Which is a key consideration when securing cloud databases such as RDS, Cosmos DB, or BigQuery?

• A. Disable encryption to reduce latency.
• B. Allow broad access by default.
• C. Implement access control, encryption in transit and at rest, backups, replication, IAM policies, auditing, and secure connections.
• D. Avoid backups to save storage costs.

Answer: (C)

Securing cloud databases requires a defense-in-depth approach that protects data both at rest and in transit, controls access, and ensures recovery and visibility. Implementing access control and least-privilege IAM policies ensures only authorized users and services can act. Encryption in transit (for example, TLS) protects data as it moves, while encryption at rest safeguards stored data. Backups and replication are essential for data durability and disaster recovery, letting you restore quickly after incidents. Auditing provides an immutable activity trail for compliance and investigations, and secure connections ensure clients use trusted, authenticated channels. Together, these elements form a robust security strategy for databases like RDS, Cosmos DB, or BigQuery.

Disabling encryption increases risk and is not a best practice. Allowing broad access by default undermines access control and data protection. Avoiding backups sacrifices data resilience and can violate compliance or business continuity requirements.