DBS-C01 Database Security Practice Question
A company uses Amazon RDS for SQL Server with Multi-AZ deployment. The security team wants to ensure that all data at rest is encrypted using a customer-managed KMS key in both the primary and standby instances. Which THREE actions are required?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Specify a customer-managed KMS key during creation.
Options B, D, and E are correct. To encrypt data at rest with a customer-managed KMS key, you must specify the KMS key during DB instance creation (B). Multi-AZ with encryption enabled (D) ensures both primary and standby instances are encrypted. Encryption at rest must be enabled when creating the DB instance (E); it cannot be added later. Option A is wrong because a separate KMS key is not required—the same key encrypts both instances. Option C is wrong because Transparent Data Encryption (TDE) is a SQL Server feature for encrypting the database files, but RDS handles encryption at the storage layer using KMS, not TDE. TDE is not applicable when using RDS encryption with KMS.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create a separate KMS key for the standby instance.
Why it's wrong here
The same KMS key encrypts both primary and standby.
- ✓
Specify a customer-managed KMS key during creation.
Why this is correct
Customer-managed key is required.
- ✗
Enable Transparent Data Encryption (TDE) on the instance.
Why it's wrong here
TDE is not needed; RDS encryption covers storage.
- ✓
Enable Multi-AZ with encryption enabled.
Why this is correct
Multi-AZ with encryption ensures standby is encrypted.
- ✓
Enable encryption at rest when creating the DB instance.
Why this is correct
Encryption must be enabled at creation.
Go deeper
Related to this question
About these practice questions
Courseiva writes every DBS-C01 question from scratch — 1,663 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DBS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DBS-C01 exam.