A: Enable encryption B: KMS is for storage and doesn't directly integrate to DB without further work C and D are for data encryption in transit not at rest

KMS only generates and manages encryption keys. That's it. That's all it does. It's a fundamental service that you as well as other AWS Services (like Secrets Manager) use it to encrypt or decrypt. Key Management Service. Secrets Manager is for database connection strings. upvoted 3 times

OK, but why not B???

ANSWER - A

A for sure

A is 100% Crt

Key Management Service. Secrets Manager is for database connection strings.

A is the correct solution to meet the requirement of encrypting the data at rest. To encrypt data at rest in Amazon RDS, you can use the encryption feature of Amazon RDS, which uses AWS Key Management Service (AWS KMS). With this feature, Amazon RDS encrypts each database instance with a unique key. This key is stored securely by AWS KMS. You can manage your own keys or use the default AWS-managed keys. When you enable encryption for a DB instance, Amazon RDS encrypts the underlying storage, including the automated backups, read replicas, and snapshots.

AWS Key Management Service (KMS) is used to manage the keys used to encrypt and decrypt the data.

Option A

A. Create a key in AWS Key Management Service (AWS KMS). Enable encryption for the DB instances is the correct answer to encrypt the data at rest in Amazon RDS DB instances. Amazon RDS provides multiple options for encrypting data at rest. AWS Key Management Service (KMS) is used to manage the keys used to encrypt and decrypt the data. Therefore, a solution architect should create a key in AWS KMS and enable encryption for the DB instances to encrypt the data at rest.

ANSWER - A https://docs.aws.amazon.com/whitepapers/latest/efs-encrypted-file-systems/managing-keys.html

A. Create a key in AWS Key Management Service (AWS KMS). Enable encryption for the DB instances. https://www.examtopics.com/discussions/amazon/view/80753-exam-aws-certified-solutions-architect-associate-saa-c02/