DBS-C01 Database Security Practice Question
A company is deploying an Amazon DynamoDB table with server-side encryption using a customer-managed AWS KMS key. The security team requires that the key be automatically rotated every year and that access to the key be logged. Which THREE steps should be taken?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable automatic key rotation for the KMS key.
To meet the requirements: (1) Enable automatic key rotation (Option A) to satisfy the automatic rotation requirement. (2) Enable AWS CloudTrail to log KMS API calls (Option C) to log access to the key. (3) Create a KMS key policy that restricts usage to specific IAM roles (Option D) to control access. Option B is incorrect because AWS CloudHSM is a hardware security module, not used for KMS key rotation or logging. Option E is incorrect because client-side encryption is not relevant; server-side encryption with KMS is already used.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Enable automatic key rotation for the KMS key.
Why this is correct
KMS supports automatic rotation yearly.
- ✗
Use AWS CloudHSM to store the key and manage rotation.
Why it's wrong here
AWS CloudHSM is not the mechanism for managing customer-managed AWS KMS keys used by DynamoDB; AWS KMS handles their creation, storage, and automatic rotation. CloudHSM provides dedicated hardware security modules for customers to generate and store their *own* encryption keys, offering exclusive control over the key material within a FIPS 140-2 Level 3 validated environment. This option is tempting because CloudHSM offers robust key management and hardware-backed security, making it suitable for scenarios requiring the highest level of key control and stringent compliance, often when used as a custom key store for AWS KMS.
- ✓
Enable AWS CloudTrail to log KMS API calls.
Why this is correct
CloudTrail logs all KMS actions for auditing.
- ✓
Create a KMS key policy that allows only specific IAM roles to use the key.
Why this is correct
Key policy controls access to the key.
- ✗
Configure the DynamoDB table to use client-side encryption.
Why it's wrong here
Client-side encryption is not needed; server-side encryption uses KMS.
Go deeper
Related to this question
About these practice questions
This DBS-C01 question is part of Courseiva's 1,663-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DBS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DBS-C01 exam.