Encrypting Data at Rest and in Transit for RDS PostgreSQL
A company is designing a multi-tier application that uses Amazon RDS for PostgreSQL. The application must encrypt data at rest and in transit. Which combination of steps should be taken to meet these requirements? (Choose the single best answer.)
Quick Answer
The answer is to enable encryption at rest when launching the RDS instance and configure the DB parameter group to require SSL connections. This is correct because Amazon RDS for PostgreSQL only supports encryption at rest as a one-time setting at launch—it cannot be enabled on an existing instance—while encryption in transit is enforced by setting `rds.force_ssl=1` in the DB parameter group, which forces all client connections to use SSL/TLS. On the AWS Certified Database Specialty DBS-C01 exam, this question tests your understanding of the immutable nature of RDS encryption at rest and the parameter-group-based control for in-transit encryption, a common trap being that you might think you can modify encryption after creation or that SSL is enabled by default. A helpful memory tip is “Launch locks at rest, SSL sets the test”—meaning encryption at rest is locked in at launch, and SSL is set via the parameter group to secure data in transit.
⚠ Common exam trap
It's easy for candidates to assume encryption at rest can be enabled after launch (like modifying an EBS volume) or that KMS alone handles in-transit encryption, but RDS requires upfront planning for at-rest encryption and explicit SSL configuration for transit.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable encryption at rest when launching the RDS instance, and configure the DB parameter group to require SSL connections.
Amazon RDS for PostgreSQL supports encryption at rest only when enabled at instance launch, and SSL/TLS encryption in transit is enforced by configuring the DB parameter group to require SSL connections (e.g., setting `rds.force_ssl=1`). Encryption at rest cannot be added after creation, and SSL ensures data is encrypted between the application and the database.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use client-side encryption for data before sending to RDS, and enable encryption at rest after the instance is created.
Why it's wrong here
Client-side encryption does not encrypt the network transport; also, encryption at rest cannot be enabled after creation without a snapshot.
- ✓
Enable encryption at rest when launching the RDS instance, and configure the DB parameter group to require SSL connections.
Why this is correct
Encryption at rest is enabled at creation; SSL enforcement ensures encryption in transit.
- ✗
Launch the RDS instance without encryption, then enable encryption at rest using the AWS Console.
Why it's wrong here
Encryption at rest can only be enabled at launch or by restoring an encrypted snapshot.
- ✗
Use AWS KMS to encrypt the connection between the application and RDS.
Why it's wrong here
KMS is for key management, not for encrypting connections; SSL/TLS should be used for in-transit encryption.
Go deeper
Related to this question
About these practice questions
This DBS-C01 question is part of Courseiva's 1,663-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on DBS-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company is deploying a new application on Amazon RDS for PostgreSQL. The security policy requires that all data be encrypted at rest and in transit. Which TWO actions should the company take to meet these requirements?
medium- A.Use a client-side encryption library to encrypt data before sending to the database.
- B.Enable encryption for automated backups separately.
- ✓ C.Enable encryption at rest by specifying a KMS key when creating the DB instance.
- D.Create an encrypted read replica and promote it to master.
- ✓ E.Set the parameter rds.force_ssl to 1 in the DB parameter group.
Why C: To encrypt data at rest, you must enable encryption when creating the DB instance by specifying a KMS key (Option C). RDS automatically encrypts automated backups for encrypted instances, so Option B is unnecessary. To encrypt data in transit, you must enforce SSL/TLS connections by setting the parameter rds.force_ssl to 1 in the DB parameter group (Option E). Option A is incorrect because client-side encryption is not required when using RDS encryption and SSL; the requirement is to use RDS features. Option D is incorrect because creating an encrypted read replica does not encrypt the original master instance; you need to enable encryption on the master from the start.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DBS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DBS-C01 exam.