DBS-C01 Database Security Practice Question
A company has a multi-account AWS environment using AWS Organizations. The security team wants to centrally manage database encryption keys for all Amazon RDS instances across accounts. They require that the keys be stored in a single account, and that each account can use the key to encrypt its RDS instances. Additionally, they want to automatically rotate the keys every year. Which solution should they implement?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a customer managed KMS key in the central account and grant the RDS service in each account permission to use the key.
AWS KMS allows you to create a customer managed key in a central account and grant cross-account access to the RDS service principal in each account. This enables each account to use the central key for RDS encryption while keeping the key stored centrally. Option A is incorrect because KMS key replication is for multi-Region, not cross-account. Option B is incorrect because CloudHSM is not integrated with RDS for encryption. Option C is incorrect because multi-Region keys are for cross-Region use, not cross-account; they do not solve the cross-account requirement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Copy the KMS key from the central account to each account using the KMS key replication feature.
Why it's wrong here
KMS keys cannot be copied across accounts.
- ✗
Use AWS CloudHSM to create a key and share the HSM partition with each account.
Why it's wrong here
RDS does not support CloudHSM for encryption.
- ✗
Create a multi-Region customer managed KMS key in the central account and replicate it to each account.
Why it's wrong here
Multi-Region keys are for cross-Region, not cross-account.
- ✓
Create a customer managed KMS key in the central account and grant the RDS service in each account permission to use the key.
Why this is correct
KMS supports cross-account key usage for RDS encryption.
Go deeper
Related to this question
About these practice questions
One of 1,663 original DBS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DBS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DBS-C01 exam.