DBS-C01 Database Security Practice Question
A company wants to encrypt data at rest for an existing Amazon RDS for Oracle DB instance. The database is currently unencrypted. What is the simplest way to enable encryption with minimal downtime?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a snapshot of the DB instance, copy the snapshot with encryption enabled, and restore the encrypted snapshot to a new DB instance.
You cannot directly enable encryption on an existing unencrypted Amazon RDS instance. The correct process is to create a snapshot of the DB instance, copy the snapshot with encryption enabled, and then restore the encrypted snapshot to a new DB instance. You then redirect traffic to the new instance. Option A is incorrect because creating a read replica does not encrypt the master instance, and the replica can only be encrypted if the master is already encrypted. Option B is incorrect because you cannot modify an existing DB instance to enable encryption through the RDS console. Option D is incorrect because enabling encryption directly on the existing DB instance is not supported.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create an encrypted read replica and promote it to a standalone instance.
Why it's wrong here
A read replica inherits the encryption setting of the master; if the master is unencrypted, the replica cannot be encrypted.
- ✗
Modify the DB instance and enable encryption using the RDS console.
Why it's wrong here
Modifying an existing Amazon RDS for Oracle DB instance directly to enable encryption is not supported. Encryption can only be configured during the initial creation of an RDS instance. Attempting to modify an unencrypted instance to enable encryption will fail. This option is tempting because "modify" suggests changing settings, and it *is* the correct method for modifying encryption keys or other settings on an *already encrypted* instance, or for enabling encryption on a *new* instance during its creation.
- ✓
Create a snapshot of the DB instance, copy the snapshot with encryption enabled, and restore the encrypted snapshot to a new DB instance.
Why this is correct
Creating an unencrypted snapshot, copying it with encryption enabled, and restoring to a new DB instance satisfies the requirement for minimal downtime because the original RDS for Oracle instance remains fully available during the snapshot and copy operations; only a brief DNS cutover occurs when the application is redirected to the new encrypted instance. This avoids the constraint that RDS does not support enabling encryption in-place on an existing unencrypted DB instance.
- ✗
Enable encryption directly on the existing DB instance by modifying the DB instance settings.
Why it's wrong here
Encryption cannot be enabled directly on an existing instance; a snapshot restore is required.
Go deeper
Related to this question
About these practice questions
One of 1,663 original DBS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DBS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DBS-C01 exam.