Courseiva
← DVA-C02
Full test
Security →easyMultiple ChoiceObjective-mapped

DVA-C02 Security Practice Question

A developer needs to enforce encryption in transit for all traffic between an application and an RDS database. Which configuration should be used?

⚠ Common exam trap

A common mix-up: candidates confuse encryption at rest (Option C) with encryption in transit, or assume that network-level controls like security groups (Option A) or VPC peering (Option B) inherently encrypt traffic, when they do not.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Set the 'require_secure_transport' parameter to 'ON' in the DB parameter group.

Setting the 'require_secure_transport' parameter to 'ON' in the DB parameter group enforces TLS/SSL encryption for all connections to the RDS database. This ensures that data in transit between the application and the database is encrypted, meeting the requirement for encryption in transit.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • ✗

    Configure the security group to only allow traffic on port 443.

    Why it's wrong here

    Configuring a security group to only allow traffic on port 443 is incorrect for enforcing encryption in transit for an RDS database. Security groups act as virtual firewalls, controlling inbound and outbound network traffic based on specified ports, protocols, and IP ranges. While they restrict access, they do not enforce encryption. Furthermore, standard RDS databases like MySQL (port 3306) or PostgreSQL (port 5432) do not use port 443 for their primary communication, making this configuration ineffective and preventing legitimate database connections.

  • ✗

    Create a VPC peering connection between the application and database subnets.

    Why it's wrong here

    Creating a VPC peering connection between application and database subnets establishes private network connectivity, allowing resources in different VPCs to communicate directly using private IP addresses. However, VPC peering itself does not inherently encrypt the data traveling over this connection at the application layer. While traffic within the AWS network backbone is generally secure, explicit encryption mechanisms like SSL/TLS are still required at the application or database level to enforce encryption in transit for the data payload.

  • ✗

    Enable encryption at rest using AWS KMS.

    Why it's wrong here

    Enabling encryption at rest using AWS KMS encrypts the data stored on the database instance's disk, including its underlying storage, backups, and snapshots. This protects data when it is persistent and not actively being transmitted. However, encryption at rest is distinct from encryption in transit. It does not provide any mechanism to encrypt the data as it travels over the network between the client application and the RDS database instance, which is the specific requirement of the question.

  • ✓

    Set the 'require_secure_transport' parameter to 'ON' in the DB parameter group.

    Why this is correct

    Setting the 'require_secure_transport' parameter to 'ON' within the RDS DB parameter group is the correct method to enforce encryption in transit. This parameter, available for databases like MySQL and PostgreSQL, configures the database server to reject any client connection attempts that do not utilize SSL/TLS. By doing so, it ensures that all successful connections to the RDS instance are encrypted, protecting data as it travels over the network between the application and the database.

About these practice questions

One of 724 original DVA-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

Same concept, more angles

1 more way this is tested on DVA-C02

These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.

Variation 1. A company wants to encrypt data in transit between an on-premises application and an Amazon RDS instance. Which of the following should be implemented?

medium
  • A.Use an AWS Site-to-Site VPN connection
  • ✓ B.Use SSL/TLS for the database connection
  • C.Place the RDS instance in a private subnet and use a bastion host
  • D.Enable encryption at rest on the RDS instance

Why B: Encryption in transit is achieved by using SSL/TLS for the connection. RDS supports SSL/TLS connections to encrypt data moving between the client and the database.

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.