Enabling Encryption at Rest for Amazon RDS: KMS, Snapshot Copy, and Read Replica
A company wants to encrypt data at rest for an Amazon RDS for MySQL DB instance. Which THREE options can be used to achieve this? (Choose THREE.)
Quick Answer
The correct answer is that you can enable encryption at rest for Amazon RDS by enabling it when creating the DB instance, encrypting a copy of an unencrypted snapshot, and creating an encrypted read replica from an encrypted source. This works because RDS encryption at rest is a launch-time attribute using AWS KMS, meaning you cannot directly encrypt an existing unencrypted instance; instead, you must snapshot it, copy the snapshot with encryption enabled, and restore from that encrypted snapshot. On the SCS-C02 exam, this question tests your understanding of the immutable nature of RDS encryption and the workaround via snapshot copy, often appearing as a trap where candidates mistakenly think you can toggle encryption on a running instance. A common memory tip is "launch, copy, or clone" — encryption is set at launch, applied to a snapshot copy, or inherited by a read replica only if the source is already encrypted.
⚠ Common exam trap
A common mix-up: candidates assume you can enable encryption on an existing RDS instance via a simple modification (Option B), but AWS explicitly prohibits this, requiring a snapshot-based migration instead.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Take a snapshot of the unencrypted instance, copy it with encryption, and restore.
You can take a snapshot of an unencrypted Amazon RDS for MySQL DB instance, create an encrypted copy of that snapshot, and then restore a new DB instance from the encrypted snapshot. This process effectively encrypts the data at rest, as the restored instance will inherit the encryption setting from the snapshot. AWS RDS does not allow enabling encryption on an existing unencrypted DB instance directly, so this snapshot-based approach is the standard workaround.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Take a snapshot of the unencrypted instance, copy it with encryption, and restore.
Why this is correct
This is a valid method to encrypt an existing database.
- ✗
Modify the DB instance to enable encryption after creation.
Why it's wrong here
You cannot enable encryption on an existing unencrypted instance directly.
- ✗
Create a read replica with encryption enabled, even if the source is unencrypted.
Why it's wrong here
Read replicas must have the same encryption as the source; if source is unencrypted, replica cannot be encrypted.
- ✓
Enable encryption on an existing read replica of an encrypted source.
Why this is correct
If the source is encrypted, you can create an encrypted read replica.
- ✓
Enable encryption when creating the DB instance.
Why this is correct
Encryption can be enabled at launch.
Go deeper
Related to this question
About these practice questions
One of 376 original SCS-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SCS-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company wants to encrypt data at rest in an Amazon RDS for MySQL DB instance. Which AWS service or feature should be used to achieve this?
easy- ✓ A.AWS Key Management Service (KMS)
- B.Amazon S3 server-side encryption
- C.RDS encryption feature
- D.SSL/TLS certificates
Why A: AWS Key Management Service (KMS) is the correct service because Amazon RDS for MySQL uses KMS-managed customer master keys (CMKs) to enable encryption at rest for DB instances. When you enable RDS encryption, RDS automatically integrates with KMS to encrypt the underlying storage, automated backups, read replicas, and snapshots using AES-256 encryption. This is the foundational service that provides the key management and encryption operations for RDS at-rest encryption.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.