DVA-C02 Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Enable encryption on the database after creation

  Why it's wrong here

  You cannot enable encryption on an existing unencrypted RDS DB instance; encryption at rest must be selected during the initial CreateDBInstance operation. If you attempt to modify an unencrypted instance to add encryption, the console and API have no such option. To apply encryption to an existing database, you must create a new encrypted snapshot, restore it as a new encrypted instance, and migrate your data.

• ✗

  Use client-side encryption in the application

  Why it's wrong here

  Client-side encryption in the application encrypts data in the application layer before it is transmitted to the database, using keys managed by the application. This is fundamentally different from RDS server-side encryption, which encrypts the underlying storage volumes transparently using AWS KMS. Choosing client-side encryption does not enable or satisfy the RDS encryption at rest requirement, and you would still need to configure server-side encryption to meet compliance controls.

• ✗

  Configure the DB instance to use a VPC

  Why it's wrong here

  Placing a DB instance in a VPC controls network-level isolation, subnets, route tables, and security groups, but it has no effect on data-at-rest encryption. An RDS instance can be launched inside a VPC while remaining completely unencrypted, because VPC configuration is orthogonal to storage encryption. To enable server-side encryption, you must use KMS and set the encryption flag at launch, not modify VPC settings.

• ✓

  Use AWS KMS to manage the encryption key

  Why this is correct

  Amazon RDS server-side encryption is built on AWS KMS; you must select a customer master key (CMK) when enabling encryption at rest. The KMS key encrypts the database storage, automated snapshots, and read replicas through envelope encryption, and RDS uses the key to encrypt the data key that protects the volume. Without specifying a KMS key, the encryption option cannot be applied, making KMS key management an essential part of the required configuration.

• ✓

  Specify encryption at rest when creating the DB instance

  Why this is correct

  You must explicitly enable encryption at rest when you create the DB instance, either by checking the encryption option in the console or by setting StorageEncrypted=true in the AWS CLI or API call. This setting is evaluated only at provisioning time; there is no post-creation modification path to turn it on. Therefore, specifying encryption at creation is a required action to achieve server-side encryption for the instance.