How to Secure Data in Transit Between EC2 and RDS with SSL
A security engineer needs to protect data in transit between an EC2 instance and an RDS database. The RDS database uses SSL/TLS certificates. What is the MOST secure way to ensure that the connection is encrypted?
Quick Answer
The correct answer is to download the RDS CA certificate to the EC2 instance and configure the database client to use SSL with certificate verification. This is the most secure way to encrypt data in transit between EC2 and RDS because it not only enables TLS encryption but also authenticates the RDS server’s identity, preventing man-in-the-middle attacks where a fake server could intercept the traffic. On the AWS Certified Security Specialty SCS-C02 exam, this concept tests your understanding that encryption in transit is never automatic—the client must explicitly initiate SSL and validate the certificate chain. A common trap is assuming that simply enabling SSL on the RDS side or using an IAM policy is sufficient; neither enforces client-side verification. Remember the mnemonic: “Client must check the cert, or the MITM will hurt.”
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Download the RDS CA certificate to the EC2 instance and configure the database client to use SSL and verify the certificate.
Downloading the RDS CA certificate to the EC2 instance and configuring the database client to use SSL with certificate verification ensures that the data in transit is encrypted and that the server's identity is verified, preventing man-in-the-middle attacks. Option A is incorrect because a self-signed certificate without proper verification does not provide a trusted chain of identity. Option B is incorrect because encryption at rest protects data stored on disk, not data in transit. Option D is incorrect because IAM policies can require SSL but cannot enforce the actual encryption of the connection; the client must still be configured to use SSL.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure the EC2 instance to use a self-signed certificate for SSL connections.
Why it's wrong here
Self-signed certificates do not provide verification of the server identity.
- ✗
Enable encryption at rest on the RDS instance to automatically encrypt in-transit traffic.
Why it's wrong here
Encryption at rest does not affect data in transit.
- ✓
Download the RDS CA certificate to the EC2 instance and configure the database client to use SSL and verify the certificate.
Why this is correct
This provides strong encryption and server identity verification.
- ✗
Create an IAM policy that requires SSL connections to the RDS endpoint.
Why it's wrong here
IAM policies cannot enforce SSL at the database connection level.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SCS-C02 question from scratch — 376 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on SCS-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company needs to encrypt data in transit between an EC2 instance and an RDS database. Which option should be used?
easy- A.Enable encryption at rest for the RDS instance
- ✓ B.Configure the database to use SSL/TLS connections
- C.Use an AWS KMS key to encrypt the connection
- D.Enable EBS encryption on the EC2 instance
Why B: Encrypting data in transit between an EC2 instance and an RDS database requires the use of SSL/TLS protocols to secure the communication channel. AWS RDS supports SSL/TLS connections by enabling the `require_secure_transport` parameter or using a certificate bundle on the client side, ensuring that all data transmitted over the network is encrypted and protected from eavesdropping or man-in-the-middle attacks.
Variation 2. A company needs to ensure that data in transit between an EC2 instance and an RDS database is encrypted. Which solution meets this requirement?
easy- A.Use a VPN connection between the VPC and the database
- B.Enable encryption at rest on the RDS instance
- ✓ C.Enable SSL/TLS on the database connection
- D.Use client-side encryption on the application
Why C: SSL/TLS is the appropriate solution to encrypt data in transit between the EC2 instance and the RDS database. It ensures that data is encrypted during transmission, preventing eavesdropping or tampering. Option A is incorrect because a VPN connection encrypts traffic between networks but is unnecessary for direct connectivity within the same VPC; SSL/TLS is more straightforward. Option B is incorrect because encryption at rest protects data stored on disk, not data in motion. Option D is incorrect because client-side encryption would require modifying the application to encrypt data before sending, which does not guarantee encryption of the entire communication channel.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.