DOP-C02 Security and Compliance Practice Question

Which TWO are best practices for securing an Amazon RDS database? (Choose 2)

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Launch the RDS instance in a private subnet.

(launch RDS in a private subnet) and Option D (enable encryption at rest using AWS KMS) are correct best practices for securing an Amazon RDS database. Launching in a private subnet ensures the database is not directly accessible from the internet, enhancing security. Encryption at rest protects data stored on disk. Option A is incorrect because enabling public accessibility increases exposure to attacks. Option B is incorrect because using a single Availability Zone does not enhance security and may reduce availability. Option E is incorrect because direct IAM user access to the database is not a standard practice; RDS uses database authentication, though IAM database authentication can be used, it's not a direct IAM user access and is not a best practice for all scenarios.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Enable public accessibility for easy management.
Why it's wrong here
Public accessibility increases exposure to attacks.
✗
Use a single Availability Zone to reduce complexity.
Why it's wrong here
This does not improve security; it reduces availability.
✓
Launch the RDS instance in a private subnet.
Why this is correct
Placing the database in a private subnet restricts direct internet access.
✓
Enable encryption at rest using AWS KMS.
Why this is correct
Encryption at rest protects data if storage is compromised.
✗
Grant direct IAM user access to the database.
Why it's wrong here
Direct IAM user access is not a standard practice; use IAM database authentication with caution.

Visual reference

About these practice questions

Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

Same concept, more angles

1 more way this is tested on DOP-C02

These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.

Variation 1. A company has an Amazon RDS for MySQL database that stores sensitive data. The security team requires encryption at rest and in transit. Which combination of options meets these requirements?

easy

A.Use AWS Certificate Manager to issue a certificate for the RDS instance
B.Place the RDS instance in a private subnet and use VPC peering
✓ C.Enable encryption at rest on the RDS instance and enforce SSL connections
D.Use AWS KMS to encrypt the database before inserting data and decrypt on read

Why C: Encryption at rest for Amazon RDS is enabled by turning on RDS encryption when creating the instance. Encryption in transit is achieved by enforcing SSL/TLS connections for client connections to the database. Option C correctly combines both: enabling RDS encryption for at-rest security and enforcing SSL for in-transit security. Option A (AWS Certificate Manager) provides certificates but does not directly encrypt the RDS instance. Option B (private subnet with VPC peering) addresses network isolation, not encryption. Option D (client-side encryption with KMS) encrypts data before insertion but does not use RDS encryption and is not a standard RDS feature.

Last reviewed: Jun 20, 2026

Question Discussion

Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.

Loading comments…

This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.