nerdexam
Amazon

DBS-C01 · Question #314

A company is using a 1 TB Amazon RDS for PostgreSQL DB instance to store user data. During a security review, a security engineer sees that the DB instance is not encrypted at rest. How should a…

The correct answer is C. Create a new encrypted DB instance and use AWS Database Migration Service (AWS DMS) to. To enable encryption at rest for an unencrypted 1TB Amazon RDS PostgreSQL instance with the least downtime and no data loss, create a new encrypted instance and migrate data using AWS DMS.

Submitted by andres_qro· Mar 6, 2026Database Security

Question

A company is using a 1 TB Amazon RDS for PostgreSQL DB instance to store user data. During a security review, a security engineer sees that the DB instance is not encrypted at rest. How should a database specialist correct this issue with the LEAST amount of downtime and no data loss?

Options

  • AModify the DB instance by using the RDS management console, and enable encryption. Apply
  • BCreate a manual DB instance snapshot and then create an encrypted copy of that snapshot. Use
  • CCreate a new encrypted DB instance and use AWS Database Migration Service (AWS DMS) to
  • DCreate an encrypted read replica. Once the read replica is in sync, promote it to primary. Modify

How the community answered

(26 responses)
  • A
    8% (2)
  • B
    15% (4)
  • C
    42% (11)
  • D
    35% (9)

Why each option

To enable encryption at rest for an unencrypted 1TB Amazon RDS PostgreSQL instance with the least downtime and no data loss, create a new encrypted instance and migrate data using AWS DMS.

AModify the DB instance by using the RDS management console, and enable encryption. Apply

Modifying an existing unencrypted RDS instance to enable encryption at rest is not directly supported; encryption can only be specified when creating a new instance or by restoring from an encrypted snapshot.

BCreate a manual DB instance snapshot and then create an encrypted copy of that snapshot. Use

While creating an encrypted copy of a snapshot is the standard method to encrypt an unencrypted RDS instance, restoring a 1 TB database from a snapshot can take a significant amount of time, resulting in considerable downtime which does not meet the "least amount of downtime" requirement.

CCreate a new encrypted DB instance and use AWS Database Migration Service (AWS DMS) toCorrect

Creating a new encrypted DB instance and using AWS Database Migration Service (AWS DMS) allows for a live migration of data from the unencrypted source to the encrypted target with minimal downtime. DMS can perform a full load and then continuous change data capture (CDC), enabling a cutover with very little application interruption.

DCreate an encrypted read replica. Once the read replica is in sync, promote it to primary. Modify

An encrypted read replica can be created from an unencrypted primary, but promoting an encrypted read replica to be the new primary from an unencrypted source doesn't encrypt the original primary database, and this method usually entails some downtime.

Concept tested: RDS encryption at rest for existing instances

Source: https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Overview.Encryption.html#Overview.Encryption.EncryptExisting

Topics

#RDS PostgreSQL#encryption at rest#downtime reduction#data security

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full DBS-C01 Practice