DBS-C01 Database Security Practice Question
A company has an Amazon Redshift cluster that stores sensitive financial data. The security team requires that all data be encrypted at rest and that the encryption keys be rotated annually. Which solution meets these requirements?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a new encrypted cluster with a KMS key and configure automatic key rotation.
The security requirements are to have encryption at rest and automatic annual key rotation. Amazon Redshift clusters can only be encrypted at creation time; you cannot enable encryption on an existing unencrypted cluster. Therefore, the only way to meet the requirements is to create a new encrypted cluster using a KMS key with automatic rotation enabled. The existing cluster must be replaced by restoring from an encrypted snapshot or by creating a new cluster and migrating data. Option D precisely describes this solution: 'Create a new encrypted cluster with a KMS key and configure automatic key rotation.' Automatic rotation can be enabled on the KMS key, and Redshift will use the new key material automatically for re-encryption. Option A is ambiguous: 'Use AWS KMS with automatic key rotation to encrypt the Redshift cluster' – this could be interpreted as enabling encryption on an existing cluster, which is not possible. Option D clearly states the correct procedure. Hence D is the best answer. Option B is wrong because CloudHSM-backed encryption does not support automatic key rotation; rotation must be done manually. Option C is wrong because encryption cannot be enabled on an existing cluster; a new encrypted cluster must be created.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use AWS KMS with automatic key rotation to encrypt the Redshift cluster.
Why it's wrong here
This option is ambiguous because it does not specify creating a new cluster. Encryption cannot be enabled on an existing unencrypted Redshift cluster; you must create a new encrypted cluster. Option D is the correct and explicit solution.
- ✗
Create the cluster with AWS CloudHSM-backed encryption and rotate the key annually.
Why it's wrong here
CloudHSM-backed encryption requires manual key rotation, not automatic annual rotation as required.
- ✗
Enable encryption on the existing cluster by modifying the cluster settings.
Why it's wrong here
Enabling encryption on an existing cluster is not supported; you need to create a new encrypted cluster or restore from an encrypted snapshot.
- ✓
Create a new encrypted cluster with a KMS key and configure automatic key rotation.
Why this is correct
Correct. You create a new encrypted cluster using a KMS key with automatic key rotation. This ensures encryption at rest and automatic annual rotation.
Go deeper
Related to this question
About these practice questions
This DBS-C01 question is part of Courseiva's 1,663-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DBS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DBS-C01 exam.