DBS-C01 Encryption at rest Practice Question
A company is using Amazon RDS for Oracle and needs to comply with regulatory requirements that mandate encryption of all data at rest and in transit. Which TWO actions should be taken to meet these requirements?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable encryption at rest by specifying a KMS key when creating the DB instance.
Options A and E are correct. Option A enables encryption at rest by specifying a KMS key when creating the DB instance. Option E enables encryption in transit by setting the rds.force_ssl parameter and using the RDS SSL certificate. Option B is incorrect because Oracle TDE is not required when RDS encryption at rest is used; RDS native encryption with KMS is sufficient. Option C is incorrect because CloudWatch Logs encryption does not encrypt the database data. Option D is incorrect because Oracle Native Network Encryption is less secure than SSL/TLS and is not the recommended method for encryption in transit.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Enable encryption at rest by specifying a KMS key when creating the DB instance.
Why this is correct
Encryption at rest is enabled by specifying a KMS key when creating the DB instance. This meets the encryption at rest requirement.
- ✗
Use Oracle Transparent Data Encryption (TDE) to encrypt the data at rest.
Why it's wrong here
Oracle Transparent Data Encryption (TDE) is an additional feature but not required because RDS already provides encryption at rest via KMS. Using TDE would be redundant and incur extra cost.
- ✗
Enable encryption for CloudWatch Logs.
Why it's wrong here
Encrypting CloudWatch Logs only protects log data, not the database data itself. It does not meet the requirement to encrypt database data at rest or in transit.
- ✗
Configure Oracle Native Network Encryption in the sqlnet.ora file.
Why it's wrong here
Oracle Native Network Encryption can provide encryption in transit, but it is not the recommended method. SSL/TLS with RDS force_ssl is the preferred and more secure approach.
- ✓
Enable SSL/TLS encryption by setting the rds.force_ssl parameter and using the RDS SSL certificate.
Why this is correct
Setting rds.force_ssl and using the RDS SSL certificate enforces SSL/TLS encryption for data in transit. This meets the encryption in transit requirement.
Go deeper
Related to this question
About these practice questions
This DBS-C01 question is part of Courseiva's 1,663-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DBS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DBS-C01 exam.