Encrypt an Existing Unencrypted RDS Instance via Snapshot Copy
A company needs to encrypt an existing unencrypted Amazon RDS for Oracle DB instance. Which set of steps should be followed?
Quick Answer
The correct answer is to take a snapshot of the instance, copy the snapshot with encryption enabled, and restore from the encrypted snapshot. This works because encryption in Amazon RDS is a property of the underlying storage, not the instance itself, so you cannot enable it directly on a running database; instead, you must create an encrypted copy of the snapshot, which applies AWS KMS encryption to the data at rest, and then restore a new encrypted instance from that copy. On the AWS Certified Database Specialty DBS-C01 exam, this question tests your understanding that encryption is immutable for existing instances—a common trap is trying to modify the instance or add a KMS key directly, both of which are invalid operations. Remember the key sequence: snapshot, encrypt copy, restore—never modify in place. A useful memory tip is "SEC" (Snapshot, Encrypt copy, Create instance).
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Take a snapshot of the instance, copy the snapshot with encryption enabled, and restore from the encrypted snapshot.
The correct procedure. To encrypt an existing unencrypted RDS DB instance, you must create a manual snapshot of the instance, then copy that snapshot with encryption enabled (specifying a KMS key), and finally restore a new DB instance from the encrypted snapshot. Option A is wrong because the console does not provide a direct 'Enable Encryption' action on an existing instance. Option B is wrong because you cannot modify an existing unencrypted instance to enable encryption directly; there is no such modification parameter. Option C is wrong because while it mentions copying the snapshot to an encrypted one, it does not clarify that encryption is applied during the copy operation, and the correct process explicitly requires taking the initial snapshot, copying with encryption, and then restoring; Option D includes all three steps.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable encryption using the AWS Management Console by selecting the instance and choosing 'Enable Encryption'.
Why it's wrong here
No such option in console for existing instances.
- ✗
Modify the DB instance and set the KMS key ID to enable encryption.
Why it's wrong here
Modifying does not enable encryption.
- ✗
Copy the snapshot to an encrypted snapshot and then restore.
Why it's wrong here
You must enable encryption during the copy step.
- ✓
Take a snapshot of the instance, copy the snapshot with encryption enabled, and restore from the encrypted snapshot.
Why this is correct
This is the standard method.
Go deeper
Related to this question
About these practice questions
Courseiva writes every DBS-C01 question from scratch — 1,663 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
3 more ways this is tested on DBS-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company wants to encrypt an existing unencrypted Amazon RDS for PostgreSQL DB instance. What is the correct procedure?
easy- ✓ A.Take a snapshot of the instance, create an encrypted copy of the snapshot, and restore the encrypted snapshot to a new DB instance.
- B.Take a snapshot of the instance and restore it with encryption enabled.
- C.Modify the DB instance and enable encryption in the RDS console.
- D.Create a read replica of the instance and enable encryption on the replica.
Why A: Encryption for an existing unencrypted Amazon RDS for PostgreSQL DB instance cannot be enabled directly. The correct procedure is to take a snapshot of the instance, create an encrypted copy of that snapshot, and then restore the encrypted snapshot to a new DB instance. Option A accurately describes this process. Option B is incorrect because restoring a snapshot does not allow enabling encryption during the restore; encryption must be applied at the time of snapshot copy. Option C is incorrect because you cannot modify a running DB instance to enable encryption. Option D is incorrect because creating a read replica does not encrypt the primary instance; encryption must be set up before replica creation.
Variation 2. A company wants to ensure that an Amazon RDS for MySQL DB instance is encrypted at rest. Which action should be taken to enable encryption for the first time?
easy- A.Enable encryption on the existing DB instance using the AWS CLI.
- ✓ B.Create a new encrypted DB instance using AWS KMS.
- C.Set the rds.encrypted parameter to true in the DB parameter group.
- D.Modify the existing DB instance and enable encryption.
Why B: Encryption at rest for Amazon RDS can only be enabled when creating a new DB instance. To enable encryption for the first time, you must create a new encrypted DB instance using AWS KMS. Option A is incorrect because encryption cannot be enabled on an existing DB instance via the AWS CLI; it requires creating a new instance. Option C is incorrect because there is no rds.encrypted parameter in a DB parameter group; encryption is set at instance creation, not via parameters. Option D is incorrect because modifying an existing DB instance does not allow enabling encryption; you must create a new encrypted instance.
Variation 3. A company has an Amazon RDS for Oracle DB instance that needs to be encrypted at rest. The instance currently uses Oracle Transparent Data Encryption (TDE) with a key stored in the database. The company wants to use AWS KMS for key management. What is the correct migration path?
hard- ✓ A.Take a snapshot of the DB instance, copy the snapshot with KMS encryption, and restore from the encrypted snapshot.
- B.Enable KMS encryption directly on the existing DB instance using the AWS CLI.
- C.Create a read replica with KMS encryption.
- D.Modify the DB instance and select the KMS key.
Why A: To change the encryption key from Oracle TDE to AWS KMS, you must take a snapshot of the DB instance, copy the snapshot with KMS encryption, and restore from the encrypted snapshot. This process enables encryption at rest with KMS. Option B is incorrect because you cannot directly enable KMS encryption on an existing TDE instance; this is not supported. Option C is incorrect because creating a read replica does not allow changing the encryption key; read replicas inherit the source instance's encryption. Option D is incorrect because you cannot modify the encryption key in place on an existing instance.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DBS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DBS-C01 exam.