SCS-C02 Management and Security Governance Practice Question
A company's security team needs to enforce encryption at rest for all RDS instances in the production account. They have enabled mandatory encryption using a service control policy. What else must be done to ensure existing unencrypted RDS instances are encrypted?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a snapshot of the unencrypted instance, copy the snapshot with encryption enabled, and restore the encrypted snapshot to a new DB instance.
RDS does not support directly enabling encryption on an existing unencrypted instance. The only way to encrypt an existing unencrypted RDS instance is to take a snapshot of it, copy the snapshot with encryption enabled, and restore the encrypted snapshot to a new DB instance. Options A, C, and D are incorrect: A: Attaching a new KMS key policy to the RDS instance does not encrypt the instance; encryption is applied at snapshot creation. C: Enabling encryption on the DB subnet group does not affect existing instances; it only applies to new instances. D: Modifying the RDS instance via the console does not allow enabling encryption on an existing instance; encryption can only be enabled at creation or via snapshot copy.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Attach a new KMS key policy to the RDS instance.
Why it's wrong here
Attaching a new KMS key policy is a category error. A KMS key policy is a resource policy on a customer master key, not on an RDS instance, and RDS instances do not have configurable key-policy attachments. At most, adjusting the key policy grants AWS KMS the kms:Encrypt and kms:Decrypt permissions needed to use an existing CMK for future operations, but it cannot retroactively encrypt storage that was provisioned without encryption. Therefore this action does not change the current unencrypted state.
- ✓
Create a snapshot of the unencrypted instance, copy the snapshot with encryption enabled, and restore the encrypted snapshot to a new DB instance.
Why this is correct
This is the standard, supported migration path. First, create a manual snapshot of the unencrypted RDS instance. Then copy that snapshot and select 'Enable encryption' (or specify a KMS key ID), because the copy operation re-encrypts the data at rest. Finally, restore the encrypted snapshot to a new DB instance, redirect application traffic to the new instance, and retire the old unencrypted instance once validation is complete.
- ✗
Enable encryption on the DB subnet group and reboot the instance.
Why it's wrong here
Encryption at rest is a property of the DB instance's storage volume, not of the network layer. DB subnet groups define only the VPC subnets and route tables, and they have no encryption toggle available. Rebooting an instance also merely restarts the underlying database process; it cannot alter the storage encryption attribute, so this approach leaves the existing unencrypted data completely unchanged.
- ✗
Modify the RDS instance to enable encryption using the AWS Console.
Why it's wrong here
The RDS console offers no 'Enable encryption' modification for an existing DB instance because the engine does not support in-place encryption changes. The StorageEncrypted parameter is set to true only at creation time (or via snapshot copy/restore), and no ModifyDBInstance API call can flip it. Thus attempting this console modification fails, and the only general path is snapshot-based migration.
Visual reference
Go deeper
Related to this question
About these practice questions
This SCS-C02 question is part of Courseiva's 1,205-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.