SCS-C02 Data Protection Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Enable encryption at rest for the RDS instance

  Why it's wrong here

  Enabling encryption at rest for an RDS instance uses AES-256 to encrypt the underlying storage volumes, automated backups, snapshots, and read replicas. That protection is entirely transparent to network traffic, so the SQL queries and credentials moving between your EC2 instance and the database endpoint can still be captured and read from the wire. This setting is required for compliance at rest, but it does nothing for data in transit.

• ✓

  Configure the database to use SSL/TLS connections

  Why this is correct

  To encrypt data in transit, you must configure the database client and server to negotiate a TLS session. On RDS, this means importing the Amazon RDS CA certificate into the client's trust store and setting the database parameter group's `rds.force_ssl` (PostgreSQL) or `require_secure_transport` (MySQL/MariaDB) parameter to 1. Once enabled, TLS encrypts the entire database protocol stream, including authentication, query text, and result sets, and the client can verify that it is connecting to the genuine RDS endpoint, not an impostor.

• ✗

  Use an AWS KMS key to encrypt the connection

  Why it's wrong here

  AWS KMS is a managed service that creates, rotates, and controls envelope encryption keys; it does not sit in the network path between EC2 and RDS. A KMS key can be used to encrypt data at rest, or to generate data keys for client-side encryption, but it cannot establish an encrypted session on the database connection itself. Encrypting the connection requires a protocol-level mechanism such as TLS, which performs its own handshake and exchanges session keys, independent of any KMS API call.

• ✗

  Enable EBS encryption on the EC2 instance

  Why it's wrong here

  EBS encryption protects the EC2 instance's attached block device at rest by encrypting data as it is written to the underlying volume, and transparently decrypting it when read by the kernel. That is a storage-layer feature that has no effect on the network interfaces or TCP sockets used to reach the RDS database. The traffic between the EC2 instance's ENI and the RDS endpoint remains plaintext unless an application-level encryption protocol such as TLS is applied, so EBS encryption cannot prevent sniffing or eavesdropping in transit.

Go deeper

Related to this question