Courseiva
← DBS-C01
Full test
Database Security →easyMultiple ChoiceObjective-mapped

DBS-C01 Database Security Practice Question

A company wants to encrypt data at rest for an existing Amazon RDS for MySQL DB instance. The database is currently unencrypted. What is the most efficient way to enable encryption?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Create a snapshot of the DB instance, copy the snapshot with encryption enabled, and restore the DB instance from the encrypted snapshot.

RDS does not support enabling encryption on an existing unencrypted DB instance directly. You must create a snapshot, copy it with encryption enabled, and restore from that encrypted snapshot. Option A is incorrect because you cannot modify the DB instance to enable encryption. Option C is incorrect because AWS KMS does not automatically encrypt the DB instance. Option D is incorrect because you cannot directly configure encryption on the existing instance.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • ✗

    Enable encryption on the existing DB instance by modifying the parameter group.

    Why it's wrong here

    Parameter groups do not control encryption at rest for RDS.

  • ✓

    Create a snapshot of the DB instance, copy the snapshot with encryption enabled, and restore the DB instance from the encrypted snapshot.

    Why this is correct

    This is the standard procedure to encrypt an unencrypted RDS instance.

  • ✗

    Use AWS KMS to automatically encrypt the DB instance.

    Why it's wrong here

    AWS KMS does not automatically encrypt RDS instances.

  • ✗

    Modify the DB instance and enable encryption from the RDS console.

    Why it's wrong here

    RDS does not allow modifying an existing unencrypted instance to enable encryption.

About these practice questions

One of 1,663 original DBS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

Same concept, more angles

2 more ways this is tested on DBS-C01

These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.

Variation 1. A company wants to encrypt data at rest for an existing Amazon RDS for Oracle DB instance. The database is currently unencrypted. What is the simplest way to enable encryption with minimal downtime?

easy
  • A.Create an encrypted read replica and promote it to a standalone instance.
  • B.Modify the DB instance and enable encryption using the RDS console.
  • ✓ C.Create a snapshot of the DB instance, copy the snapshot with encryption enabled, and restore the encrypted snapshot to a new DB instance.
  • D.Enable encryption directly on the existing DB instance by modifying the DB instance settings.

Why C: You cannot directly enable encryption on an existing unencrypted Amazon RDS instance. The correct process is to create a snapshot of the DB instance, copy the snapshot with encryption enabled, and then restore the encrypted snapshot to a new DB instance. You then redirect traffic to the new instance. Option A is incorrect because creating a read replica does not encrypt the master instance, and the replica can only be encrypted if the master is already encrypted. Option B is incorrect because you cannot modify an existing DB instance to enable encryption through the RDS console. Option D is incorrect because enabling encryption directly on the existing DB instance is not supported.

Variation 2. A company is using Amazon RDS for MySQL and needs to encrypt data at rest for an existing DB instance. Which approach meets this requirement with minimal downtime?

medium
  • ✓ A.Take a snapshot of the DB instance, copy the snapshot with encryption enabled, and restore from the encrypted snapshot.
  • B.Enable encryption directly on the existing DB instance by modifying it.
  • C.Use the AWS CLI command modify-db-instance with the --storage-encrypted flag.
  • D.Create a read replica of the DB instance with encryption enabled, then promote it.

Why A: To encrypt an existing unencrypted RDS MySQL DB instance, you cannot directly modify the instance. The standard approach is to take a snapshot, create an encrypted copy of the snapshot, and then restore that encrypted snapshot to a new DB instance. This method typically involves minimal downtime compared to other options. Option A correctly describes this process. Option B is incorrect because encryption cannot be enabled directly on an existing instance. Option C is incorrect because the AWS CLI modify-db-instance command does not support enabling encryption on an existing instance; the --storage-encrypted flag only applies to new instances. Option D is incorrect because creating a read replica with encryption does not encrypt the primary instance; you would still need to perform a snapshot restore for the primary's encryption.

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This DBS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DBS-C01 exam.