DBS-C01 DynamoDB encryption at rest Practice Question
A company has an Amazon DynamoDB table that stores sensitive user data. The security team requires that all data is encrypted at rest using a customer-managed AWS KMS key. Which step should be taken to meet this requirement?
⚠ Common exam trap
Candidates often confuse DynamoDB encryption options with S3 encryption. DynamoDB does not support SSE-S3 or SSE-C; it uses AWS KMS.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Specify a customer-managed KMS key in the DynamoDB table creation.
You can specify a customer-managed AWS KMS key when creating a DynamoDB table to enable encryption at rest with that key. Option E is incorrect because while you can restrict access to a specific IAM role, the question specifically asks about encryption at rest. Option A is wrong because DynamoDB uses KMS keys, not S3-managed keys. Option B is wrong because bucket policies are for S3, not DynamoDB. Option D is wrong because encryption at rest cannot be enabled after table creation; it must be specified at creation time.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable server-side encryption with S3-managed keys (SSE-S3) on the DynamoDB table.
Why it's wrong here
Incorrect. DynamoDB does not support SSE-S3; it uses AWS KMS for encryption at rest.
- ✗
Attach a bucket policy to restrict access to the DynamoDB table.
Why it's wrong here
Incorrect. Bucket policies are for S3, not DynamoDB. Access to DynamoDB is controlled via IAM policies.
- ✓
Specify a customer-managed KMS key in the DynamoDB table creation.
Why this is correct
Correct. Specifying a customer-managed KMS key during table creation enables encryption with that key.
- ✗
Modify the existing DynamoDB table to enable encryption at rest.
Why it's wrong here
Incorrect. Encryption at rest for DynamoDB cannot be enabled after table creation; it must be set at creation time.
- ✗
Create an IAM policy that allows dynamodb:GetItem and dynamodb:PutItem only when the request is made by the specific IAM role.
Why it's wrong here
Correct. An IAM policy can restrict DynamoDB actions to a specific IAM role, ensuring only that role can access the table.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This DBS-C01 question is part of Courseiva's 1,663-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DBS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DBS-C01 exam.