The correct answer is that you must either create a new encrypted DB instance from the start or restore from an encrypted snapshot to enable RDS encryption at rest. This is because Amazon RDS enforces encryption at the storage layer using AWS KMS, and the encryption setting is a permanent attribute of the DB instance that cannot be changed after creation—you cannot encrypt an existing unencrypted instance, nor can you directly enable encryption on a snapshot without copying it. On the AWS Certified Security Specialty SCS-C02 exam, this concept tests your understanding of immutable encryption policies and the snapshot workflow, often appearing as a trap where candidates mistakenly think they can modify an existing instance or snapshot. A common memory tip is “encrypt at birth or restore from earth”—meaning encryption must be set at instance creation or inherited from an encrypted snapshot during a restore operation.
SCS-C02 Data Protection Practice Question
This SCS-C02 practice question tests your understanding of data protection. The scenario asks you to isolate a root cause — eliminate options that address a different problem before choosing. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
Which TWO of the following are valid methods to enforce encryption at rest for an Amazon RDS for PostgreSQL DB instance? (Choose 2.)
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Restore a DB instance from an encrypted snapshot
Options B and D are correct. You can only enable encryption at creation time or by restoring from an encrypted snapshot. Option A is wrong because you cannot encrypt an existing unencrypted instance. Option C is wrong because enabling encryption on a snapshot is not supported; you must copy it. Option E is wrong because read replicas inherit encryption settings from the source.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
Enable encryption on an existing unencrypted DB instance
Why it's wrong here
Wrong: You cannot enable encryption on an existing instance.
✓
Restore a DB instance from an encrypted snapshot
Why this is correct
Correct: The restored instance inherits encryption from the snapshot.
Related concept
Read the scenario before looking for a memorised answer.
✗
Take a snapshot of the unencrypted instance and enable encryption on the snapshot
Why it's wrong here
Wrong: You cannot enable encryption on a snapshot directly.
✗
Create an encrypted read replica and promote it
Why it's wrong here
Wrong: Read replicas cannot have different encryption settings than the source.
✓
Create a new encrypted DB instance from the start
Why this is correct
Correct: Encryption can be enabled at launch time.
Related concept
Read the scenario before looking for a memorised answer.
Common exam traps
Common exam trap: answer the scenario, not the keyword
Many certification questions include familiar terms but test a specific constraint. Read the exact wording before choosing an answer that is generally true but wrong for this case.
Detailed technical explanation
How to think about this question
This question should be treated as a scenario, not a definition check. Identify the problem, the constraint and the best action. Then compare each option against those facts.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
Use explanations to understand the rule behind the answer.
TExam Day Tips
→Underline the problem statement mentally.
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A cloud solutions architect for a retail company is evaluating services for a new workload. The correct answer here reflects best practice for the specific scenario described — not a general cloud recommendation. Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option. Cloud exam questions reward reading the constraint carefully: the same technology can be right or wrong depending on the use case.
What to study next
Got this wrong? Here's your next step.
Identify which SCS-C02 exam domain this question belongs to, then review the specific concept being tested. Practise related questions in that domain and focus on understanding why each wrong answer is tempting — not just why the correct answer is right.
Data Protection — This question tests Data Protection — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Restore a DB instance from an encrypted snapshot — Options B and D are correct. You can only enable encryption at creation time or by restoring from an encrypted snapshot. Option A is wrong because you cannot encrypt an existing unencrypted instance. Option C is wrong because enabling encryption on a snapshot is not supported; you must copy it. Option E is wrong because read replicas inherit encryption settings from the source.
What should I do if I get this SCS-C02 question wrong?
Identify which SCS-C02 exam domain this question belongs to, then review the specific concept being tested. Practise related questions in that domain and focus on understanding why each wrong answer is tempting — not just why the correct answer is right.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A security engineer is designing a data protection strategy for Amazon RDS for PostgreSQL. The database contains sensitive personal information. Which TWO actions should the engineer take to protect the data at rest? (Choose TWO.)
medium
✓ A.Enable encryption at rest for the RDS instance using AWS KMS.
