A financial company wants to store sensitive user data in an Amazon Aurora PostgreSQL DB cluster. The database will be accessed by multiple applications across the company. The company has mandated…

Question

Options

• ASet the rds.force_ssl=0 parameter in DB parameter groups. Download and use the Amazon RDS
• BSet the rds.force_ssl=1 parameter in DB parameter groups. Download and use the Amazon RDS
• CSet the rds.force_ssl=0 parameter in DB parameter groups. Download and use the Amazon RDS
• DSet the rds.force_ssl=1 parameter in DB parameter groups. Download and use the Amazon RDS

• A
  15% (6)
• B
  7% (3)
• C
  5% (2)
• D
  73% (30)

Explanation

Explanation

Setting rds.force_ssl=1 in the DB parameter group is the critical configuration that enforces SSL/TLS for all connections, automatically rejecting any non-SSL connection attempts to the Aurora PostgreSQL cluster. Option D combines this enforced SSL setting with downloading and using the Amazon RDS Certificate Authority (CA) certificate bundle, which allows clients to validate the server's identity - satisfying both requirements of encryption and server identity validation.

Why the distractors are wrong:

• Options A and C use rds.force_ssl=0, which means SSL is available but not enforced - non-SSL connections would still be permitted, directly violating the requirement to disallow non-SSL access.
• Options B and C likely reference an incorrect certificate usage or connection method that does not properly enable server identity validation (e.g., using SSL without certificate verification), meaning encryption may exist but the server cannot be authenticated.

Memory Tip: Think of force_ssl=1 as flipping the "mandatory" switch - 1 = ON = forced. Pair this with the RDS CA certificate download to remember the two-part requirement: enforce the connection AND verify who you're connecting to. If either piece is missing, the solution is incomplete.

No community discussion yet for this question.