Domain 1.3: Data Security — AWS SAA-C03 Practice Question 18

How to approach this question

Remember the snapshot-copy-restore pattern for RDS encryption.

Full Answer

B.Take a snapshot of the unencrypted database, copy the snapshot and enable encryption, then restore a new DB instance from the encrypted snapshot.✓ Correct

You can only enable encryption for an Amazon RDS DB instance when you create it, not after. To encrypt an existing unencrypted instance, you must create a snapshot, copy that snapshot (specifying a KMS key to encrypt the copy), and then restore the encrypted snapshot to a new instance.

Common mistakes

Believing you can just modify the instance to turn on encryption.

A company has an unencrypted Amazon RDS for PostgreSQL database. The security team mandates that the database must be encrypted at rest using AWS KMS.<br/><br/>What is the MOST operationally efficient way to encrypt the existing database?

How to approach this question

Full Answer

Common mistakes

Practice the full AWS SAA-C03 Practice Exam 6

More questions from this exam