A company's Security department has mandated that their existing Amazon RDS for MySQL DB instance be encrypted at rest. What should a Database Specialist do to meet this requirement?

Question

Options

• AModify the database to enable encryption. Apply this setting immediately without waiting for the
• BExport the database to an Amazon S3 bucket with encryption enabled. Create a new database
• CCreate a snapshot of the database. Create an encrypted copy of the snapshot. Create a new
• DCreate a snapshot of the database. Restore the snapshot into a new database with encryption

• A
  16% (4)
• B
  4% (1)
• C
  72% (18)
• D
  8% (2)

Explanation

Encrypting an Existing RDS Instance at Rest

Option C is correct because Amazon RDS does not support enabling encryption on an existing unencrypted DB instance directly - the only supported path is to create a snapshot, create an encrypted copy of that snapshot, and then restore a new encrypted DB instance from that encrypted copy. This is the AWS-documented procedure for encrypting an existing RDS instance.

Why the distractors are wrong:

• Option A is incorrect because RDS does not allow you to simply modify an existing unencrypted instance to enable encryption - this setting cannot be changed once an instance is created.
• Option B is incorrect because exporting to S3 is not the standard migration path for this purpose and introduces unnecessary complexity and risk.
• Option D is a near-miss but is wrong because you cannot restore an unencrypted snapshot directly into an encrypted database - you must first create an encrypted copy of the snapshot, then restore from that copy.

Memory Tip: Think of it as a 3-step staircase: Snapshot → Encrypt the Copy → Restore New DB. The key distinction between C and D is that you must encrypt the snapshot copy first before restoring - you can't skip that middle step.

No community discussion yet for this question.