DBS-C01 Database Security Practice Question
A company is migrating its on-premises Oracle database to Amazon RDS for Oracle. The security team requires that all data at rest be encrypted using a customer-managed key stored in AWS KMS, and that the key be rotated automatically every year. The company also needs to ensure that only specific IAM roles can access the key. Which combination of steps should the database administrator take to meet these requirements?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create the RDS instance with encryption enabled using a customer-managed KMS key, and configure the key policy to restrict access to the required IAM roles.
It enables encryption on the RDS instance with a customer-managed KMS key, which allows automatic yearly key rotation (configurable in KMS) and access control via KMS key policies to restrict usage to specific IAM roles. Option A is wrong because RDS does not support enabling encryption after creation; it must be enabled at launch. Option B is wrong because the default AWS managed service key does not allow customer-managed rotation or custom key policies. Option C is wrong because CloudHSM is not required; KMS customer-managed keys satisfy the requirements without CloudHSM.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create the RDS instance without encryption, then use the AWS Console to enable encryption after creation using a customer-managed key.
Why it's wrong here
RDS does not support enabling encryption on an existing unencrypted instance.
- ✗
Create the RDS instance with encryption using the default AWS managed service key, and set up automatic key rotation in KMS.
Why it's wrong here
Default service key cannot have custom rotation or IAM role restrictions.
- ✗
Use AWS CloudHSM to generate and store the encryption key, and configure RDS to use the CloudHSM key for encryption.
Why it's wrong here
RDS does not support CloudHSM for encryption; it uses KMS.
- ✓
Create the RDS instance with encryption enabled using a customer-managed KMS key, and configure the key policy to restrict access to the required IAM roles.
Why this is correct
This meets encryption, key rotation, and access control requirements.
Go deeper
Related to this question
About these practice questions
Courseiva writes every DBS-C01 question from scratch — 1,663 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DBS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DBS-C01 exam.