AWS Certified SysOps Administrator - Associate SOA-C02 — Topic 1 Question 209

Question

A company needs to deploy a new workload on AWS. The company must encrypt all data at rest and must rotate the encryption keys once each year. The workload uses an Amazon RDS for MySQL Multi-AZ database for data storage. Which configuration approach will meet these requirements?

Accepted Answer

Correct answer: C. The correct answer is C. Option C: Create a new AWS Key Management Service (AWS KMS) customer managed key. Enable automatic key rotation. Enable RDS encryption on the database at creation time by using the KMS key. Amazon RDS is a managed relational database that handles patching, backups and failover. AWS KMS manages encryption keys and integrates with most AWS services for encryption at rest. By spanning multiple Availability Zones / adding redundancy, this option provides the high availability and resilience required.

AWS Certified SysOps Administrator - Associate SOA-C02 — Question 209