Enable RDS Encryption at Rest with KMS
A DevOps team is designing a solution to encrypt data at rest for an Amazon RDS for MySQL database. Which TWO actions should the team take? (Choose TWO.)
Quick Answer
The correct answer is to enable encryption at rest when creating the RDS DB instance and use AWS KMS to manage the encryption key. This is because Amazon RDS encryption at rest uses AWS Key Management Service (KMS) to automatically encrypt the underlying storage, automated backups, read replicas, and snapshots using AES-256 encryption, and this setting must be specified at launch time since it cannot be added later to an unencrypted instance. On the AWS Certified DevOps Engineer Professional DOP-C02 exam, this concept tests your understanding of immutable infrastructure and security best practices, often appearing as a trap where candidates mistakenly think encryption can be enabled post-creation or confuse SSL/TLS (encryption in transit) with at-rest encryption. A common memory tip is “encrypt at birth or not at all” — remember that RDS encryption is a one-time decision at instance creation, and KMS is the key manager, not S3 or SSL.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use AWS KMS to create a customer managed key and assign it to the RDS instance
To encrypt data at rest for Amazon RDS for MySQL, encryption must be enabled when creating the DB instance (Option D) and a customer managed key from AWS KMS can be used (Option C). Option A is incorrect because you cannot enable encryption on an existing unencrypted RDS instance; it must be done at creation time. Option B is incorrect because SSL/TLS encrypts data in transit, not at rest. Option E is incorrect because storing database files in an encrypted S3 bucket does not encrypt the RDS instance; RDS encryption is managed by AWS KMS and is enabled at the instance level.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable encryption after creating the RDS instance by modifying the instance
Why it's wrong here
Enable encryption after creating the RDS instance by modifying the instance [wrong]
- ✗
Enable SSL/TLS for the RDS instance
Why it's wrong here
Enable SSL/TLS for the RDS instance [wrong]
- ✓
Use AWS KMS to create a customer managed key and assign it to the RDS instance
Why this is correct
You can use AWS KMS to create a customer managed key and assign it to the RDS instance during creation to encrypt data at rest.
- ✓
Enable encryption at rest when creating the RDS DB instance
Why this is correct
Encryption at rest must be enabled when creating the RDS DB instance; it cannot be added later.
- ✗
Store the database files in an encrypted S3 bucket
Why it's wrong here
Store the database files in an encrypted S3 bucket [wrong]
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This DOP-C02 question is part of Courseiva's 251-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
3 more ways this is tested on DOP-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company is using Amazon RDS for MySQL and needs to encrypt the database at rest. Which action should be taken to enable encryption?
easy- A.Create a read replica with encryption enabled
- B.Use AWS Secrets Manager to encrypt the data
- ✓ C.Enable encryption when creating the DB instance
- D.Modify the existing DB instance and enable encryption
Why C: Encryption at rest for Amazon RDS MySQL can only be enabled during the creation of the DB instance. Once the instance is created, encryption cannot be added. Option A is incorrect because while you can create an encrypted read replica from an unencrypted source, that does not encrypt the original instance. Option B is incorrect because AWS Secrets Manager is used for managing database credentials, not for encrypting data at rest. Option D is incorrect because modifying an existing DB instance does not support enabling encryption; the instance must be created with encryption enabled.
Variation 2. A company uses Amazon RDS for MySQL with Multi-AZ deployment. The security team requires that all data be encrypted at rest and that automated backups are also encrypted. Which configuration meets these requirements?
medium- A.Use an S3 bucket policy to enforce encryption for backup files.
- ✓ B.Enable encryption for the RDS instance using AWS KMS.
- C.Enable encryption on automated backups only after creating a snapshot.
- D.Enable encryption on the underlying EBS volumes using KMS.
Why B: Enabling encryption on the RDS instance using AWS KMS at creation time encrypts the data, automated backups, read replicas, and snapshots. Option A is incorrect because an S3 bucket policy cannot enforce encryption for RDS automated backups; RDS encryption must be handled at the instance level. Option C is incorrect because enabling encryption on automated backups after creating a snapshot does not encrypt the live database or future automated backups. Option D is incorrect because encrypting the underlying EBS volumes separately does not automatically encrypt the RDS data, logs, or backups; RDS encryption must be enabled directly on the instance.
Variation 3. A DevOps engineer is tasked with encrypting data at rest for an Amazon RDS for MySQL database. Which TWO methods can achieve this?
medium- ✓ A.Enable encryption when creating the DB instance using a customer-managed KMS key.
- ✓ B.Enable encryption when creating the DB instance using the AWS managed KMS key.
- C.Use the default RDS encryption with a customer-managed key without KMS.
- D.Enable encryption on an existing unencrypted DB instance by modifying the instance.
- E.Use client-side encryption with the RDS SDK.
Why A: Options A and B are correct because Amazon RDS for MySQL supports encryption at rest using AWS KMS. You can enable encryption when creating the DB instance with either a customer-managed KMS key (Option A) or the AWS managed KMS key (Option B). Option C is incorrect because RDS encryption always uses AWS KMS; there is no option to use a customer-managed key without KMS. Option D is incorrect because encryption cannot be enabled on an existing unencrypted DB instance; you must create a new encrypted instance and migrate the data. Option E is incorrect because client-side encryption is not a built-in RDS feature and would require application-level changes, not a direct method of encrypting data at rest in RDS.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.