DBS-C01 Database Security Practice Question
A company wants to ensure that an Amazon RDS for MySQL database is automatically backed up daily and backups are encrypted. What should they do?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable automated backups and encryption at rest on the RDS instance.
Automated backups with encryption at rest ensure that backups are automatically taken daily and encrypted. Option C is correct because it enables both features: automated backups and encryption at rest. Option A is incorrect because manual snapshots are not automatic; they require manual intervention and enabling encryption on the snapshot copy is an extra step. Option B is incorrect because using CloudWatch Events and Lambda to export to S3 is not the standard automated backup mechanism for RDS; RDS automated backups are handled natively and do not require custom Lambda functions. Option D is incorrect because AWS Backup is not the default automated backup service for RDS; RDS has its own automated backup feature. Additionally, encryption for RDS backups is managed by AWS KMS, not S3 default encryption.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Take manual snapshots daily and enable encryption on the snapshot copy.
Why it's wrong here
Manual process, not automatic.
- ✗
Use Amazon CloudWatch Events to trigger a Lambda function that exports the database to S3 with encryption.
Why it's wrong here
Overly complex and not the standard approach.
- ✓
Enable automated backups and encryption at rest on the RDS instance.
Why this is correct
Automated backups are encrypted if encryption at rest is enabled.
- ✗
Configure AWS Backup to back up the RDS instance to an S3 bucket with default encryption.
Why it's wrong here
AWS Backup can be used, but encryption of RDS backups is tied to the instance encryption.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 1,663 original DBS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DBS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DBS-C01 exam.