Encrypting Data in Transit for Amazon RDS MySQL

SAA-C03 By islever Editorial Last updated

Design secure access to AWS resources.

Short answer

D Download AWS-provided root certificates and provide the certificates in all connections to the RDS instance to enable SSL/TLS encryption.

Question

To meet security requirements, a company needs to encrypt all of its application data in transit while communicating with an Amazon RDS MySQL DB instance. A recent security audit revealed that encryption at rest is enabled using AWS Key Management Service (AWS KMS), but data in transit is not enabled. What should a solutions architect do to satisfy the security requirements?
  1. Enable IAM database authentication on the database.
  2. Provide self-signed certificates. Use the certificates in all connections to the RDS instance.
  3. Take a snapshot of the RDS instance. Restore the snapshot to a new instance with encryption enabled.
  4. Download AWS-provided root certificates. Provide the certificates in all connections to the RDS instance. Correct Answer

Key Takeaways

This question tests the distinction between authentication mechanisms (IAM) and transport layer security (SSL/TLS), highlighting that SSL/TLS requires specific certificate configuration.

To encrypt data in transit for an Amazon RDS MySQL instance, you must configure connections to use SSL/TLS by providing the AWS-provided root certificates. This ensures secure communication between the application and the database.

Common mistake: Many candidates choose IAM database authentication because it provides encryption benefits, but they overlook that enabling IAM alone does not automatically enforce SSL/TLS on all clients without explicit certificate configuration.

Expert Analysis

Why the Answer Is Correct

Amazon RDS automatically creates an SSL certificate and installs it on the DB instance when provisioned. To ensure data in transit is encrypted, clients must connect using SSL/TLS. This requires downloading the AWS-provided root certificates and configuring the connection to use them. Option D correctly identifies this standard procedure.

Why the Other Options Are Wrong

Option A (IAM database authentication) allows users to authenticate using IAM credentials instead of a password. While AWS documentation states that IAM authentication can be used with SSL/TLS, enabling IAM itself does not force or guarantee that all connections are encrypted; it primarily changes who authenticates, not how the transport is secured unless explicitly configured with certs. Options B and C are incorrect because self-signed certificates are not the standard AWS-provided method, and restoring from a snapshot does not change the transit encryption settings of the underlying instance's SSL configuration.

Community Comment Notes

Community consensus strongly favors D. As user BillaRanga noted, "Amazon RDS creates an SSL certificate... So it is AWS provided." User DAIYL emphasized that even with IAM auth, clients still need to download and configure the AWS-provided root certificate to ensure a secure connection. Some users argued for A, citing that IAM auth uses SSL, but the most direct and universally applicable answer for ensuring transit encryption across all connections is configuring the certificates as described in D.

Official Reference

https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.SSL.html

This link opens the official vendor documentation in a new tab.

Exam Strategy

Always distinguish between authentication (who connects) and encryption (how data is transmitted). For RDS, if the requirement is specifically about encrypting data in transit, look for options involving SSL/TLS certificates provided by AWS.

Frequently Asked Questions

Does enabling IAM database authentication automatically encrypt data in transit?

No. IAM authentication changes how users log in. While it supports SSL/TLS, you must still explicitly configure clients to use the AWS-provided certificates to ensure encryption.

Why not use self-signed certificates for RDS transit encryption?

AWS provisions its own SSL certificates for RDS instances. Using AWS-provided certificates ensures compatibility and trust without the overhead of managing custom CA infrastructure.

More SAA-C03 FAQ →

Community Votes

D
81%
A
19%

81% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 8 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 8

  1. BillaRanga 👍 13 Answered D
    Amazon RDS creates an SSL certificate and installs the certificate on the DB instance when the instance is provisioned. So it is AWS provided.
  2. DAIYL 👍 4 Answered D
    Even if IAM database authentication is enabled, clients still need to download and configure the AWS-provided root certificate to ensure a secure connection using SSL/TLS encryption. Without configuring the certificate, communication may not be fully encrypted, even with IAM authentication enabled. https://docs.aws.amazon.com/zh_cn/AmazonRDS/latest/UserGuide/UsingWithRDS.SSL.html
  3. Sivaeas 👍 4
    Optiona A: IAM database authentication provides the following benefits: Network traffic to and from the database is encrypted using Secure Socket Layer (SSL) or Transport Layer Security (TLS). For more information about using SSL/TLS with Amazon RDS, see Using SSL/TLS to encrypt a connection to a DB instance or cluster.
  4. Kezuko 👍 4 Answered A
    A https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.IAMDBAuth.html
  5. JA2018 👍 2 Answered D
    Why D is correct: To encrypt data in transit to an RDS MySQL instance, you need to configure the database connection to use TLS/SSL, which requires using AWS-provided root certificates to establish a secure connection.
Show 3 more comments
  1. Andy_09 👍 5
    Option D
  2. Scheldon 👍 2 Answered D
    AnswerD
  3. Arad 👍 1 Answered A
    A is the correct answer

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

S3 Multi-Region Access Point and Replication Strategy

S-grade

Securing NLB with Security Groups for Minimal Change

S-grade

Most Cost-Effective 7-Year Retention for EBS Snapshots?

S-grade

AWS Forecast vs SageMaker for Time-Series Prediction

S-grade

Practice All SAA-C03 Questions

Access 120 questions with complete answers and detailed explanations.

View Full SAA-C03 Practice Test →

← Back to SAA-C03 Study Guide