Which action will meet these requirements?

A company uses an Amazon RDS for PostgreSQL DB instance for its customer relationship management (CRM) system. New compliance requirements specify that the database must be encrypted at rest.

Which action will meet these requirements?
A . Create an encrypted copy of manual snapshot of the DB instance. Restore a new DB instance from the encrypted snapshot.
B. Modify the DB instance and enable encryption.
C. Restore a DB instance from the most recent automated snapshot and enable encryption.
D. Create an encrypted read replica of the DB instance. Promote the read replica to a standalone instance.

View Answer

Answer: A

Explanation:

https://docs.aws.amazon.com/prescriptive-guidance/latest/patterns/encrypt-an-existing-amazon-rds-for-postgresql-db-instance.html

You can enable encryption for an Amazon RDS DB instance when you create it, but not after it’s created. However, you can add encryption to an unencrypted DB instance by creating a snapshot of your DB instance, and then creating an encrypted copy of that snapshot. You can then restore a DB instance from the encrypted snapshot to get an encrypted copy of your original DB instance. The pattern uses AWS Database Migration Service (AWS DMS) to migrate data and AWS Key Management Service (AWS KMS) for encryption.