SCS-C02 Data Protection Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Export the database to S3 using pg_dump, then import into a new encrypted RDS instance.

  Why it's wrong here

  Although pg_dump can export the data and a newly created RDS instance can be encrypted at launch, this approach is manual and operationally heavy. You must manage downtime or write quiescence during the dump and import, and you lose the convenience of restoring an existing snapshot with the same instance settings, automated backup timeline, and native RDS metadata. AWS's snapshot-copy-restore path is simpler, less error-prone, and preserves the database engine configuration without requiring custom import tooling.

• ✗

  Create a read replica with encryption enabled and promote it to primary.

  Why it's wrong here

  A read replica's encryption status is inherited from its source DB instance, so you cannot create an encrypted read replica from an unencrypted source. If the source is unencrypted, the replica is also unencrypted, and the AWS API/Console does not allow you to specify a KMS key for that replica. Therefore, promoting such a replica would still leave the data unencrypted at rest and does not satisfy the requirement.

• ✓

  Take a snapshot of the database, copy the snapshot with encryption enabled, and restore the encrypted snapshot to a new DB instance.

  Why this is correct

  This is the officially supported AWS method for adding encryption at rest to an existing unencrypted RDS instance. You take a manual snapshot, copy that snapshot while specifying a KMS key (which encrypts the snapshot copy), and then restore the encrypted snapshot to a new DB instance. The restored instance is encrypted at the storage layer, and you can repoint your application to its new endpoint before decommissioning the original instance. After creation, encryption on that restored instance cannot be disabled.

• ✗

  Enable encryption directly on the existing RDS instance by modifying the DB instance settings.

  Why it's wrong here

  Modifying an unencrypted Amazon RDS instance's settings to enable encryption is not possible. Encryption status is a fundamental configuration set during instance creation and cannot be altered afterwards for an unencrypted instance. This option is tempting because modifying DB instance settings is the standard procedure for changing many other parameters, such as instance class or storage. It would also be the correct method to enable encryption when creating a *new* instance, or to rotate the encryption key on an *already encrypted* instance.

Go deeper

Related to this question