DBS-C01 Database Security Practice Question
A company is designing a security strategy for an Amazon RDS for MySQL instance that stores Personally Identifiable Information (PII). Which TWO measures should be implemented to protect the data at rest?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable automatic backups with encryption.
Options A and D are correct. Option A: Enabling automatic backups with encryption ensures that backup data is encrypted at rest. Option D: Enabling encryption at rest using AWS KMS encrypts the underlying storage of the DB instance. Option B is wrong because Amazon GuardDuty is a threat detection service, not for data at rest protection. Option C is wrong because deletion protection prevents accidental deletion but does not protect data at rest. Option E is wrong because encryption in transit (SSL/TLS) protects data in motion, not at rest.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Enable automatic backups with encryption.
Why this is correct
Automatic backups with encryption ensure that backup data is encrypted at rest, providing protection for stored backups.
- ✗
Enable Amazon GuardDuty to monitor for suspicious activity.
Why it's wrong here
Amazon GuardDuty is a threat detection service that monitors for malicious activity; it does not protect data at rest.
- ✗
Enable deletion protection on the DB instance.
Why it's wrong here
Deletion protection prevents accidental deletion of the DB instance but does not encrypt or protect the data at rest.
- ✓
Enable encryption at rest using AWS KMS.
Why this is correct
Encryption at rest using AWS KMS encrypts the underlying storage, snapshots, and automated backups, protecting data at rest.
- ✗
Enable encryption in transit using SSL/TLS.
Why it's wrong here
Encryption in transit using SSL/TLS protects data as it travels between clients and the database, not data at rest.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This DBS-C01 question is part of Courseiva's 1,663-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DBS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DBS-C01 exam.