A company needs to deploy a new workload on AWS. The company must encrypt all data at rest and must rotate the encryption keys once each year. The workload uses an Amazon RDS for MySQL Multi- AZ…

Question

Options

• AEnable Transparent Data Encryption (TDE) in the MySQL configuration file.
• BEnable RDS encryption on the database at creation time by using the AWS managed key for
• CCreate a new AWS Key Management Service (AWS KMS) customer managed key.
• DCreate a new AWS Key Management Service (AWS KMS) customer managed key.

• A
  3% (1)
• B
  15% (5)
• C
  73% (24)
• D
  9% (3)

Explanation

Option C is correct because AWS KMS customer managed keys (CMKs) are the only key type that allows you to configure automatic annual rotation - you enable key rotation on the CMK, and AWS rotates it every 365 days. You then use this CMK when enabling RDS encryption at database creation, satisfying both the at-rest encryption and annual rotation requirements.

Why the distractors fail:

• A is wrong because TDE (Transparent Data Encryption) via a MySQL config file applies to on-premises MySQL - you cannot directly edit RDS MySQL configuration files, and RDS uses KMS-based encryption, not native MySQL TDE.
• B is wrong because AWS managed keys rotate automatically only every 3 years, not annually - you have no control over their rotation schedule, so this fails the "once each year" requirement.
• D appears identical to C (likely a truncated distractor in the source); in real exams, the distinction is usually that D describes a CMK without enabling rotation, which would miss the annual rotation requirement.

Memory tip: Think "Customer Control = Customizable rotation" - only Customer managed keys let you set the rotation schedule. AWS managed keys are on AWS's timetable (3 years), not yours.

No community discussion yet for this question.