DVA-C02 Security Practice Question
A developer is tasked with encrypting data at rest for an Amazon RDS for MySQL database. The developer wants to use AWS KMS for key management. Which TWO configurations are valid? (Choose TWO.)
⚠ Common exam trap
Test-takers frequently think encryption can be toggled on after creation (Option B) or that AWS owned keys are a valid choice for RDS (Option E), but AWS explicitly requires encryption to be set at launch and only supports AWS managed or customer managed keys for RDS.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a customer managed KMS key and specify it when creating the DB instance.
You can create a customer managed KMS key and specify it when creating the DB instance. Amazon RDS for MySQL supports encryption at rest using AWS KMS, and you can choose a customer managed key at launch time. This key is used to encrypt the DB instance's storage, automated backups, read replicas, and snapshots.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create a customer managed KMS key and specify it when creating the DB instance.
Why this is correct
Creating a customer managed key (CMK) in AWS Key Management Service (KMS) allows a developer to maintain full control over the encryption key's policy, rotation schedule, and access permissions. When creating an Amazon RDS DB instance, this CMK can be explicitly specified, ensuring that all data at rest, including the underlying EBS volumes and subsequent snapshots, is encrypted using a key managed by the customer. This approach provides enhanced compliance and auditing capabilities.
- ✗
Enable encryption after the DB instance is created by modifying the DB instance.
Why it's wrong here
Amazon RDS encryption at rest is a fundamental configuration applied to the underlying storage volume (EBS) at the time of DB instance creation. Once an RDS instance is created without encryption, it is not possible to enable encryption by simply modifying the instance later. To encrypt an unencrypted RDS instance, a new encrypted instance must be created from a snapshot of the original, or the original instance must be recreated with encryption enabled.
- ✓
Enable encryption using the default AWS managed key for RDS.
Why this is correct
Utilizing the default AWS managed key for RDS encryption is a straightforward and secure method to encrypt data at rest without requiring manual key management. AWS automatically handles the creation, rotation, and management of this key within AWS Key Management Service (KMS) on behalf of the customer. This option provides robust encryption with minimal operational overhead, making it suitable for many use cases where granular key control is not a primary requirement.
- ✗
Use S3 server-side encryption (SSE-S3) with the RDS instance.
Why it's wrong here
Amazon RDS DB instances store their data on Amazon Elastic Block Store (EBS) volumes, not directly within Amazon S3 buckets. Therefore, server-side encryption mechanisms specific to S3, such as SSE-S3, are entirely irrelevant and cannot be applied to encrypt RDS data at rest. RDS encryption relies on KMS keys to encrypt the underlying EBS volumes, which is a distinct and separate service from S3 storage.
- ✗
Use an AWS owned KMS key for encryption.
Why it's wrong here
AWS owned keys are encryption keys that AWS owns and manages for use across multiple AWS accounts and services, but customers have no direct control or visibility over them. These keys are not exposed to customers for selection or management when configuring service-specific encryption like for RDS. For RDS encryption, customers can choose between an AWS managed key (managed by AWS on the customer's behalf) or a customer managed key (CMK), but never an AWS owned key.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This DVA-C02 question is part of Courseiva's 1,135-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.