A banking company is currently using Amazon Redshift for sensitive data. An audit found that the current cluster is unencrypted. Compliance requires that a database with sensitive data must be…

Question

Options

• ACreate a new HSM-encrypted Amazon Redshift cluster and migrate the data to the new cluster.
• BModify the DB parameter group with the appropriate encryption settings and then restart the cluster.
• CEnable HSM encryption in Amazon Redshift using the command line.
• DModify the Amazon Redshift cluster from the console and enable encryption using the HSM option.

• A
  75% (21)
• B
  14% (4)
• C
  4% (1)
• D
  7% (2)

Explanation

Amazon Redshift does not support enabling encryption on an existing unencrypted cluster in place. Encryption is set at cluster creation time and cannot be toggled on a running cluster. The only supported path to achieve HSM encryption on an existing cluster is to create a new cluster with HSM encryption enabled and migrate the data to it. Option B is incorrect because Redshift encryption is not a parameter group setting - there is no DB parameter for enabling HSM encryption. Option C is misleading: while the AWS CLI can be used to create an encrypted cluster, you still cannot enable encryption on an already-running unencrypted cluster via CLI. Option D is similarly incorrect for the same reason - the console does not offer an option to enable encryption on an existing Redshift cluster.

No community discussion yet for this question.