DBS-C01 Database Security Practice Question
A company is using Amazon RDS for Oracle with Transparent Data Encryption (TDE) enabled. They need to rotate the TDE master key. What is the correct procedure?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use the AWS KMS RotateKey operation to rotate the customer master key (CMK) that is used for TDE.
In Amazon RDS for Oracle with TDE, the master key is stored in AWS KMS. To rotate the TDE master key, you can call the AWS KMS RotateKey operation on the customer master key (CMK) used for TDE, or use the Amazon RDS procedure rds.rds_rotate_tde_key. Option B is correct. Option A is incorrect because Oracle's ALTER SYSTEM SET ENCRYPTION KEY command rotates the Oracle-internal master key, not the KMS CMK, and RDS does not support direct Oracle TDE key rotation. Option C is incorrect because full migration is unnecessary. Option D is incorrect because modifying the DB instance to use a new KMS key changes the key, but does not rotate the existing TDE key.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use Oracle's ALTER SYSTEM SET ENCRYPTION KEY command to rotate the key.
Why it's wrong here
Direct Oracle commands may not be supported in RDS.
- ✓
Use the AWS KMS RotateKey operation to rotate the customer master key (CMK) that is used for TDE.
Why this is correct
KMS key rotation is the supported method for TDE key rotation.
- ✗
Create a new encrypted RDS instance and migrate the data.
Why it's wrong here
Overly complex; key rotation can be done without migration.
- ✗
Modify the DB instance to use a new KMS key.
Why it's wrong here
Modifying the DB instance does not rotate the TDE key.
Go deeper
Related to this question
About these practice questions
Courseiva writes every DBS-C01 question from scratch — 1,663 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DBS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DBS-C01 exam.