How to Encrypt PII at Rest on EC2 and RDS with Least Change?
Short answer
D Enable Amazon EBS encryption and Amazon RDS encryption with AWS KMS keys to encrypt the instance and database volumes with minimal infrastructure change.
Question
Key Takeaways
The question tests the split between at-rest encryption (EBS and RDS volumes backed by AWS KMS) and in-transit encryption (SSL/TLS certificates), and the trap is choosing a certificate or HSM option that never encrypts the storage volumes.
Encrypting PII at rest for an EC2 application backed by Amazon RDS is achieved with the fewest infrastructure changes by turning on Amazon EBS encryption and Amazon RDS encryption using AWS KMS keys. This page confirms option D as the correct SAA-C03 answer and explains why certificate- and CloudHSM-based options fail.
Common mistake: Most candidates who miss this pick C (or A) because they see "KMS" or "certificates" and assume encryption is covered, forgetting that SSL/TLS with ACM protects data in transit, not PII sitting on EBS and RDS volumes.
Expert Analysis
Why the Answer Is Correct
Option D enables Amazon EBS encryption on the EC2 instance volumes and Amazon RDS encryption on the database, both using AWS KMS customer master keys. These are native, managed features of the services already in use, so no new appliances, key-management clusters, or application rewrites are needed — exactly what "LEAST amount of changes to the infrastructure" requires. Because Amazon RDS stores its data on Amazon EBS volumes, combining the two settings covers the instance storage and the database storage that hold the PII. KMS handles key creation, rotation, and access control, so the compliance requirement for encryption at rest is satisfied with configuration rather than architecture change.
Why the Other Options Are Wrong
Option A uses AWS Certificate Manager to generate certificates, but certificates enable TLS/SSL, which protects data in transit, not database volumes at rest. Option B deploys AWS CloudHSM, which means provisioning a dedicated HSM cluster, generating and managing your own keys, and integrating them with the database — a large infrastructure change, and RDS only supports CloudHSM-style keys for specific engines such as Oracle TDE and SQL Server TDE. Option C is technically incoherent: SSL is a transport protocol configured with certificates, not KMS keys, and even a correct SSL setup would leave the volumes unencrypted. Only D encrypts the actual instance and database volumes.
Community Comment Notes
boluwatito reinforces the storage layer, noting that "Amazon RDS relies on Amazon EBS volumes for storage" so configuring EBS encryption covers the underlying volumes. sandordini cuts to the core distinction with "SSL is for transit not at rest" and admits that although the question never explicitly mentions EBS volumes, D is still the intended answer. mk168898 eliminates the certificate options (A and C) as transit-only and narrows the choice to B versus D. JA2018 highlights that D "requires the least infrastructure modification as it leverages existing features", which is the phrase in the question's requirement. zinabu answered C, illustrating exactly the transit-versus-at-rest confusion this question is designed to catch.
Exam Strategy
When a scenario says "least changes" or "least operational overhead," favor native, managed encryption toggles on existing resources (EBS, RDS, KMS) over introducing new services such as CloudHSM. Instantly eliminate options that mix certificates or SSL with volume encryption, because certificates are for data in transit. Remember too that RDS encryption is enabled at creation, so the realistic path is restoring an encrypted snapshot — still the smallest change among the four options.
Official Reference
- https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSEncryption.html
- https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Overview.Encryption.html
These links open the official vendor documentation in a new tab.
Exam Strategy
For any compliance question about encryption at rest, map each option to the layer it protects: certificates/SSL protect data in transit, while KMS-backed EBS and RDS encryption protect stored volumes. Then apply the "least change" tiebreaker, which almost always favors the native service feature over a new dedicated appliance like CloudHSM.
Frequently Asked Questions
Why is configuring SSL encryption with KMS keys (option C) wrong for PII at rest?
Does enabling Amazon RDS encryption satisfy the compliance requirement for the EC2 instance too?
Community Votes
100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 5 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 5
-
boluwatito 👍 6 Answered DAmazon RDS relies on Amazon EBS volumes for storage. By configuring Amazon EBS encryption, the underlying storage volumes are encrypted.
-
sandordini 👍 4 Answered DEncryption should be KMS, SSL is for transit not at rest... Even though the question never mentioned any EBS volumes whatsoever, I would still go for D....
-
mk168898 👍 2SSL/Certificate => encrypt in transit, so A and C are wrong. so i feel the answer is between B and D.
-
JA2018 👍 1 Answered D- Option D requires the least infrastructure modification as it leverages existing features of EBS and RDS to enable encryption with KMS keys. - This is the most straightforward way to meet the compliance requirement without significant changes to the existing setup.
-
zinabu 👍 2answer:C
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.
Related Analysis
Practice All SAA-C03 Questions
Access 120 questions with complete answers and detailed explanations.
View Full SAA-C03 Practice Test →