How to Enable Encryption on Unencrypted RDS Instance Backups
A company is using Amazon RDS for PostgreSQL with automated backups. The security team requires that backups be encrypted at rest. The DB instance is currently unencrypted. What is the most efficient way to enable encryption for future backups?
Quick Answer
The correct approach is to create a snapshot of the DB instance, copy the snapshot with encryption enabled, and restore the encrypted snapshot to a new DB instance. This is necessary because AWS RDS does not allow you to enable encryption on an existing unencrypted instance directly; encryption is a property set only at launch time, so you must migrate the data through an encrypted snapshot copy to a new instance. On the AWS Certified Database Specialty DBS-C01 exam, this question tests your understanding of the immutable nature of RDS encryption settings and the snapshot-based migration workflow. A common trap is assuming you can modify the instance or encrypt the S3 backup destination, but neither encrypts the actual database backups—only a snapshot copy with encryption enabled does. Memory tip: think of it as “snapshot, copy with key, restore new”—you cannot flip a switch on the old instance.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a snapshot of the DB instance, copy the snapshot with encryption enabled, and restore the encrypted snapshot to a new DB instance.
The correct method to enable encryption for future backups on an existing unencrypted Amazon RDS for PostgreSQL instance is to create a snapshot of the DB instance, copy the snapshot with encryption enabled, and restore the encrypted snapshot to a new DB instance. Option A is incorrect because there is no 'backup_encryption' parameter in the DB parameter group. Option B is incorrect because modifying the DB instance does not allow enabling encryption on an unencrypted instance; encryption can only be enabled at creation time. Option C is incorrect because enabling encryption on the S3 bucket does not encrypt the RDS backups themselves; the backups must be encrypted at the source.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable encryption by setting the 'backup_encryption' parameter in the DB parameter group.
Why it's wrong here
There is no such parameter for enabling backup encryption.
- ✗
Modify the DB instance to enable encryption.
Why it's wrong here
Modifying an unencrypted RDS instance does not allow enabling encryption.
- ✗
Enable encryption on the S3 bucket where backups are stored.
Why it's wrong here
S3 encryption does not encrypt the backup data at the database level; backups from unencrypted instances remain unencrypted.
- ✓
Create a snapshot of the DB instance, copy the snapshot with encryption enabled, and restore the encrypted snapshot to a new DB instance.
Why this is correct
This is the standard method to migrate an unencrypted RDS instance to an encrypted one.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every DBS-C01 question from scratch — 1,663 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on DBS-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company is using Amazon RDS for MySQL with automated backups enabled. The security team requires that all backups be encrypted at rest. Which configuration ensures that new automated backups are encrypted?
medium- ✓ A.Create a new encrypted DB instance and migrate the data. Automated backups will inherit encryption.
- B.Modify the DB instance to enable encryption at rest after creation.
- C.Use AWS KMS to encrypt the S3 bucket where automated backups are stored.
- D.Enable encryption at rest on the DB instance and also enable encryption on automated backups using the DBSnapshot option.
Why A: Encryption at rest must be enabled at creation time on an RDS instance. When you enable encryption at rest on a new DB instance, all automated backups, snapshots, and replicas inherit that encryption automatically. Option B is incorrect because you cannot enable encryption at rest on an existing RDS instance after creation; you must create a new encrypted instance and migrate. Option C is incorrect because automated backups are stored in an S3 bucket managed by RDS, but you cannot directly encrypt the bucket or backups separately; encryption is tied to the DB instance. Option D is incorrect because it incorrectly suggests both enabling encryption on the instance and a separate DBSnapshot option; encryption on the instance already covers backups, and there is no separate DBSnapshot option for enabling encryption.
Variation 2. A company wants to ensure that an Amazon RDS for MySQL database is automatically backed up daily and backups are encrypted. What should they do?
easy- A.Take manual snapshots daily and enable encryption on the snapshot copy.
- B.Use Amazon CloudWatch Events to trigger a Lambda function that exports the database to S3 with encryption.
- ✓ C.Enable automated backups and encryption at rest on the RDS instance.
- D.Configure AWS Backup to back up the RDS instance to an S3 bucket with default encryption.
Why C: Automated backups with encryption at rest ensure that backups are automatically taken daily and encrypted. Option C is correct because it enables both features: automated backups and encryption at rest. Option A is incorrect because manual snapshots are not automatic; they require manual intervention and enabling encryption on the snapshot copy is an extra step. Option B is incorrect because using CloudWatch Events and Lambda to export to S3 is not the standard automated backup mechanism for RDS; RDS automated backups are handled natively and do not require custom Lambda functions. Option D is incorrect because AWS Backup is not the default automated backup service for RDS; RDS has its own automated backup feature. Additionally, encryption for RDS backups is managed by AWS KMS, not S3 default encryption.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DBS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DBS-C01 exam.