Q87 — AWS SAA-C03 Ch.15

Question 87 of 100 | ← Chapter 15

Q1187. A company is running a blogging platform.A security audit determines that the Amazon RDS DB instance that is used by the platform is not configured to encrypt the data at rest. The company must encrypt the DB instance within 30 days.What should a solutions architect do to meet this requirement with the LEAST amount of downtime?

• A. Create a read replica of the DB instance,and enable encryption. When the read replica is available, promote the read replica and update the endpoint that is used by the application. Delete the unencrypted DB instance.
• B. Take a snapshot of the DB instance. Make an encrypted copy of the snapshot. Restore the encrypted snapshot. When the new DB instance is available, update the endpoint that is used by the application.Delete the unencrypted DB instance. ✓
• C. Create a new encrypted DB instance.Perform an initial data load,and set up logical replication between the two DB instances. When the new DB instance is in sync with the source DB instance, update the endpoint that is used by the application.Delete the unencrypted DB instance.
• D. Convert the DB instance to an Amazon Aurora DB cluster, and enable encryption. When the DB cluster is available, update the endpoint that is used by the application to the cluster endpoint. Delete the unencrypted DB instance.

Correct Answer: B. Take a snapshot of the DB instance. Make an encrypted copy of the snapshot. Restore the encrypted snapshot. When the new DB instance is available, update the endpoint that is used by the application.Delete the unencrypted DB instance.

Explanation

To meet the requirement of encrypting an Amazon RDS DB instance used by a blogging platform with the least amount of downtime, the best solution is B. Take a snapshot of the DB instance. Make an encrypted copy of the snapshot. Restore the encrypted snapshot. When the new DB instance is available, update the endpoint that is used by the application. Delete the unencrypted DB instance.Analysis of Options:Option A: Create a read replica of the DB instance, and enable encryption. When the read replica is available, promote the read replica and update the endpoint that is used by the application. Delete the unencrypted DB instance.Limitation: While creating a read replica is a valid approach for certain scenarios, RDS does not support enabling encryption on an existing read replica. Encryption must be enabled when the read replica is created, which means you would need to create a new encrypted read replica from scratch. However, this still involves a process similar to taking a snapshot and restoring, and the read replica approach might not be the most straightforward for this specific requirement. Option B: Take a snapshot of the DB instance. Make an encrypted copy of the snapshot. Restore the encrypted snapshot. When the new DB instance is available, update the endpoint that is used by the application. Delete the unencrypted DB instance.Advantage: This solution involves taking a snapshot of the unencrypted DB instance, creating an encrypted copy of the snapshot, and then restoring the encrypted snapshot to a new DB instance. This process can be done with minimal downtime because the snapshot can be taken while the DB instance is running, and the restore process can be initiated once the encrypted snapshot is ready. Once the new encrypted DB instance is available, you can update the application endpoint to point to the new instance and delete the unencrypted one. This approach is efficient and ensures that the data is encrypted with minimal disruption to the application.Option C: Create a new encrypted DB instance. Perform an initial data load, and set up logical replication between the two DB instances. When the new DB instance is in sync with the source DB instance, update the endpoint that is used by the application. Delete the unencrypted DB instance. Limitation: This solution involves setting up logical replication between the unencrypted and encrypted DB instances, which can be complex and time-consuming. It also requires careful synchronization to ensure that no data is lost during the transition. This approach introduces additional complexity and potential risks compared to the snapshot and restore method.Option D: Convert the DB instance to an Amazon Aurora DB cluster, and enable encryption. When the DB cluster is available, update the endpoint that is used by the application to the cluster endpoint. Delete the unencrypted DB instance.Limitation: While converting to Amazon Aurora can provide benefits such as improved performance and scalability, it is not necessary for the specific requirement of encrypting the data at rest. Additionally, converting to Aurora involves a more complex migration process and may not be the most straightforward solution for minimizing downtime.Conclusion:B. Take a snapshot of the DB instance. Make an encrypted copy of the snapshot. Restore the encrypted snapshot. When the new DB instance is available, update the endpoint that is used by the application. Delete the unencrypted DB instance. is the best solution to meet the requirement with the least amount of downtime. It is efficient, straightforward, and ensures that the data is encrypted without significant disruption to the application.