CloudGuild · Blog · Cheat sheets · Lessons · Certifications
AWS Certified Security - Specialty Exam Question Walkthrough: RDS Backup Encryption
Understand a key exam question on RDS backup encryption and learn how to tackle AWS Certified Security - Specialty questions effectively.
Migrating databases to Amazon RDS is common, but ensuring data security during backups can trip candidates up. The exam tests your knowledge of AWS services and their configurations, especially around data protection.
The question
A company is migrating its on-premises database to Amazon RDS and needs to ensure that all backups are encrypted. What is the best approach to achieve this?
- A. Enable automated backups and specify the use of AWS KMS for encryption.
- B. Back up the database to an S3 bucket and enable server-side encryption.
- C. Use Amazon S3 lifecycle policies to manage backup encryption.
- D. Manually encrypt backups using a third-party tool before uploading.
Think before you scroll
Consider how Amazon RDS handles backups. AWS KMS plays a crucial role in securing data at rest. Each option presents a different method of ensuring encryption. Focus on the one that integrates best with RDS’s automated processes.
The answer
The correct option is A: Enable automated backups and specify the use of AWS KMS for encryption. This method ensures that all backups are automatically encrypted without requiring additional steps from the user. It leverages AWS services designed to work together seamlessly, making it the best choice.
Why the other options lose
- B. Back up the database to an S3 bucket and enable server-side encryption. This option does not represent the primary backup method for RDS. RDS automated backups are designed to work within the service, not by backing up to S3. Thus, it doesn't meet the requirement for RDS.
- C. Use Amazon S3 lifecycle policies to manage backup encryption. This option is not applicable to RDS backup management. Lifecycle policies are more relevant to managing S3 objects, not the automated backups created by RDS.
- D. Manually encrypt backups using a third-party tool before uploading. While this could technically achieve encryption, it introduces unnecessary complexity. RDS automated backups with AWS KMS is a simpler and more effective approach.
The concept behind it
The key principle here is understanding how AWS services integrate for data protection. Automated backups in RDS can utilize AWS KMS for encryption, ensuring that backups are protected without additional manual processes. Recognizing this integration is vital for similar questions on the exam.
Exam trap to remember
Always choose options that align with the service’s built-in features. Automated processes typically require less manual intervention and are designed to work optimally with AWS services.