A client has decided to go for a MySQL RDS database on the AWS cloud based on its Scalability & High Availability features. When he does so, what role does he play in making the database secure? (Select TWO.)

Answer options:

A.He can restrict RDS access to the database by using a Security Group.
B.He can provide the most recent updates of his database software installed on the EC2 Instance for preventing Security attacks.
C.He can provide the most recent versions of his Operating System on the EC2 instance for preventing Security attacks.
D.He can Encrypt database data at rest by using EBS volume storage encryption.
E.He can plan for backup & recovery strategies for data that may be lost.

Answers: A and E
RDS is a managed service (Database As a Service) that allows the user to ease administrative tasks like Database software updates and Operating System patch updates. Thus it helps the user concentrate more on the design/development of the database. The instance class types(EC2 VM’s) that support the database instance configuration are abstracted from the user since it is provided as a service. All in all RDS offers automatic DB installation process, storage disk provisioning, Database upgrades, Security patches and backups of SQL Server databases. In this scenario, we would like to know the tasks that a user can perform as a part of the Shared responsibility model for security in an RDS database.
Option A is CORRECT. Security Groups can be used to control Ingress / Egress traffic flowing in & out of an RDS database instance. A user can configure an Ingress security group rule for restricting traffic to certain IP addresses of an RDS port such as 3306.
Option B is incorrect. Database instances are abstracted from the user & database software updates are managed by the service provider(AWS).
Option C is incorrect. Since the instance types are abstracted from the user, the OS security patches are also controlled by the service provider (AWS).
Option D is incorrect. Data encryption at rest is possible in an RDS instance. However, using an EBS volume will not be possible since that will require much more control to the instance hosting the Database to mount an EBS volume. RDS automatically manages storage disk provisioning. It allows a user to select the storage type during database creation/modification time from the following types: General purpose SSD, Provisioned IOPS, Magnetic.
Option E is CORRECT. Although RDS provides an automated backup facility, the user needs to enable it & plan for the window time where the backup process can be initiated. RDS also provides the user with a facility to do manual backups (Point in time DB snapshots) which can be planned.
References:
https://aws.amazon.com/blogs/database/common-administrator-responsibilities-on-amazon-rds-and-aurora-for-postgresql-databases/
https://serverguy.com/comparison/pros-cons-rds-vs-ec2-mysql-aws/
https://www.percona.com/blog/2018/05/08/how-to-enable-amazon-rds-remote-access/