SAA-C03 Q90 · Security

Question

A healthcare company stores personally identifiable information (PII) data in an Amazon RDS for Oracle database. The company must encrypt the PII data at rest. The company must use dedicated hardware modules to store and manage the encryption keys. What should a solutions architect do to meet these requirements?

Accepted Answer

**Option B: Use AWS CloudHSM-backed AWS KMS keys to configure transparent encryption for the RDS database.**

Let's break down the requirements and how B satisfies each:

1. **Encrypt PII data at rest in RDS for Oracle** → Oracle Transparent Data Encryption (TDE) is a native Oracle feature that encrypts data at rest at the tablespace or column level. RDS for Oracle supports TDE. This is the most appropriate encryption mechanism for Oracle databases.

2. **Dedicated hardware modules for key management** → AWS CloudHSM provides single-tenant, dedicated Hardware Security Module (HSM) appliances in the AWS cloud. When you create a **custom key store** in AWS KMS backed by CloudHSM, KMS generates and stores the key material inside your CloudHSM cluster — meaning encryption keys never leave your

📖 Explanation

✅ Correct Answer

❌ Wrong Answers

📘 Key Concepts

🏗️ Architecture

⚙️ Operations

💰 Cost

🔒 Security

🎯 Exam Tips