DBS-C01 Database Security Practice Question
A company is storing sensitive customer data in an Amazon RDS for MySQL DB instance. They need to ensure that data is encrypted at rest. What is the simplest way to achieve this?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Launch a new encrypted DB instance and migrate the data.
Amazon RDS for MySQL does not allow enabling encryption at rest on an existing unencrypted DB instance. The simplest way to achieve encryption at rest is to launch a new encrypted DB instance and migrate the data. Option A is incorrect because encryption cannot be enabled on an existing DB instance via modification; it requires creating a new instance. Option B is incorrect because RDS for MySQL does not support Transparent Data Encryption (TDE). Option D is incorrect because client-side encryption with AWS KMS is more complex and not the simplest approach.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable encryption on the existing DB instance by modifying the DB instance settings.
Why it's wrong here
Modifying an existing unencrypted DB instance to enable encryption is not supported directly; you must create a new encrypted instance from a snapshot.
- ✗
Enable Transparent Data Encryption (TDE) on the MySQL instance.
Why it's wrong here
RDS for MySQL does not support TDE; encryption at rest is handled by RDS using EBS volume encryption.
- ✓
Launch a new encrypted DB instance and migrate the data.
Why this is correct
Launching a new RDS instance with encryption enabled is the simplest method, as encryption is specified at launch time.
- ✗
Use client-side encryption with AWS KMS to encrypt data before inserting into the database.
Why it's wrong here
Client-side encryption adds application complexity and is not the simplest approach.
Go deeper
Related to this question
About these practice questions
Courseiva writes every DBS-C01 question from scratch — 1,663 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DBS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DBS-C01 exam.