Q43 — AWS SAA-C03 Ch.16

Question 43 of 100 | ← Chapter 16

Q1243. A company is using a 1 TB Amazon RDS for PostgreSQL DB instance to store user data. During a security review,a security engineer sees that the DB instance is not encrypted at rest. How should a solutions architect correct this issue with the LEAST amount of downtime and no data loss?

Correct Answer: B. Create a manual DB instance snapshot and then create an encrypted copy of that snapshot. Use this snapshot to create a new encrypted DB instance. Modify the application to connect to the new DB instance.

Explanation

The company needs to encrypt an existing unencrypted Amazon RDS for PostgreSQL DB instance with minimal downtime and no data loss. Let's evaluate the options:Key Requirements:No data loss Must preserve all existing data.Least downtime Prefer solutions that avoid long outages.Encryption at rest Must enable encryption for the database.Analysis of Options:A. Modify the DB instance by using the RDS management console, and enable encryption. Apply the changes immediately.Incorrect:RDS does not support enabling encryption on an existing unencrypted DB instance directly. Encryption must be enabled at creation time.This option is not possible.B. Create a manual DB instance snapshot and then create an encrypted copy of that snapshot. Use this snapshot to create a new encrypted DB instance. Modify the application to connect to the new DB instance.Correct:Steps:Take a manual snapshot of the unencrypted RDS instance.Copy the snapshot and enable encryption during the copy process.Restore the encrypted snapshot into a new RDS instance.Update the application to point to the new encrypted DB instance. Downtime: Requires a cutover when switching to the new instance (minimal if planned carefully).No data loss: Snapshots are consistent.Works for PostgreSQL.Drawback: Requires application modification (endpoint update), but this is unavoidable when replacing the DB instance.C. Create a new encrypted DB instance and use AWS Database Migration Service (AWS DMS) to migrate the existing database to the encrypted DB instance. Once the instances are in sync, modify the application to connect to the new DB instance.Correct:Steps:Create a new encrypted RDS instance.Use AWS DMS to migrate data from the old (unencrypted) to the new (encrypted) instance. Once synced, cut over the application to the new instance. Downtime: Can be minimized with change data capture (CDC) for near-real-time sync.No data loss: DMS ensures data consistency.Works for PostgreSQL.Drawback: More complex setup than Option B (requires DMS configuration). D. Create an encrypted read replica. Once the read replica is in sync, promote it to primary. Modify the application to connect to the new primary instance.Incorrect:RDS for PostgreSQL does not support creating an encrypted read replica from an unencrypted primary instance.Encryption must be enabled on the primary instance before creating encrypted read replicas.This option is not feasible.Best Options: B vs. COption B (Snapshot + Copy + Restore) is simpler and faster for PostgreSQL. Option C (AWS DMS) is useful if continuous replication is needed (e.g., for very large databases or minimal downtime), but it's more complex.Since the question asks for least downtime and no data loss, Option B is the most straightforward and efficient method for PostgreSQL.Final Answer:B. Create a manual DB instance snapshot and then create an encrypted copy of that snapshot. Use this snapshot to create a new encrypted DB instance. Modify the application to connect to the new DB instance.Steps in Detail (Option B):Take a manual snapshot of the unencrypted RDS instance.Copy the snapshot and enable encryption:In the RDS console, select the snapshot Copy Snapshot.Check Enable Encryption and choose a KMS key.Restore the encrypted snapshot into a new RDS instance.Update the application to use the new encrypted DB endpoint.Monitor and decommission the old instance.This approach ensures no data loss and minimal downtime (just the cutover period).