Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5
DBS-C01 Workload-Specific Database Design Practice Question
Arrange the steps to enable encryption at rest for an existing unencrypted Amazon RDS for MariaDB DB instance in the correct order.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a manual snapshot, then copy the snapshot with encryption enabled, then restore the encrypted snapshot to a new DB instance, then migrate applications.
Encryption at rest for an existing instance requires creating an encrypted snapshot and restoring it, then migrating applications.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create a manual snapshot, then copy the snapshot with encryption enabled, then restore the encrypted snapshot to a new DB instance, then migrate applications.
Why this is correct
This is the correct order because encryption at rest cannot be added to an existing unencrypted RDS instance; you must create a snapshot, copy it with encryption using a KMS key, restore to a new encrypted instance, and then migrate applications.
- ✗
Create a manual snapshot, then restore the snapshot to a new instance, then copy the new instance with encryption, then migrate applications.
Why it's wrong here
This is incorrect because copying an instance with encryption is not a supported operation; encryption must be applied during the snapshot copy process, not after restoration.
- ✗
Create a manual snapshot, then copy the snapshot with encryption, then modify the original DB instance to use encryption.
Why it's wrong here
This is incorrect because you cannot modify an existing unencrypted RDS instance to enable encryption; the only way is to create a new encrypted instance from an encrypted snapshot.
- ✗
Enable encryption on the original DB instance via a maintenance window, then take a snapshot, then restore.
Why it's wrong here
This is incorrect because encryption cannot be enabled on an existing RDS instance; the maintenance window does not add encryption to an unencrypted instance.
Go deeper
Related to this question
About these practice questions
One of 1,663 original DBS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DBS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DBS-C01 exam.