SCS-C02 Data Protection Practice Question
A company is designing a data protection strategy for an Amazon RDS for MySQL database. The database is 2 TB in size and stores financial data. The compliance team requires that database snapshots be encrypted at rest and that encryption keys be rotated every year. Which solution meets these requirements with the LEAST operational overhead?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable automatic key rotation in AWS KMS for the KMS key used for RDS encryption
Enabling automatic key rotation in AWS KMS for the KMS key used for RDS encryption meets the compliance requirement of yearly key rotation without any manual effort. RDS automatically uses the rotated key for new snapshots, and existing snapshots remain encrypted with the original key but can be decrypted with the new key as KMS maintains the key hierarchy. Option A is wrong because copying snapshots to re-encrypt with a new KMS key requires manual scripting and adds operational overhead. Option B is wrong because exporting snapshots to S3 and using S3 Batch Operations is complex and unnecessary. Option C is wrong because using a different KMS key for each snapshot and manually rotating adds significant operational overhead and does not leverage the automatic rotation capability of KMS.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Copy each snapshot to a new snapshot encrypted with a new KMS key
Why it's wrong here
Copying each snapshot to a new snapshot encrypted with a new KMS key is a manual, one-off operation. You would need to perform this for every existing and future snapshot, promote the copied snapshots, and delete the originals; the live RDS instance's storage encryption remains tied to the original key. This approach does not provide automatic, continuous protection and introduces significant operational overhead and room for error.
- ✗
Export snapshots to S3 and use S3 Batch Operations to re-encrypt them
Why it's wrong here
Exporting RDS snapshots to Amazon S3 and running S3 Batch Operations to re-encrypt the exports adds a complex data pipeline without addressing the RDS-encrypted object itself. The export produces logical data files (e.g., Parquet) rather than the native RDS snapshot, and a restore/import would be required to apply the new encryption to the database. This is high operational overhead and not a supported method for automatically rotating the KMS key used by RDS.
- ✗
Use a different KMS key for each snapshot and rotate the key manually
Why it's wrong here
Using a different KMS key for each snapshot and manually rotating the key does not match how RDS encryption keys work. A snapshot inherits the KMS key of the source RDS instance, and to change that key you would have to copy the snapshot and specify the new key, then restore the instance from that copy—there is no native per-snapshot key assignment. Manual rotation of KMS keys also fails to re-encrypt existing data automatically; RDS would continue using the original key material until you take disruptive migration steps.
- ✓
Enable automatic key rotation in AWS KMS for the KMS key used for RDS encryption
Why this is correct
Enabling automatic key rotation in AWS KMS for the customer-managed KMS key used by RDS meets the data protection requirement with minimal operational overhead. AWS KMS rotates the cryptographic backing key each year while keeping the same KMS key ID, so the RDS instance, its storage, and all future snapshots continue using the same key reference with zero manual intervention. Existing data remains decryptable via the previous backing key, and new writes automatically use the new backing key, providing continuous protection.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 1,205 original SCS-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.