SCS-C02 Data Protection Practice Question
A company needs to encrypt data at rest for an Amazon RDS for Oracle database. The database is deployed in a Multi-AZ configuration. The company also wants to encrypt automated backups and snapshots. Which TWO steps should the security team take?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable encryption at rest when launching the RDS instance.
Encryption must be enabled at launch; it cannot be added later. Option C is correct because enabling encryption at rest automatically encrypts backups and snapshots. Option B is wrong because encryption cannot be enabled on an existing unencrypted instance. Option D is wrong because encryption must be enabled at launch, not after. Option E is wrong because KMS key must be specified at launch; can be changed later only for certain engines.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Enable encryption at rest when launching the RDS instance.
Why this is correct
Encryption must be enabled at launch.
- ✗
Modify the DB instance to enable encryption after creation.
Why it's wrong here
Cannot modify; must create a new encrypted instance.
- ✓
Ensure that the 'Encryption at rest' setting also encrypts automated backups and snapshots.
Why this is correct
RDS encryption automatically encrypts backups and snapshots.
- ✗
Enable encryption at rest on the existing RDS instance via a modification.
Why it's wrong here
Encryption cannot be added to an existing unencrypted instance.
- ✗
Specify a KMS key after the instance is launched.
Why it's wrong here
KMS key must be specified at launch.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SCS-C02 question from scratch — 376 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.