A Database Specialist migrated an existing production MySQL database from on-premises to an Amazon RDS for MySQL DB instance. However, after the migration, the database needed to be encrypted at rest

Question

Options

• ACreate a snapshot of the unencrypted RDS DB instance. Create an encrypted copy of the
• BModify the RDS DB instance. Enable the AWS KMS encryption option that leverages the AWS
• CRestore an unencrypted snapshot into a MySQL RDS DB instance that is encrypted.
• DCreate an encrypted read replica of the RDS DB instance. Promote it the master.

• A
  74% (34)
• B
  9% (4)
• C
  2% (1)
• D
  15% (7)

Explanation

Explanation

Option A is correct because AWS allows you to create a snapshot of an unencrypted RDS instance and then create an encrypted copy of that snapshot using AWS KMS - restoring that encrypted snapshot then produces a fully encrypted RDS instance, avoiding the need to reload data entirely. Option B is wrong because RDS does not support enabling encryption on an existing unencrypted instance via a simple modification - encryption must be set at creation time and cannot be toggled afterward. Option C is incorrect because restoring an unencrypted snapshot into an RDS instance does not automatically encrypt it; you must explicitly create an encrypted copy of the snapshot first before restoring. Option D is a common trap - while read replicas can be encrypted, you cannot create an encrypted read replica from an unencrypted master instance in RDS.

Memory Tip

Remember the encryption workflow as "Snap → Copy (encrypt) → Restore": you can never directly encrypt an existing RDS instance or its snapshots in place, but you can encrypt a copy of a snapshot. Think of it as making a "secure photocopy" of the original.

No community discussion yet for this question.