DBS-C01 Database Security Practice Question
Network Topology
A database administrator runs the command shown in the exhibit. The security team requires that the database be encrypted at rest. What should the administrator do to enable encryption?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a snapshot of the DB instance, copy the snapshot with encryption, and restore from the encrypted snapshot.
Encryption cannot be enabled on an existing unencrypted instance; you must create a snapshot, copy it with encryption, and restore. Option A is wrong because encryption is at the storage level, not table level. Option C is wrong because modifying the instance does not add encryption. Option D is wrong because the command shows StorageEncrypted is false, so it is not encrypted.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable encryption at the table level using MySQL's built-in encryption.
Why it's wrong here
Enabling MySQL's built-in table-level encryption only encrypts individual tablespaces, not the entire database instance, including logs, backups, and temporary files. This fails to satisfy the requirement for comprehensive 'encryption at rest' across the whole database, which typically implies volume-level encryption. This option is tempting as it *does* provide encryption, and would be appropriate for securing specific sensitive tables within a database where granular, object-level encryption is explicitly needed, or when the underlying storage volume is not encrypted.
- ✓
Create a snapshot of the DB instance, copy the snapshot with encryption, and restore from the encrypted snapshot.
Why this is correct
This is the standard method to enable encryption on an existing instance.
- ✗
Modify the DB instance and set StorageEncrypted to true.
Why it's wrong here
Modifying the instance does not add encryption.
- ✗
The instance is already encrypted because the output shows 'StorageEncrypted' as false.
Why it's wrong here
StorageEncrypted: false means it is not encrypted.
Go deeper
Related to this question
About these practice questions
This DBS-C01 question is part of Courseiva's 1,663-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on DBS-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A database administrator runs the described command. What does the output indicate about the RDS instance?
medium- ✓ A.The DB instance is not encrypted at rest.
- B.The DB instance is in a failed state.
- C.The DB instance is running PostgreSQL.
- D.The DB instance is encrypted at rest using a KMS key.
Why A: The output shows 'StorageEncrypted: false' and 'KmsKeyId: null', which indicates the DB instance is not encrypted at rest. Option B is incorrect because the output does not indicate any failed state; it's a valid status showing encryption configuration. Option C is incorrect because the output does not mention the database engine type. Option D is incorrect because an encrypted instance would show 'StorageEncrypted: true' and a non-null KmsKeyId.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DBS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DBS-C01 exam.