Q5 — AWS SAA-C03 Ch.16

Question 5 of 100 | ← Chapter 16

Q1205. A company uses Amazon RDS for MySQL as a database engine for its applications. A recent security audit revealed an RDS instance that is not compliant with company policy for encrypting data at rest. A solutions architect at the company needs to ensure that all existing RDS databases are encrypted using server-side encryption and that any future deviations from the policy are detected.Which combination of steps should the solutions architect take to accomplish this?(Select TWO.)

• A. Create an AWS Config rule to detect the creation of unencrypted RDS databases. Create an Amazon EventBridge rule to trigger on the AWS Config rules compliance state change and use Amazon Simple Notification Service (Amazon SNS) to notify the security operations team. ✓
• B. Use AWS Systems Manager State Manager to detect RDS database encryption configuration drift.Create an Amazon EventBridge rule to track state changes and use Amazon Simple Notification Service (Amazon SNS) to notify the security operations team.
• C. Create a read replica for the existing unencrypted RDS database and enable replica encryption in the process. Once the replica becomes active,promote it into a standalone database instance and terminate the unencrypted database instance.
• D. Take a snapshot of the unencrypted RDS database. Copy the snapshot and enable snapshot encryption in the process.Restore the database instance from the newly created encrypted snapshot.Terminate the unencrypted database instance. ✓
• E. Enable encryption for the identified unencrypted RDS instance by changing the configurations of the existing database

Correct Answer: A. Create an AWS Config rule to detect the creation of unencrypted RDS databases. Create an Amazon EventBridge rule to trigger on the AWS Config rules compliance state change and use Amazon Simple Notification Service (Amazon SNS) to notify the security operations team., D. Take a snapshot of the unencrypted RDS database. Copy the snapshot and enable snapshot encryption in the process.Restore the database instance from the newly created encrypted snapshot.Terminate the unencrypted database instance.

Explanation

To ensure that all existing Amazon RDS for MySQL databases are encrypted using server-side encryption and that any future deviations from the policy are detected, the solutions architect should take the following combination of steps:A. Create an AWS Config rule to detect the creation of unencrypted RDS databases. Create an Amazon EventBridge rule to trigger on the AWS Config rules compliance state change and use Amazon Simple Notification Service (Amazon SNS) to notify the security operations team.D. Take a snapshot of the unencrypted RDS database. Copy the snapshot and enable snapshot encryption in the process. Restore the database instance from the newly created encrypted snapshot. Terminate the unencrypted database instance.Analysis:Step A: AWS Config and EventBridge for Compliance Monitoring AWS Config Rule: AWS Config allows you to assess, audit, and evaluate the configurations of your AWS resources. By creating a custom AWS Config rule, you can detect the creation of unencrypted RDS databases. This rule will evaluate the configuration of each RDS instance and flag any that are not encrypted.Amazon EventBridge and SNS for Notifications: Amazon EventBridge can be used to trigger actions based on changes in the AWS Config rule's compliance state. When an unencrypted RDS database is detected, EventBridge can trigger an SNS notification to the security operations team, ensuring that they are aware of the policy violation and can take appropriate action.Step D: Encrypting Existing Unencrypted RDS DatabasesSnapshot and Restore with Encryption: To encrypt an existing unencrypted RDS database, you can take a snapshot of the database, copy the snapshot, and enable encryption during the copy process. Once the encrypted snapshot is created, you can restore the database instance from this snapshot. This will result in a new, encrypted database instance that can be used in place of the unencrypted one. Termination of Unencrypted Instance: After verifying that the encrypted database instance is functioning correctly, you should terminate the unencrypted database instance to ensure that all data is encrypted and to comply with company policy.Why Other Options Are Not Suitable:B. AWS Systems Manager State Manager for Configuration Drift Detection:While AWS Systems Manager State Manager can be used to manage and enforce configurations, it is not specifically designed for detecting RDS database encryption configuration drift. AWS Config is a more appropriate tool for this purpose.C. Creating a Read Replica with Encryption:While creating a read replica with encryption is a valid approach for some scenarios, it does not directly address the need to encrypt the existing unencrypted database instance. Additionally, promoting a read replica to a standalone instance and terminating the original instance can be complex and may not be the most straightforward solution for all cases.E. Enabling Encryption for the Existing Unencrypted RDS Instance:Unfortunately, you cannot directly enable encryption for an existing, unencrypted RDS instance. Encryption must be enabled during the creation of the database instance or by restoring from an encrypted snapshot, as described in Step D.