Answer options:

A.Configure the RDS instance as the master and enable replication over the open internet using a secure HTTPS endpoint to the on-premises server.
B.RDS cannot replicate to an on-premises database server directly. Instead, first, configure the RDS instance to replicate to an EC2 instance with core MySQL, and then configure replication over a secure VPN/VPG connection.
C.Create a Data Pipeline that exports the MySQL data each night and securely downloads the data from an S3 HTTPS endpoint.
D.Create an IPSec VPN connection between AWS VPC and the on-premise server. Use the mysqldump utility to transfer the database from the Amazon RDS database to the external MySQL database in the on-premises data center.

Answer – D
Option A is incorrect because the HTTPS endpoint is incorrect as RDS uses another port. This option also does not use VPN and it is not the most secure way.
Option B is incorrect because replicating via EC2 instances is very time consuming and very expensive cost-wise.
Option C is incorrect because Data Pipeline is for batch jobs and not suitable for replicating the RDS DB to an on-premises database.
Option D is CORRECT because it is feasible to set up the secure IPSec VPN connection between the on-premises server and AWS VPC. The mysqldump utility can be used to transfer the database.
For more information on VPN connections, please visit the below URL:
http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_VPN.html
Note:
AWS docs state that, 
Configure an egress rule for the external instance to operate as a Read Replica during the export. The egress rule will allow the MySQL Read Replica to connect to the MySQL DB instance during replication. Specify an egress rule that allows TCP connections to the port and IP address of the source Amazon RDS MySQL DB instance.
Please refer to the following links for more information.
https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/MySQL.Procedural.Exporting.NonRDSRepl.html
https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/rds-ug.pdf