DBS-C01 Database Security Practice Question
A company has an Amazon Redshift cluster that contains sensitive data. The security team requires that data be encrypted at rest using a customer-managed AWS KMS key. The cluster was initially launched without encryption. How can the company enable encryption with minimal downtime?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Take a snapshot of the cluster and restore it to a new cluster with encryption enabled.
To enable encryption on an existing unencrypted Redshift cluster with minimal downtime, the recommended approach is to take a snapshot of the cluster and restore it to a new cluster with encryption enabled. This allows the original cluster to remain operational while the encrypted cluster is being created, minimizing downtime. Once the new cluster is ready, traffic can be redirected. Option A (unload to S3, create new encrypted cluster, reload) also achieves encryption but requires significant downtime for data transfer. Option B is incorrect because there is no direct CLI command to enable encryption on an existing cluster; a new cluster must be created. Option D is incorrect because the AWS Management Console does not allow enabling encryption on an existing cluster.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Unload the data to Amazon S3, create a new encrypted cluster, and reload the data from S3.
Why it's wrong here
This method works but involves unloading data to S3 and reloading, which incurs substantial downtime for large datasets. It is not the most efficient option.
- ✗
Use the AWS CLI to update the cluster encryption setting.
Why it's wrong here
There is no AWS CLI command to enable encryption on an existing cluster; encryption must be enabled at cluster creation time.
- ✓
Take a snapshot of the cluster and restore it to a new cluster with encryption enabled.
Why this is correct
Taking a snapshot and restoring it to a new cluster with encryption enabled is the correct method with minimal downtime. The original cluster remains available during the process.
- ✗
Modify the cluster and enable encryption using the AWS Management Console.
Why it's wrong here
The AWS Management Console does not provide an option to enable encryption on an existing cluster; a new cluster must be created.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every DBS-C01 question from scratch — 1,663 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DBS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DBS-C01 exam.