DVA-C02 RDS Encryption at Rest Practice Question
A company wants to encrypt data at rest in an Amazon RDS for MySQL DB instance. Which of the following are true about RDS encryption? (Select THREE.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Encryption at rest can be enabled when you create the DB instance.
Encryption at rest for Amazon RDS MySQL can only be enabled when you create the DB instance (B). Once created, you cannot enable encryption on an unencrypted instance (A is false). When encryption is enabled, snapshots (C), automated backups (D), and read replicas are all encrypted. Read replicas of an encrypted instance must also be encrypted, so E is false. Therefore, options B, C, and D are correct.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Encryption at rest can be enabled on an existing unencrypted DB instance.
Why it's wrong here
You cannot enable encryption at rest on an existing, unencrypted RDS instance because the encryption status is a fixed attribute binding at provisioning time. There is no AWS Console, CLI, or API operation that toggles encryption on a live database, so you must create a new encrypted instance (for example, by restoring a snapshot with encryption enabled) and migrate data using tools like AWS DMS or native dump/restore.
- ✓
Encryption at rest can be enabled when you create the DB instance.
Why this is correct
Encryption at rest is an instance-level configuration selected at the moment you create the DB instance. When you launch a new RDS database, you choose the 'Enable encryption' option and specify an AWS KMS key; from that point onward, all data on the underlying storage is AES-256 encrypted, and this setting cannot be changed after creation.
- ✓
Snapshots of an encrypted instance are encrypted.
Why this is correct
Any manual snapshot taken from an encrypted RDS instance is automatically encrypted with the same KMS key that encrypted the source instance. When you later restore from that snapshot, the restored instance remains encrypted, ensuring the backup artifact stored in Amazon S3 never exists in plaintext and inherits the same cryptographic controls.
- ✓
When encryption is enabled, automated backups are encrypted.
Why this is correct
When a DB instance has encryption enabled, RDS uses the same KMS key to encrypt all automated backups, including daily snapshots and transaction logs used for point-in-time recovery. This gives end-to-end encryption coverage for every recovery artifact, so you cannot retrieve unencrypted backup files from S3 or via the RDS API.
- ✗
Read replicas of an encrypted instance can be unencrypted.
Why it's wrong here
Read replicas of an encrypted source instance must also be encrypted; RDS does not allow creating an unencrypted replica from an encrypted primary. Because the replication stream and the replica's underlying storage both require encryption, AWS enforces that read replicas use a KMS key (either the same key or a different one) to preserve the confidentiality of the data at rest.
Go deeper
Related to this question
About these practice questions
Courseiva writes every DVA-C02 question from scratch — 724 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.