A financial firm requirements specify that all data stored in Amazon RDS must be encrypted with keys that only their internal security team can manage and rotate. They also want to be able to revoke access to the keys at any time. Which RDS encryption option should they use?

Direct Answer (Verified)Reviewed by Sunny (Senior Cloud Engineer)

Correct Answer: AWS KMS Customer Managed Key (CMK)

CMKs give you full control over the key policy, enabling rotation management and the ability to disable/delete the key to render data unreadable....

📋Part of AWS Certified Solutions Architect – Professional (SAP-C02) · AWS Certification Practice
Real Exam ScenarioAmazon RDS

A financial firm requirements specify that all data stored in Amazon RDS must be encrypted with keys that only their internal security team can manage and rotate. They also want to be able to revoke access to the keys at any time. Which RDS encryption option should they use?

✓ Correct Answer & ExplanationAmazon RDS

Correct Answer

AWS KMS Customer Managed Key (CMK)

Why This Answer Is Correct

CMKs give you full control over the key policy, enabling rotation management and the ability to disable/delete the key to render data unreadable.

📚 What This Question Tests

This question evaluates your knowledge of Amazon RDS — a core concept tested in AWS Certified Solutions Architect – Professional (SAP-C02). Understanding Amazon RDS is essential for designing scalable, secure, and cost-effective cloud architectures. Mastery of this topic will help you answer scenario-based questions confidently on exam day.