How to Secure Data in Transit Between EC2 and RDS with SSL
A security engineer needs to protect data in transit between an EC2 instance and an RDS database. The RDS database uses SSL/TLS certificates. What is the MOST secure way to ensure that the connection is encrypted?
Quick Answer
The correct answer is to download the RDS CA certificate to the EC2 instance and configure the database client to use SSL with certificate verification. This is the most secure way to encrypt data in transit between EC2 and RDS because it not only enables TLS encryption but also authenticates the RDS server’s identity, preventing man-in-the-middle attacks where a fake server could intercept the traffic. On the AWS Certified Security Specialty SCS-C02 exam, this concept tests your understanding that encryption in transit is never automatic—the client must explicitly initiate SSL and validate the certificate chain. A common trap is assuming that simply enabling SSL on the RDS side or using an IAM policy is sufficient; neither enforces client-side verification. Remember the mnemonic: “Client must check the cert, or the MITM will hurt.”
⚠ Common exam trap
SCS-C02 often tests the misconception that enabling encryption at rest or using an IAM policy alone secures data in transit, when in fact client-side certificate verification is required for true security.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Download the RDS CA certificate to the EC2 instance and configure the database client to use SSL and verify the certificate.
It ensures both encryption and server authentication. Downloading the RDS CA certificate (the trusted root for the RDS instance's server certificate) and configuring the client to verify it prevents man-in-the-middle attacks by confirming the RDS endpoint's identity. Simply enabling SSL without verification (as in other options) leaves the connection vulnerable to spoofing, so this is the most secure approach.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure the EC2 instance to use a self-signed certificate for SSL connections.
Why it's wrong here
A self-signed certificate on the client cannot validate the RDS server's identity, so the connection remains vulnerable to interception. It is tempting as a quick way to enable TLS, but the correct approach enforces rds.force_ssl and trusts the RDS certificate authority.
- ✗
Enable encryption at rest on the RDS instance to automatically encrypt in-transit traffic.
Why it's wrong here
Encryption at rest protects stored data and does not encrypt traffic between the EC2 instance and RDS. It is tempting because it is a genuine RDS encryption setting, but the axis is storage versus transit; the stem requires in-transit protection.
- ✓
Download the RDS CA certificate to the EC2 instance and configure the database client to use SSL and verify the certificate.
Why this is correct
Configuring the client with SSL and the downloaded RDS CA certificate enables full certificate verification, authenticating the database endpoint and preventing man-in-the-middle interception. Encryption alone without verification would leave the connection vulnerable, so this satisfies the requirement for the most secure encrypted connection.
- ✗
Create an IAM policy that requires SSL connections to the RDS endpoint.
Why it's wrong here
An IAM policy requiring SSL governs authorisation to connect, but does not itself encrypt the session or verify the server certificate. It is tempting because it enforces TLS usage, yet the mechanism is policy-based control, not transport encryption.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SCS-C02 question from scratch — 1,205 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on SCS-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company needs to encrypt data in transit between an EC2 instance and an RDS database. Which option should be used?
easy- A.Enable encryption at rest for the RDS instance
- ✓ B.Configure the database to use SSL/TLS connections
- C.Use an AWS KMS key to encrypt the connection
- D.Enable EBS encryption on the EC2 instance
Why B: Encrypting data in transit between an EC2 instance and an RDS database requires the use of SSL/TLS protocols to secure the communication channel. AWS RDS supports SSL/TLS connections by enabling the `require_secure_transport` parameter or using a certificate bundle on the client side, ensuring that all data transmitted over the network is encrypted and protected from eavesdropping or man-in-the-middle attacks.
Variation 2. A company needs to ensure that data in transit between an EC2 instance and an RDS database is encrypted. Which solution meets this requirement?
easy- A.Use a VPN connection between the VPC and the database
- B.Enable encryption at rest on the RDS instance
- ✓ C.Enable SSL/TLS on the database connection
- D.Use client-side encryption on the application
Why C: SSL/TLS is the appropriate solution to encrypt data in transit between the EC2 instance and the RDS database. It ensures that data is encrypted during transmission, preventing eavesdropping or tampering. Option A is incorrect because a VPN connection encrypts traffic between networks but is unnecessary for direct connectivity within the same VPC; SSL/TLS is more straightforward. Option B is incorrect because encryption at rest protects data stored on disk, not data in motion. Option D is incorrect because client-side encryption would require modifying the application to encrypt data before sending, which does not guarantee encryption of the entire communication channel.
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.