A web application stores regulated data in RDS. Which TWO controls together provide defense-in-depth for BOTH data at rest and application access? (Select TWO.)
Choose 2 answers.
A.Enable RDS encryption at rest with a customer managed KMS key
Correct. A customer managed KMS key encrypts RDS storage and provides control plus audit of key use.
B.Require IAM database authentication or Secrets Manager-managed credentials for application access
Correct. IAM database authentication or rotated Secrets Manager credentials secures application access without embedded passwords.
C.Enable S3 versioning on the application bucket
S3 versioning does not protect database data or access to it.
D.Add a CloudFront distribution in front of the database
CloudFront caches web content at edge locations; placing it 'in front of the database' is not a meaningful database control.
E.Increase the RDS instance size
Larger instances change capacity, not security posture.
Why this answer
Defense-in-depth means controls at multiple layers. KMS-encrypted storage protects data at rest, while IAM DB authentication or Secrets Manager-managed credentials controls and audits who/what can authenticate to the database.
Correct answers: A, B · Last reviewed 2026-10-25
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Data Protection & Encryption practice session.
Practice Data Protection & Encryption