DBS-C01 Database Security Practice Question
A company is migrating an on-premises Oracle database to Amazon RDS for Oracle. The database contains sensitive data that must be encrypted at rest. Which action should the company take to enable encryption on the RDS instance?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a new RDS DB instance with encryption enabled and migrate the data.
Amazon RDS for Oracle supports encryption at rest using AWS KMS. Encryption can only be enabled when the DB instance is created; you cannot encrypt an existing unencrypted RDS instance. Therefore, to enable encryption for an existing on-premises Oracle database being migrated, you must create a new RDS DB instance with encryption enabled at launch and then migrate the data into that new instance. This makes option B the correct choice. Option A is incorrect because you cannot modify an existing unencrypted RDS instance to add encryption. Option C is incorrect because while Oracle Transparent Data Encryption (TDE) can be used to encrypt data within the database, it is not the native Amazon RDS encryption method and requires additional configuration; moreover, the scenario assumes a new RDS instance is being created, not an existing one. Option D is incorrect because the source database is on-premises, not an RDS instance, so there is no RDS snapshot to take; even if there were an existing unencrypted RDS instance, encrypting a snapshot requires copying it with encryption enabled, not directly encrypting the snapshot. Thus D is not a valid action for this migration.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Modify the existing RDS DB instance and enable encryption.
Why it's wrong here
You cannot enable encryption on an existing unencrypted RDS instance.
- ✓
Create a new RDS DB instance with encryption enabled and migrate the data.
Why this is correct
Encryption can only be enabled at creation time.
- ✗
Enable Oracle Transparent Data Encryption (TDE) on the existing RDS instance.
Why it's wrong here
While TDE is supported on RDS Oracle, you need to use an option group and it can be enabled on existing instances, but the question asks for encryption at rest which is also achievable via KMS; however, TDE is an additional cost and the simplest answer is to create a new encrypted instance.
- ✗
Take a snapshot of the existing database, encrypt the snapshot, and restore from it.
Why it's wrong here
You cannot encrypt a snapshot of an unencrypted instance.
Go deeper
Related to this question
About these practice questions
One of 1,663 original DBS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DBS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DBS-C01 exam.