A company hosts a database on an Amazon RDS Multi-AZ DB instance. The database is not encrypted. The company's new security policy requires all AWS resources to be encrypted at rest and in transit…

The correct answer is D. Take a snapshot of the DB instance. Amazon RDS does not allow enabling encryption on an existing, unencrypted DB instance. To comply with the new security policy, you must create a new encrypted DB instance. The process involves taking a snapshot of the existing DB instance, copying the snapshot with encryption…

Submitted by thandi_sa· Mar 30, 2026Security and Compliance

Question

A company hosts a database on an Amazon RDS Multi-AZ DB instance. The database is not encrypted. The company's new security policy requires all AWS resources to be encrypted at rest and in transit. What should a SysOps administrator do to encrypt the database?

Options

AConfigure encryption on the existing DB instance.
BTake a snapshot of the DB instance.
CEncrypt the standby replica in a secondary Availability Zone.
DTake a snapshot of the DB instance.

How the community answered

(35 responses)

A
3% (1)
B
14% (5)
C
6% (2)
D
77% (27)

Explanation

Amazon RDS does not allow enabling encryption on an existing, unencrypted DB instance. To comply with the new security policy, you must create a new encrypted DB instance. The process involves taking a snapshot of the existing DB instance, copying the snapshot with encryption enabled, and then restoring the encrypted snapshot to create a new, encrypted DB instance. This approach meets the requirement of encrypting the database at rest.

Topics

#RDS encryption at rest#snapshot copy#Multi-AZ#encryption migration

Community Discussion

No community discussion yet for this question.

Full SOA-C02 Practice