awscluoudops eng associate question clarification

[LR1]

Section-Based – Security and Compliance (CloudOps)
Q6 – An online banking system will be deployed to AWS which will be utilizing an Auto Scaling group of EC2 instances, an Application Load Balancer, and an RDS instance. To secure the personal data of the clients, you need to enable encryption for the DB instance.

Which of the following are incorrect statements regarding an Amazon RDS encrypted DB instance? (Select TWO.)

The option that says: You can only enable encryption for an Amazon RDS DB instance when you create it, not after the DB instance is created is incorrect because encryption for an RDS instance can only be enabled upon the creation of the instance. If you want to enable encryption for the RDS instance, you need to create a snapshot and create an encrypted
copy of the snapshot before restoring the instance.

Sounds a bit contradictory,ca n you please explain?

[JR-TutorialsDojo]

Hello LR1,

Thank you for raising this point. To clarify: encryption for an RDS instance can only be enabled at the time of creation. You cannot simply switch on encryption for an already running DB instance. The snapshot workaround is a migration path. You take a snapshot of the unencrypted DB, create an encrypted copy of that snapshot, and then restore a new encrypted DB instance from it. This does not change the existing DB. It only creates a new encrypted one.

So, that option is actually a correct statement. I hope this clears up the contradiction and helps you confidently identify the right answers.

Best regards,
JR @ Tutorials Dojo