SCS-C02 Data Protection Practice Question
A security engineer is configuring a new Amazon RDS for MySQL database. The compliance team requires that all database connections be encrypted in transit. Which configuration ensures this requirement is met?
⚠ Common exam trap
It's easy for candidates to confuse enabling SSL support (the 'ssl' parameter) with requiring SSL (the 'require_secure_transport' parameter), thinking that simply enabling SSL on the server forces all clients to use it, but in reality, the server will accept both encrypted and unencrypted connections unless the requirement is explicitly enforced.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable the 'require_secure_transport' parameter in the DB parameter group
Setting the 'require_secure_transport' parameter to '1' in the DB parameter group forces all connections to the RDS for MySQL instance to use TLS/SSL encryption. This ensures that data in transit is encrypted, meeting the compliance requirement. The parameter enforces that only encrypted connections are accepted, rejecting any unencrypted attempts.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable encryption at rest using KMS
Why it's wrong here
Encryption at rest protects data stored on the underlying volume, automated backups, and snapshots, but it has no effect on the network path between the client and the database. A malicious observer on the wire can still sniff SQL queries and result sets unless TLS is also enforced. Since the requirement explicitly addresses in-transit data, enabling KMS encryption alone leaves the transport channel unencrypted.
- ✗
Enable IAM database authentication
Why it's wrong here
IAM database authentication replaces a static password with an AWS Signature Version 4 signed authentication token, but it merely verifies the user's identity; it does not negotiate or enforce TLS encryption. After authentication, the session can still carry plaintext traffic unless the server is configured to reject insecure connections. Therefore, turning on IAM auth does not guarantee that every connection is encrypted.
- ✗
Set the 'ssl' parameter to '1' in the DB parameter group
Why it's wrong here
Setting the ssl parameter to 1 tells the MySQL server to support TLS, but it leaves the client free to decide whether to use it. The server will accept both encrypted and unencrypted connections under this setting, so a client that omits the --ssl-mode=REQUIRED option connects in plaintext. The goal is to force encryption, so merely supporting SSL is insufficient.
- ✓
Enable the 'require_secure_transport' parameter in the DB parameter group
Why this is correct
Setting require_secure_transport to 1 in the custom DB parameter group instructs the MySQL server to reject any connection that does not use a secure transport protocol such as TLS/SSL. This enforces encryption in transit at the server level, meaning clients that request plaintext are refused immediately. It directly addresses the requirement to prevent all unencrypted traffic, regardless of client-side settings.
Go deeper
Related to this question
About these practice questions
One of 1,205 original SCS-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.