DBS-C01 Deployment and Migration Practice Question
A company is migrating a 1 TB Microsoft SQL Server database from on-premises to Amazon RDS for SQL Server. The on-premises database uses TDE for encryption. The company must ensure that the migrated database in RDS also uses TDE. Which solution meets this requirement?
⚠ Common exam trap
Many candidates assume native backup/restore (Option B) is the simplest approach for TDE databases, but they overlook that RDS does not support restoring TDE-encrypted backups because the required certificates cannot be imported, making DMS the only viable migration path for preserving encryption at rest.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use AWS DMS with ongoing replication to an RDS instance that has TDE enabled.
AWS DMS can migrate data from an on-premises SQL Server database with TDE enabled to an Amazon RDS for SQL Server instance that has TDE enabled. DMS reads the decrypted data from the source (since TDE is transparent to applications) and writes it to the target, which can then encrypt the data at rest using RDS's built-in TDE support. This approach avoids the need to transfer TDE certificates or perform a native backup/restore, which are not supported for TDE-enabled databases in RDS.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Export the on-premises database with TDE certificates and import them into RDS.
Why it's wrong here
RDS does not allow importing custom TDE certificates; it manages its own.
- ✗
Take a native backup of the on-premises database with TDE, upload to S3, and restore to RDS.
Why it's wrong here
RDS does not support restoring native backups with TDE from on-premises.
- ✗
Use AWS SCT to convert the database to Amazon Aurora and enable encryption.
Why it's wrong here
Aurora does not support TDE in the same way; it uses AWS KMS encryption.
- ✓
Use AWS DMS with ongoing replication to an RDS instance that has TDE enabled.
Why this is correct
DMS can migrate data to an RDS instance with TDE enabled, and the data will be encrypted at rest.
Go deeper
Related to this question
About these practice questions
Courseiva writes every DBS-C01 question from scratch — 1,663 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DBS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DBS-C01 exam.