DEA-C01 Data Security and Governance Practice Question
A media company stores video metadata in an Amazon DynamoDB table. The security team requires that all data at rest in the table be encrypted with a customer managed key in AWS KMS, and that the key usage be auditable. The data engineer needs to configure encryption for the table. Which action should the data engineer take?
⚠ Common exam trap
The trap here is assuming that AWS managed keys or DAX provide the same control and auditability as customer managed keys for DynamoDB encryption at rest.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a customer managed KMS key and specify it when creating the DynamoDB table, ensuring the key policy allows DynamoDB to use it for encryption and decryption.
DynamoDB encryption at rest can use customer managed KMS keys. Specifying such a key during table creation ensures the table is encrypted with that key. The key policy must grant DynamoDB permission to use the key. KMS key usage is logged in CloudTrail, providing auditability. Other options use keys that are not customer managed or do not encrypt the table at rest.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use DynamoDB Accelerator (DAX) with encryption in transit enabled, and configure the DAX cluster to use a customer managed KMS key.
Why it's wrong here
DAX is an in-memory cache for DynamoDB and does not encrypt the underlying DynamoDB table at rest. While DAX can encrypt data in transit, it does not provide encryption at rest for the table itself. This option does not meet the requirement for table data encryption with a customer managed key.
- ✗
Enable DynamoDB encryption at rest using the default AWS owned key, and enable CloudTrail logging for DynamoDB.
Why it's wrong here
The default AWS owned key is not a customer managed key and does not provide the same auditability or control. CloudTrail logs DynamoDB API calls but does not log KMS key usage for the AWS owned key. This does not meet the requirement for a customer managed key with auditable usage.
- ✗
Enable DynamoDB encryption at rest using an AWS managed key, and use AWS CloudTrail to monitor key usage.
Why it's wrong here
An AWS managed key is not a customer managed key. It is managed by AWS and does not provide the same level of control or auditability as a customer managed key. CloudTrail logs KMS API calls for AWS managed keys, but the key policy cannot be customized, and the key is shared across accounts. This does not satisfy the requirement for a customer managed key.
- ✓
Create a customer managed KMS key and specify it when creating the DynamoDB table, ensuring the key policy allows DynamoDB to use it for encryption and decryption.
Why this is correct
DynamoDB supports customer managed KMS keys for encryption at rest. By specifying the key during table creation and granting DynamoDB permissions in the key policy, the table data is encrypted with that key. KMS key usage is logged in CloudTrail, providing the required auditability. This meets the security team's requirements.
Go deeper
Related to this question
About these practice questions
This DEA-C01 question is part of Courseiva's 1,321-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This DEA-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DEA-C01 exam.