DVA-C02 Security Practice Question
A company wants to encrypt data at rest in Amazon RDS for MySQL. Which TWO actions should be taken?
⚠ Common exam trap
Many exam-takers assume encryption at rest can be enabled after instance creation (like modifying a DB parameter group) or that MySQL native encryption is available in RDS, but AWS restricts encryption to instance creation time and does not support MySQL's native table encryption within the managed service.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable encryption at rest when creating the DB instance.
Amazon RDS for MySQL supports encryption at rest only at the time of DB instance creation. You must enable the encryption option in the console or specify the --storage-encrypted flag in the AWS CLI when launching the instance. Once enabled, RDS automatically encrypts the underlying storage, automated backups, read replicas, and snapshots using AES-256 encryption, with keys managed through AWS KMS.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Enable encryption at rest when creating the DB instance.
Why this is correct
Amazon RDS for MySQL supports encryption at rest, which must be configured during the initial creation of the DB instance. This ensures that the underlying storage volume, database snapshots, automated backups, and read replicas are all encrypted from the outset using an AWS Key Management Service (KMS) key. Attempting to enable encryption on an unencrypted instance after creation is not supported directly by RDS.
- ✗
Encrypt individual tables using MySQL native encryption.
Why it's wrong here
While MySQL does offer native table-level encryption features, such as InnoDB tablespace encryption, this approach is distinct from Amazon RDS encryption at rest. RDS encryption at rest operates at the storage volume level, encrypting the entire underlying data store, including all tables, indexes, and logs, rather than requiring individual table configuration. Therefore, relying solely on native MySQL table encryption would not fulfill the requirement for comprehensive RDS data at rest encryption.
- ✗
Enable encryption at rest after the DB instance is created.
Why it's wrong here
Amazon RDS does not allow enabling encryption at rest on an existing, unencrypted DB instance directly. The encryption status is a fundamental property of the underlying storage volume established at creation. To encrypt an unencrypted RDS instance, a new encrypted DB instance must be created, and data migrated from the unencrypted instance, typically via a snapshot copy and restore process, or logical replication.
- ✓
Use AWS KMS to manage the encryption keys.
Why this is correct
Amazon RDS encryption at rest seamlessly integrates with AWS Key Management Service (KMS) to manage the encryption keys. When encryption is enabled, RDS uses a KMS key—either an AWS-managed key or a customer-managed key (CMK)—to encrypt the data. KMS provides centralized control, auditing, and rotation capabilities for these cryptographic keys, enhancing the security posture of the encrypted database.
- ✗
Use client-side encryption to encrypt data before sending to RDS.
Why it's wrong here
Client-side encryption involves encrypting data within the application before it is transmitted to the database. While a valid security practice for data in transit and potentially for specific sensitive fields, it is a separate mechanism from Amazon RDS encryption at rest. RDS encryption at rest specifically secures the data stored on the underlying storage volume, automated backups, and snapshots, independent of how the data was encrypted before being written to the database.
Quick reference
Symmetric Encryption Algorithm Comparison
| Algorithm | Key Size | Block Size | Status | Notes |
|---|---|---|---|---|
| AES-128 | 128-bit | 128-bit | Current standard | NIST approved; WPA3, TLS |
| AES-256 | 256-bit | 128-bit | Current standard | Preferred for sensitive / govt data |
| 3DES | 112-bit effective | 64-bit | Deprecated (2023) | Replaced by AES |
| DES | 56-bit | 64-bit | Broken | Cracked in < 24 h; never deploy |
| ChaCha20 | 256-bit | Stream cipher | Current | TLS 1.3, WireGuard |
Go deeper
Related to this question
About these practice questions
One of 724 original DVA-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on DVA-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company wants to encrypt data at rest in an Amazon RDS for MySQL DB instance. Which of the following are true about RDS encryption? (Select THREE.)
medium- A.Encryption at rest can be enabled on an existing unencrypted DB instance.
- ✓ B.Encryption at rest can be enabled when you create the DB instance.
- ✓ C.Snapshots of an encrypted instance are encrypted.
- ✓ D.When encryption is enabled, automated backups are encrypted.
- E.Read replicas of an encrypted instance can be unencrypted.
Why B: Encryption at rest for Amazon RDS MySQL can only be enabled when you create the DB instance (B). Once created, you cannot enable encryption on an unencrypted instance (A is false). When encryption is enabled, snapshots (C), automated backups (D), and read replicas are all encrypted. Read replicas of an encrypted instance must also be encrypted, so E is false. Therefore, options B, C, and D are correct.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.