A database is running on an Amazon RDS Mufti-AZ DB instance. A recent security audit found the database to be out of compliance because it was not encrypted. Which approach will resolve the encryption

Question

Options

• ALog in to the RDS console and select the encryption box to encrypt the database
• BCreate a new encrypted Amazon EBS volume and attach it to the instance
• CEncrypt the standby replica in the secondary Availability Zone and promote it to the primary
• DTake a snapshot of the RDS instance, copy and encrypt the snapshot and then restore to the new

• A
  5% (1)
• B
  14% (3)
• C
  9% (2)
• D
  73% (16)

Explanation

Encrypting an existing RDS instance cannot be done in-place - AWS requires you to take a snapshot, copy it with encryption enabled (using KMS), and restore from that encrypted snapshot to create a new encrypted instance. Option A is wrong because RDS provides no checkbox to enable encryption on a running instance after creation. Option B is wrong because RDS manages its own storage; you cannot detach and swap EBS volumes on RDS instances like you would with EC2. Option C is wrong because the standby replica in a Multi-AZ setup is always in the same encrypted state as the primary - if the primary is unencrypted, so is the standby, so promoting it changes nothing.

Memory tip: Think "Snapshot → Copy → Restore" (SCR) as the only path to encryption for an existing RDS instance - the same pattern applies whenever you need to move an unencrypted RDS database to an encrypted one, or copy it across regions/accounts.

No community discussion yet for this question.