DBS-C01 Database Security Practice Question
A company's security team wants to encrypt data at rest for an existing RDS for PostgreSQL DB instance. The instance is currently unencrypted. Which steps should the team take to enable encryption with minimal downtime?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Take a snapshot of the DB instance, copy the snapshot with encryption enabled, and restore a new DB instance from the encrypted snapshot.
Amazon RDS does not support enabling encryption directly on an existing unencrypted DB instance. The only supported method is to take a snapshot of the instance, copy the snapshot with encryption enabled, and restore a new DB instance from the encrypted snapshot. Option A is incorrect because the RDS console does not allow enabling encryption on an existing instance. Option B is incorrect because a read replica of an unencrypted instance is also unencrypted; promoting it does not add encryption. Option C is incorrect because option groups control database engine configuration, not encryption at rest. Encryption at rest is a storage-level feature that can only be enabled during instance creation or via snapshot operations.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Modify the DB instance and enable encryption in the RDS console.
Why it's wrong here
Encryption cannot be enabled on an existing instance.
- ✗
Create a read replica of the DB instance and promote it to a standalone instance.
Why it's wrong here
Read replicas inherit encryption from the source; if source is unencrypted, replica is also unencrypted.
- ✗
Create a new option group with encryption enabled and associate it with the DB instance.
Why it's wrong here
Option groups do not control encryption.
- ✓
Take a snapshot of the DB instance, copy the snapshot with encryption enabled, and restore a new DB instance from the encrypted snapshot.
Why this is correct
This is the standard method to encrypt an existing unencrypted RDS instance.
Go deeper
Related to this question
About these practice questions
Courseiva writes every DBS-C01 question from scratch — 1,663 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DBS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DBS-C01 exam.