SAP-C02 Practice Question: Accelerate Workload Migration and Modernization
A company is migrating a legacy application to AWS and needs to ensure compliance with data residency requirements. The application stores personally identifiable information (PII) in an on-premises MySQL database. The company wants to encrypt the data at rest and in transit during the migration. The database will be migrated to Amazon RDS for MySQL. The solutions architect must ensure that all data is encrypted end-to-end. Which combination of steps will meet these requirements?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable RDS encryption at launch, enforce TLS for connections, and configure the application to use SSL/TLS.
To meet the requirements for encrypting data at rest and in transit end-to-end, the solution must include encryption for the RDS database at rest (only possible at launch) and encryption in transit for both the migration process and ongoing application connections. Option C correctly combines enabling RDS encryption at launch (for at-rest encryption), enforcing TLS for connections to the RDS endpoint (for in-transit encryption), and configuring the application to use SSL/TLS (ensuring the application sends encrypted traffic). Option A is incorrect because using a custom AMI with encrypted EBS applies to EC2 instances, not RDS; the database needs to be migrated to RDS, not EC2. Option B is partially correct but fails to include the application-side TLS configuration, so it does not ensure end-to-end encryption from the application to the database. Option D is incorrect because RDS encryption cannot be enabled after migration; it must be enabled at launch, and a VPN does not encrypt the database at rest.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use a custom AMI with encrypted EBS volumes, enforce TLS, and use AWS DMS with SSL.
Why it's wrong here
Custom AMI with encrypted EBS is for EC2, not RDS; RDS encryption is managed by AWS.
- ✗
Enable RDS encryption at launch, use AWS DMS with SSL, and require SSL certificate verification on the RDS endpoint.
Why it's wrong here
Missing the application side: application must be configured to use TLS.
- ✓
Enable RDS encryption at launch, enforce TLS for connections, and configure the application to use SSL/TLS.
Why this is correct
RDS encryption encrypts data at rest; TLS encrypts data in transit; application configuration ensures end-to-end encryption.
- ✗
Enable RDS encryption after migration, use AWS DMS with SSL, and set up a VPN connection.
Why it's wrong here
RDS encryption cannot be enabled after launch; must be at launch time.
Go deeper
Related to this question
About these practice questions
One of 1,660 original SAP-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.