SCS-C03 Data Protection Practice Question
A company is migrating a legacy database to Amazon RDS for MySQL and must ensure the data is protected according to strict compliance standards. The security team requires that the data at rest is encrypted and that the encryption cannot be disabled after the instance is created. Which TWO statements accurately describe RDS encryption behavior?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Snapshots and automated backups of an encrypted RDS instance are automatically encrypted using the same KMS key.
Amazon RDS encryption at rest is a foundational security feature that must be decided at the time of resource creation. It uses the AES-256 encryption algorithm to protect data stored on the underlying volumes, as well as backups and snapshots. Understanding the lifecycle of encrypted instances is critical for maintaining a secure data environment.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Encryption at rest can be enabled for an existing unencrypted RDS DB instance by modifying the instance settings.
Why it's wrong here
You cannot enable encryption on an existing unencrypted RDS DB instance directly. To encrypt an unencrypted instance, you must first take a snapshot of the database, create an encrypted copy of that snapshot using a KMS key, and then restore a new DB instance from the encrypted snapshot copy.
- ✓
Snapshots and automated backups of an encrypted RDS instance are automatically encrypted using the same KMS key.
Why this is correct
When you encrypt an RDS DB instance, all its subsequent snapshots and automated backups are automatically encrypted using the same KMS key as the parent instance. This ensures consistent data protection throughout the entire lifecycle of the data, including recovery points and archival storage in Amazon S3.
- ✓
Read replicas of an encrypted RDS instance must also be encrypted using the same KMS key as the primary instance.
Why this is correct
For RDS MySQL, MariaDB, and PostgreSQL, if the primary instance is encrypted, all read replicas must also be encrypted. While they usually use the same KMS key, they must at least be encrypted to maintain the security posture of the replicated data across different availability zones or regions.
- ✗
Encryption at rest can be disabled on an RDS instance to improve performance during large data imports.
Why it's wrong here
Once an RDS instance is created with encryption enabled, you cannot disable it. This is a security design choice to prevent the accidental exposure of sensitive data. If you need an unencrypted instance, you would have to export the data and import it into a new, unencrypted database instance.
- ✗
RDS encryption at rest only protects the database tables and does not apply to logs or temporary files.
Why it's wrong here
RDS encryption at rest is comprehensive and covers more than just the tables. It encrypts the underlying storage for the DB instance, including the data files, transaction logs, temporary files, and even the system tables. This provides a holistic layer of protection for all data associated with the database.
Quick reference
Symmetric Encryption Algorithm Comparison
| Algorithm | Key Size | Block Size | Status | Notes |
|---|---|---|---|---|
| AES-128 | 128-bit | 128-bit | Current standard | NIST approved; WPA3, TLS |
| AES-256 | 256-bit | 128-bit | Current standard | Preferred for sensitive / govt data |
| 3DES | 112-bit effective | 64-bit | Deprecated (2023) | Replaced by AES |
| DES | 56-bit | 64-bit | Broken | Cracked in < 24 h; never deploy |
| ChaCha20 | 256-bit | Stream cipher | Current | TLS 1.3, WireGuard |
About these practice questions
One of 99 original SCS-C03 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This SCS-C03 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C03 exam.