DBS-C01 Database Security Practice Question
A company is using Amazon DynamoDB Accelerator (DAX) for caching. The security team is concerned about data in transit between the application and DAX. What should the team do to ensure that all traffic to DAX is encrypted?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable encryption in transit when creating the DAX cluster.
DAX supports encryption in transit, which must be enabled when creating the cluster. Option A is incorrect because launching in a private subnet with a VPC endpoint does not encrypt traffic; it only provides private connectivity. Option C is incorrect because DAX manages its own encryption certificates and does not use AWS Certificate Manager. Option D is incorrect because client-side encryption encrypts data at the application layer, but it does not ensure encryption in transit between the application and DAX; enabling encryption in transit on the DAX cluster is required.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Launch the DAX cluster in a private subnet with a VPC endpoint.
Why it's wrong here
Launching a DAX cluster in a private subnet with a VPC endpoint does not encrypt traffic; it only provides private connectivity. Encryption in transit must be explicitly enabled on the DAX cluster.
- ✓
Enable encryption in transit when creating the DAX cluster.
Why this is correct
DAX supports TLS encryption in transit when enabled at cluster creation.
- ✗
Use AWS Certificate Manager to issue a certificate for the DAX cluster.
Why it's wrong here
DAX does not use ACM; it has its own certificate management.
- ✗
Use client-side encryption to encrypt data before sending it to DAX.
Why it's wrong here
Client-side encryption encrypts data before sending it to DAX, but this does not ensure that all traffic between the application and DAX is encrypted by DAX. To ensure all traffic is encrypted, enable encryption in transit on the DAX cluster.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every DBS-C01 question from scratch — 1,663 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DBS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DBS-C01 exam.