DBS-C01 Database Security Practice Question
A company needs to enforce that all new Amazon RDS DB instances are automatically encrypted at rest. What is the most efficient way to achieve this?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use an AWS Organizations service control policy (SCP) to deny creation of unencrypted RDS instances.
Using an AWS Organizations service control policy (SCP) to deny creation of unencrypted RDS instances is the most efficient way to enforce encryption at rest for all new RDS DB instances across multiple accounts. SCPs are applied at the organization, organizational unit, or account level and cannot be overridden by users, ensuring consistent enforcement. Option A is wrong because IAM policies with condition keys only affect specified users or roles, not service-linked roles or resources, and can be bypassed if users have permissions to modify policies. Option B is wrong because there is no 'encryption at rest' default setting in the RDS console; encryption must be enabled per instance or via other mechanisms. Option D is wrong because CloudFormation StackSets require manual creation and maintenance of templates, and do not enforce encryption if users launch instances outside the stack.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create an IAM policy that denies rds:CreateDBInstance unless encryption is enabled, and attach it to all users.
Why it's wrong here
IAM policies do not automatically apply to all accounts; they apply to users/roles.
- ✗
Enable the 'encryption at rest' default in each AWS account's RDS console.
Why it's wrong here
There is no global default setting; encryption must be specified per instance.
- ✓
Use an AWS Organizations service control policy (SCP) to deny creation of unencrypted RDS instances.
Why this is correct
SCPs can enforce encryption at the organizational level.
- ✗
Use AWS CloudFormation StackSets to deploy a template that creates encrypted instances in every account.
Why it's wrong here
This would not prevent creation of unencrypted instances outside the template.
Go deeper
Related to this question
About these practice questions
This DBS-C01 question is part of Courseiva's 1,663-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DBS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DBS-C01 exam.