DBS-C01 Database Security Practice Question
A healthcare company is migrating its patient records database to Amazon RDS for SQL Server. The database contains Protected Health Information (PHI). The compliance team requires that all PHI data be encrypted at rest and that the encryption keys be stored in a dedicated AWS CloudHSM cluster. Additionally, the database must be replicated to a second AWS region for disaster recovery. The DBA has enabled RDS encryption at rest using a KMS key, but the compliance team insists on using CloudHSM. What should the DBA do to meet the compliance requirement while maintaining disaster recovery?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable Transparent Data Encryption (TDE) using a CloudHSM key and create a cross-region read replica for DR.
RDS for SQL Server supports Transparent Data Encryption (TDE) with CloudHSM as the key store, and RDS read replicas can be created across regions for disaster recovery. Option A is incorrect because RDS encryption at rest with a KMS key does not meet the CloudHSM requirement; KMS custom key stores (backed by CloudHSM) are not supported for RDS encryption at rest. Option B is incorrect because DynamoDB encryption with CloudHSM via KMS custom key store is possible but unnecessary and does not maintain the existing SQL Server database. Option C is incorrect because using RDS Custom with TDE and manual log shipping is more complex and not the standard approach for cross-region disaster recovery with RDS.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use RDS encryption at rest with a KMS key backed by CloudHSM (custom key store).
Why it's wrong here
RDS encryption at rest uses AWS KMS and cannot use a CloudHSM key directly. Custom key stores in KMS are for CloudHSM, but RDS encryption at rest does not support custom key stores, so this does not meet the compliance requirement.
- ✗
Migrate the database to Amazon DynamoDB with encryption using CloudHSM via KMS custom key store.
Why it's wrong here
Migrating to DynamoDB is unnecessary and introduces complexity. DynamoDB encryption with CloudHSM via KMS custom key store is possible but not a standard solution for SQL Server PHI data and does not address the DBA's existing RDS setup.
- ✗
Use an RDS Custom for SQL Server instance and configure TDE with CloudHSM, then set up log shipping to another region.
Why it's wrong here
This option is tempting because RDS Custom for SQL Server enables customers to configure Transparent Data Encryption (TDE) directly within the database instance, allowing integration with AWS CloudHSM for key management, thus addressing the compliance requirement. However, RDS Custom for SQL Server does not natively support managed cross-Region replication for disaster recovery. Setting up log shipping manually to another region introduces significant operational overhead and complexity, especially with TDE and external key management, failing to maintain the desired level of managed disaster recovery.
- ✓
Enable Transparent Data Encryption (TDE) using a CloudHSM key and create a cross-region read replica for DR.
Why this is correct
RDS for SQL Server supports TDE, which can use a CloudHSM key as the key store. Cross-region read replicas are available for RDS for SQL Server, providing disaster recovery. This meets both the encryption and DR requirements.
Go deeper
Related to this question
About these practice questions
One of 1,663 original DBS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DBS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DBS-C01 exam.