DBS-C01 Database Security Practice Question
A company is migrating its on-premises Oracle database to Amazon RDS for Oracle. As part of the migration, they need to ensure that all sensitive data is encrypted at rest using AWS Key Management Service (AWS KMS). Which configuration step is required to achieve this?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a new encrypted DB instance by enabling encryption and specifying a KMS key.
To encrypt an Amazon RDS for Oracle DB instance at rest using AWS KMS, you must enable encryption when creating the DB instance and specify a KMS key. Encryption cannot be added to an existing unencrypted DB instance directly; you must take a snapshot, create an encrypted copy, and restore it. Option A is incorrect because modifying an existing instance does not allow enabling encryption. Option B is incorrect because SSL/TLS encrypts data in transit, not at rest. Option C is incorrect because while CloudHSM can be used, AWS KMS is the simpler and more common approach, and the question specifically mentions AWS KMS.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Modify the existing DB instance to enable encryption.
Why it's wrong here
Enabling encryption on an existing unencrypted RDS instance is not supported directly; you must create a new encrypted instance or restore from a snapshot.
- ✗
Configure SSL/TLS on the DB instance to encrypt data at rest.
Why it's wrong here
SSL/TLS encrypts data in transit, not at rest.
- ✗
Use AWS CloudHSM to generate and store the encryption keys.
Why it's wrong here
AWS CloudHSM is not required for RDS encryption; AWS KMS can be used.
- ✓
Create a new encrypted DB instance by enabling encryption and specifying a KMS key.
Why this is correct
Creating a new encrypted RDS instance with a KMS key is the correct way to enable encryption at rest.
Go deeper
Related to this question
About these practice questions
This DBS-C01 question is part of Courseiva's 1,663-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DBS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DBS-C01 exam.