A healthcare company stores personally identifiable information (PII) data in an Amazon RDS for Oracle database. The company must encrypt the PII data at rest. The company must use dedicated…

Question

Options

• AUse AWS Key Management Service (AWS KMS) to configure encryption for the RDS database.
• BUse AWS CloudHSM backed AWS KMS keys to configure transparent encryption for the RDS
• CUse Amazon EC2 instance store encryption to encrypt database volumes by using AWS
• DConfigure RDS snapshots and use server-side encryption with Amazon S3 managed keys (SSE-

• A
  6% (2)
• B
  77% (24)
• C
  13% (4)
• D
  3% (1)

Explanation

Amazon RDS supports encryption at rest by using AWS KMS keys backed by AWS CloudHSM. This allows use of dedicated FIPS 140-2 Level 3 validated hardware modules to manage encryption keys, meeting compliance for sensitive data such as PII. "You can use AWS KMS with keys that are backed by AWS CloudHSM to control the encryption of RDS databases. This provides dedicated HSM-backed key storage and management." Why B is correct: Meets the requirement for dedicated HSM hardware. Fully integrates with RDS for transparent encryption at rest. Satisfies compliance standards for healthcare and regulated data. Why others are incorrect: A: Keys in CloudHSM directly are not used by RDS; they must be managed through KMS C: EC2 instance stores are ephemeral, not suitable for RDS databases. D: SSE-S3 applies to S3 objects, not databases.

No community discussion yet for this question.