DBS-C01 Database Security Practice Question
A company is migrating its Oracle database to Amazon RDS for Oracle. The security team requires that all data be encrypted at rest using a customer-managed AWS KMS key. Which TWO steps are necessary to achieve this?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Migrate the data using Oracle Data Pump to the new encrypted instance.
To enable encryption at rest with a customer-managed KMS key in Amazon RDS for Oracle, you must create a new DB instance and specify the KMS key for encryption (Option C). Encryption cannot be enabled on an existing RDS instance without migrating to a new encrypted instance (Options B and D are incorrect). After creating the encrypted instance, you can migrate the Oracle database using Oracle Data Pump to the new encrypted instance (Option A). Using the default RDS encryption key (Option E) does not meet the requirement of a customer-managed key. Therefore, the two necessary steps are A and C.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Migrate the data using Oracle Data Pump to the new encrypted instance.
Why this is correct
Data must be migrated to the new encrypted instance.
- ✗
Modify the DB instance to enable encryption using a KMS key.
Why it's wrong here
Encryption cannot be added to an existing instance.
- ✓
Create a new DB instance and specify the KMS key for encryption.
Why this is correct
Encryption is enabled at launch with a customer-managed KMS key.
- ✗
Enable encryption at rest on the existing RDS instance by modifying the DB instance.
Why it's wrong here
Encryption cannot be enabled on an existing instance; must be done at creation.
- ✗
Use the default RDS encryption key (aws/rds) to encrypt the instance.
Why it's wrong here
Default key is AWS managed, not customer managed.
Go deeper
Related to this question
About these practice questions
This DBS-C01 question is part of Courseiva's 1,663-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DBS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DBS-C01 exam.