Exam AWS Certified Database - Specialty All Questions

View all questions & answers for the AWS Certified Database - Specialty exam

Exam AWS Certified Database - Specialty topic 1 question 299 discussion

Exam question from Amazon's AWS Certified Database - Specialty

Question #: 299
Topic #: 1

[All AWS Certified Database - Specialty Questions]

A company is using an Amazon Aurora PostgreSQL DB cluster for a project. A database specialist must ensure that the database is encrypted at rest. The database size is 500 GB.

What is the FASTEST way to secure the data through encryption at rest in the DB cluster?

A. Take a manual snapshot of the unencrypted DB cluster. Create an encrypted copy of that snapshot in the same AWS Region as the unencrypted snapshot. Restore a DB cluster from the encrypted snapshot.
B. Create an AWS Key Management Service (AWS KMS) key in the same AWS Region and create a new encrypted Aurora cluster using this key.
C. Take a manual snapshot of the unencrypted DB cluster. Restore the unencrypted snapshot to a new encrypted Aurora PostgreSQL DB cluster.
D. Create a new encrypted Aurora PostgreSQL DB cluster. Use AWS Database Migration Service (AWS DMS) to migrate the data from the unencrypted DB cluster to the encrypted DB cluster.

Show Suggested Answer

Suggested Answer: C 🗳️

by rdiaz at March 26, 2023, 5:05 p.m.

Disclaimers:

- ExamTopics website is not related to, affiliated with, endorsed or authorized by Amazon.
- Trademarks, certification & product names are used for reference only and belong to Amazon.

Comments

Submit Cancel

MultiAZ

1 year, 5 months ago

Selected Answer: C

C Aurora allows you to create encrypted DB out of unencrypted snapshot (this is not true for regular RDS, where A would be the right answer)

upvoted 2 times

...

zanhsieh

1 year, 10 months ago

Selected Answer: C

C. After try-n-error in the AWS RDS Snapshot console, got this (make sure the Engine column must be Aurora PostgreSQL): unencrypted snapshot -> encrypted snapshot unencrypted snapshot -> restore to encrypted instance encrypted snapshot -> restore to encrypted instance encrypted snapshot -> change key -> encrypted snapshot A: No. I can't find any way in console that cp and encrypt a snapshot but marked as unencrypted. BTW, I can't unencrypted an encrypted snapshot in RDS Snapshot console. I even tried clear out the key ARN field then copy, but it will go back to whatever key it originally has after copy. No comment / test on RDS non-Aurora snapshot cycle since the question scope doesn't cover.

upvoted 1 times

...

rn30

1 year, 10 months ago

C https://repost.aws/knowledge-center/encrypt-rds-snapshots Important: If you use Amazon Aurora, you can restore an unencrypted Aurora DB cluster snapshot to an encrypted Aurora DB cluster. However, you must specify an AWS Key Management Service (AWS KMS) encryption key when you restore from the unencrypted DB cluster snapshot.

upvoted 2 times

...

Windy

1 year, 10 months ago

It's C.

upvoted 1 times

...

Kodoma

2 years ago

Selected Answer: C

You cannot restore an unecrypted DB cluster from an encrypted snapshot.

upvoted 1 times

...

clarksu

2 years, 1 month ago

Selected Answer: A

concur with Mintwater.

upvoted 1 times

clarksu

2 years, 1 month ago

After review, I changed my mind to support C For Aurora Cluster : https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/Overview.Encryption.html You can't convert an unencrypted DB cluster to an encrypted one. However, you can restore an unencrypted snapshot to an encrypted Aurora DB cluster. To do this, specify a KMS key when you restore from the unencrypted snapshot.

upvoted 1 times

...

mbadioum

2 years, 1 month ago

A is the best response https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Overview.Encryption.html#Overview.Encryption.Limitations

upvoted 3 times

fufufu

2 years, 1 month ago

It's RDS and this problem is Aurora. C is correct for Aurora.

upvoted 1 times

...

Mintwater

2 years, 2 months ago

A - A. Take a manual snapshot of the unencrypted DB cluster. Create an encrypted copy of that snapshot in the same AWS Region as the unencrypted snapshot. Restore a DB cluster from the encrypted snapshot. Limitations of Amazon RDS encrypted DB instances The following limitations exist for Amazon RDS encrypted DB instances: You can only encrypt an Amazon RDS DB instance when you create it, not after the DB instance is created. However, because you can encrypt a copy of an unencrypted snapshot, you can effectively add encryption to an unencrypted DB instance. That is, you can create a snapshot of your DB instance, and then create an encrypted copy of that snapshot. You can then restore a DB instance from the encrypted snapshot, and thus you have an encrypted copy of your original DB instance. For more information, see Copying a DB snapshot. https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Overview.Encryption.html#Overview.Encryption.Limitations

upvoted 1 times

fufufu

2 years, 1 month ago

It's RDS and this problem is Aurora. C is correct for Aurora.

upvoted 2 times

...

Mintwater

2 years, 2 months ago

to create a manual snapshot (unencrypted) => create another encrypted copy of that unencrypted snapshot ==> restore the encrypted snapshot to the new encrypted instance

upvoted 1 times

...

rdiaz

2 years, 2 months ago

Selected Answer: C

You can't convert an unencrypted DB cluster to an encrypted one. However, you can restore an unencrypted snapshot to an encrypted Aurora DB cluster. To do this, specify a KMS key when you restore from the unencrypted snapshot. https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/Overview.Encryption.html

upvoted 2 times

Mintwater

2 years, 2 months ago

agree C

upvoted 1 times

Mintwater

2 years, 2 months ago

Not B: You can't create an encrypted Aurora Replica from an unencrypted Aurora DB cluster. You can't create an unencrypted Aurora Replica from an encrypted Aurora DB cluster.

upvoted 1 times

...