DBS-C01 Database Security Practice Question
A company is using Amazon DynamoDB to store customer session data. The security team requires that all data is encrypted at rest using a customer-managed KMS key, and that access to the key is restricted to specific IAM roles. The company also wants to ensure that DynamoDB Accelerator (DAX) cluster is encrypted. Which steps should be taken to meet these requirements?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create the DynamoDB table with encryption using a customer-managed KMS key. Create the DAX cluster and enable encryption at rest using the same KMS key.
DynamoDB tables can be encrypted at rest with a customer-managed KMS key at creation, and DAX clusters also support encryption at rest using the same or a different KMS key, meeting the requirement. Option B is wrong because DynamoDB encryption cannot be enabled after table creation; it must be specified at creation. Option C is wrong because it uses default encryption (AWS managed key) for the table, not a customer-managed key. Option D is wrong because it refers to encryption in transit (TLS) for DAX, but the requirement is for encryption at rest; DAX encryption at rest is not addressed.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create the DynamoDB table with encryption using a customer-managed KMS key. Create the DAX cluster and enable encryption at rest using the same KMS key.
Why this is correct
Correct. DynamoDB tables support encryption at rest with a customer-managed KMS key at creation. DAX clusters can also be encrypted at rest using the same or a different KMS key.
- ✗
Create the DynamoDB table without encryption, then use the AWS CLI to enable encryption after creation.
Why it's wrong here
Incorrect. DynamoDB encryption at rest cannot be enabled after table creation. Encryption must be set when the table is created. Additionally, this option does not address DAX encryption.
- ✗
Create the DynamoDB table with default encryption, and create the DAX cluster with a separate customer-managed KMS key.
Why it's wrong here
Incorrect. Default encryption for DynamoDB uses an AWS managed key, not a customer-managed key. While a separate customer-managed key for DAX is possible, the table does not meet the customer-managed key requirement.
- ✗
Create the DynamoDB table with encryption using a customer-managed key, and enable encryption in transit on the DAX cluster using TLS.
Why it's wrong here
Incorrect. This option enables encryption in transit (TLS) for DAX, but the requirement is for encryption at rest. DAX encryption at rest is not configured here.
Go deeper
Related to this question
About these practice questions
One of 1,663 original DBS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DBS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DBS-C01 exam.