DBS-C01 Database Security Practice Question
A company wants to ensure that an Amazon RDS for MySQL DB instance is encrypted at rest. Which action should be taken to enable encryption for the first time?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a new encrypted DB instance using AWS KMS.
Encryption at rest for Amazon RDS can only be enabled when creating a new DB instance. To enable encryption for the first time, you must create a new encrypted DB instance using AWS KMS. Option A is incorrect because encryption cannot be enabled on an existing DB instance via the AWS CLI; it requires creating a new instance. Option C is incorrect because there is no rds.encrypted parameter in a DB parameter group; encryption is set at instance creation, not via parameters. Option D is incorrect because modifying an existing DB instance does not allow enabling encryption; you must create a new encrypted instance.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable encryption on the existing DB instance using the AWS CLI.
Why it's wrong here
This is incorrect because encryption at rest cannot be enabled on an existing RDS instance. It must be enabled at creation time.
- ✓
Create a new encrypted DB instance using AWS KMS.
Why this is correct
This is correct. Encryption at rest for RDS must be enabled when the DB instance is created, using an AWS KMS key.
- ✗
Set the rds.encrypted parameter to true in the DB parameter group.
Why it's wrong here
This is incorrect. The rds.encrypted parameter does not exist in a DB parameter group. Encryption is configured at instance creation, not through parameter groups.
- ✗
Modify the existing DB instance and enable encryption.
Why it's wrong here
This is incorrect. You cannot modify an existing DB instance to enable encryption. You must create a new encrypted instance or restore an encrypted snapshot.
Go deeper
Related to this question
About these practice questions
Courseiva writes every DBS-C01 question from scratch — 1,663 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DBS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DBS-C01 exam.