What is the correct procedure to ensure snapshots use the customer-managed key?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Take a snapshot of the RDS instance, copy the snapshot specifying the customer-managed KMS key, and restore from the copied snapshot.
To encrypt RDS snapshots with a customer-managed KMS key, you must first take a snapshot of the existing instance (which uses an AWS-managed key). Then, copy that snapshot and specify the customer-managed KMS key during the copy operation. Finally, restore from the copied snapshot to create a new instance encrypted with the customer-managed key. Option A is incorrect because you cannot change the encryption key of an existing instance; you must copy the snapshot. Option B is correct and describes the proper procedure. Option C is incorrect because the default KMS key for the account does not affect existing instance snapshots. Option D is incorrect because you cannot modify an existing RDS instance to use a different encryption key directly; the encryption key is set at creation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create a new RDS instance with the customer-managed KMS key and migrate data using DMS.
Why it's wrong here
Creating a new RDS instance with a customer-managed KMS key and migrating data via DMS would encrypt the new instance and its snapshots under that key, but this approach introduces unnecessary operational overhead and does not address the specific requirement to change the encryption key on the *existing* snapshots of the already encrypted instance. It is tempting because DMS is the standard tool for migrating data between different database configurations, and in a scenario where the original instance could be decommissioned, this method would successfully achieve encryption under a customer-managed key.
- ✓
Take a snapshot of the RDS instance, copy the snapshot specifying the customer-managed KMS key, and restore from the copied snapshot.
Why this is correct
This is the only way to re-encrypt the database with a new KMS key.
- ✗
Change the default KMS key for the AWS account to the customer-managed key.
Why it's wrong here
You cannot change the default KMS key.
- ✗
Modify the RDS instance to use the customer-managed KMS key directly.
Why it's wrong here
You cannot change the KMS key of an encrypted RDS instance after creation.
Go deeper
Related to this question
About these practice questions
One of 1,663 original DBS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DBS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DBS-C01 exam.