CV0-004 Deployment Practice Question
A cloud engineer is deploying a three-tier web application using AWS CloudFormation. The application requires a relational database that must be encrypted at rest and support automated backups. The engineer wants to minimize management overhead. Which AWS CloudFormation resource should be used for the database tier?
⚠ Common exam trap
The trap here is assuming that any encrypted storage or backup-capable service can serve as the database tier, overlooking the need for a managed relational database.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS::RDS::DBInstance with the Engine property set to mysql and StorageEncrypted set to true
The AWS::RDS::DBInstance resource is designed for managed relational databases, offering encryption at rest via StorageEncrypted and automated backups. It reduces operational burden by handling patching, backups, and replication. The other options either require manual management, use a non-relational engine, or provide caching rather than a primary database.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
AWS::RDS::DBInstance with the Engine property set to mysql and StorageEncrypted set to true
Why this is correct
AWS::RDS::DBInstance is the correct resource for deploying a managed relational database. Setting StorageEncrypted to true ensures encryption at rest, and RDS automatically handles backups and patching, minimizing management overhead. This matches the requirements exactly and is the standard way to provision RDS via CloudFormation.
- ✗
AWS::ElastiCache::CacheCluster with the Engine property set to redis and automatic backups enabled
Why it's wrong here
ElastiCache is an in-memory caching service, not a durable relational database. It does not provide persistent storage for the primary database tier. While it can improve performance, it cannot replace a relational database. The scenario requires a database that supports encryption at rest and automated backups, which ElastiCache does not fulfill.
- ✗
AWS::EC2::Instance with a MySQL AMI and an EBS volume encrypted using AWS::EC2::Volume
Why it's wrong here
This approach requires managing the database on an EC2 instance, including OS patching, backups, and replication, which increases management overhead. While EBS encryption is possible, it does not provide automated backups or the managed features of RDS. It fails the requirement to minimize management overhead.
- ✗
AWS::DynamoDB::Table with the SSESpecification property and point-in-time recovery enabled
Why it's wrong here
DynamoDB is a NoSQL database and not suitable for a traditional relational three-tier application that likely uses SQL. Although it supports encryption and backups, the data model and query capabilities differ significantly. Using DynamoDB would require application changes and is not the correct choice for a relational database tier.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 834 original CV0-004 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CompTIA exam blueprint
This CV0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CV0-004 exam.