DBS-C01 Deployment and Migration Practice Question
A company is deploying a new Amazon RDS for PostgreSQL DB instance. Which THREE actions are recommended for a secure deployment?
⚠ Common exam trap
It's easy for candidates to confuse 'default VPC' with being secure because it is provided by AWS, but the default VPC includes a public subnet with an internet gateway, which is inherently less secure for database deployments than using a custom VPC with private subnets.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable encryption at rest using AWS KMS
Enabling encryption at rest using AWS KMS ensures that the underlying storage for the RDS for PostgreSQL DB instance is encrypted using AES-256 encryption. This protects data at rest against unauthorized physical access to the storage media and is a fundamental security best practice. KMS integration also allows for centralized key management and audit trails via AWS CloudTrail.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Enable encryption at rest using AWS KMS
Why this is correct
Encryption at rest protects data if storage is compromised.
- ✗
Use the default VPC for simplicity
Why it's wrong here
Default VPC may have overly permissive rules; a custom VPC is recommended.
- ✗
Delete automated backups after the initial snapshot to reduce costs
Why it's wrong here
Automated backups are needed for point-in-time recovery.
- ✓
Enable automated backups with a retention period
Why this is correct
Automated backups enable recovery from failures.
- ✓
Place the DB instance in a private subnet
Why this is correct
Private subnets prevent direct internet access.
Quick reference
Symmetric Encryption Algorithm Comparison
| Algorithm | Key Size | Block Size | Status | Notes |
|---|---|---|---|---|
| AES-128 | 128-bit | 128-bit | Current standard | NIST approved; WPA3, TLS |
| AES-256 | 256-bit | 128-bit | Current standard | Preferred for sensitive / govt data |
| 3DES | 112-bit effective | 64-bit | Deprecated (2023) | Replaced by AES |
| DES | 56-bit | 64-bit | Broken | Cracked in < 24 h; never deploy |
| ChaCha20 | 256-bit | Stream cipher | Current | TLS 1.3, WireGuard |
Go deeper
Related to this question
About these practice questions
One of 1,663 original DBS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DBS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DBS-C01 exam.