B.Enable SSL/TLS for connections to the database.
C.Delete automated backups after 30 days.
✓ D.Enable encryption for automated backups using the same KMS key.
E.Enable deletion protection for the RDS instance.
Why A: Enabling encryption at rest for RDS (Option A) and enabling automated backups with encryption (Option D) ensure data at rest is encrypted. Deleting backups (Option B) does not protect data at rest. Enabling encryption in transit (Option C) protects data in motion. Enabling deletion protection (Option E) prevents accidental deletion but does not encrypt data.
Variation 2. A security engineer is designing a solution to protect sensitive data in an Amazon RDS for MySQL database. The data must be encrypted at rest using a key stored in AWS KMS. Additionally, the database must support automated backups and cross-region disaster recovery. Which architecture meets these requirements?
hard
A.Launch an unencrypted RDS instance, then use AWS DMS to replicate data to an encrypted instance in another region.
B.Launch an unencrypted RDS instance, then enable encryption using the AWS Console after creation.
C.Launch an encrypted RDS instance using the default KMS key, then export the database to S3 and copy to another region.
✓ D.Launch an encrypted RDS instance using a customer-managed KMS key. Enable automated backups and create a cross-region read replica.
Why D: Option B is correct because enabling encryption at rest for RDS automatically encrypts snapshots and backups, and cross-region read replicas can be created from an encrypted source. Option A is wrong because encrypting after creation is not directly supported; you would need to create a new encrypted instance. Option C is wrong because RDS does not support different KMS keys for the replica; it must use the same key or a replica key in the destination region. Option D is wrong because enabling encryption after creation is not supported without creating a new instance.
Variation 3. A security engineer needs to ensure that data at rest in an Amazon RDS for PostgreSQL DB instance is encrypted. Which action should the engineer take?
easy
A.Grant the rds:ModifyDBInstance permission to allow encryption toggling.
B.Modify the existing unencrypted DB instance to enable encryption.
C.Enable encryption automatically by enabling automated backups.
✓ D.Create a new DB instance with encryption enabled using the AWS CLI or Console.
Why D: Option A is correct because RDS encryption at rest is enabled by specifying the --storage-encrypted flag during creation. Option B is wrong because encryption can only be enabled at creation time; existing unencrypted instances cannot be encrypted without migration. Option C is wrong because encryption at rest is not enabled by default. Option D is wrong because encryption at rest is independent of KMS key permissions.
Variation 4. A security engineer needs to ensure that an Amazon RDS for MySQL database is encrypted at rest. Which action should be taken?
easy
A.Use a client-side encryption tool to encrypt data before writing to the database.
B.Use AWS KMS to encrypt individual databases within the instance.
C.Enable encryption on an existing unencrypted DB instance.
✓ D.Create a new DB instance with encryption enabled.
Why D: Option B is correct because enabling encryption on the DB instance at creation time encrypts the database at rest. Option A is incorrect because encryption cannot be enabled on an existing unencrypted DB instance. Option C is incorrect because encryption is not applied per database. Option D is incorrect because RDS encryption does not require a client-side tool.
Variation 5. A security engineer is troubleshooting an issue where an Amazon RDS for MySQL DB instance is not encrypting data at rest. The DB instance was created without encryption. The engineer needs to enable encryption without significant downtime. What is the MOST effective approach?
hard
A.Take a snapshot of the DB instance and enable encryption on the snapshot
✓ B.Take a snapshot, copy it with encryption enabled, and restore a new DB instance from the encrypted snapshot
C.Modify the DB instance and enable encryption in the console
D.Create a read replica with encryption and promote it
Why B: Option D is correct because the only way to enable encryption on an unencrypted RDS instance is to create a snapshot, copy it with encryption, and restore a new encrypted instance. Option A is wrong because RDS does not support enabling encryption on existing instances. Option B is wrong because modifying the DB instance does not allow encryption. Option C is wrong because you cannot enable encryption on a snapshot; you must copy it.
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.