DBS-C01 Encryption at Rest Practice Question
A company is using Amazon RDS for MySQL with automated backups enabled. The security team requires that all backups be encrypted at rest. Which configuration ensures that new automated backups are encrypted?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a new encrypted DB instance and migrate the data. Automated backups will inherit encryption.
Encryption at rest must be enabled at creation time on an RDS instance. When you enable encryption at rest on a new DB instance, all automated backups, snapshots, and replicas inherit that encryption automatically. Option B is incorrect because you cannot enable encryption at rest on an existing RDS instance after creation; you must create a new encrypted instance and migrate. Option C is incorrect because automated backups are stored in an S3 bucket managed by RDS, but you cannot directly encrypt the bucket or backups separately; encryption is tied to the DB instance. Option D is incorrect because it incorrectly suggests both enabling encryption on the instance and a separate DBSnapshot option; encryption on the instance already covers backups, and there is no separate DBSnapshot option for enabling encryption.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create a new encrypted DB instance and migrate the data. Automated backups will inherit encryption.
Why this is correct
Creating an encrypted instance ensures all backups (automated and manual) are encrypted.
- ✗
Modify the DB instance to enable encryption at rest after creation.
Why it's wrong here
Encryption at rest cannot be enabled on an existing RDS instance; you must restore a snapshot with encryption.
- ✗
Use AWS KMS to encrypt the S3 bucket where automated backups are stored.
Why it's wrong here
RDS automated backups are stored in an S3 bucket managed by AWS, not directly accessible for encryption configuration.
- ✗
Enable encryption at rest on the DB instance and also enable encryption on automated backups using the DBSnapshot option.
Why it's wrong here
Automated backups are encrypted automatically when the instance is encrypted; a separate DBSnapshot option is not needed.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every DBS-C01 question from scratch — 1,663 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DBS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DBS-C01 exam.