DBS-C01 Database Security Practice Question
A company is using Amazon DynamoDB to store sensitive customer data. They need to ensure that all data is encrypted at rest using a customer-managed AWS KMS key. The company also wants to rotate the KMS key every year. What is the simplest way to achieve key rotation?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable automatic key rotation in AWS KMS for the customer-managed key.
The simplest way to achieve annual key rotation for a customer-managed AWS KMS key used with DynamoDB is to enable automatic key rotation on the existing key. AWS KMS supports automatic rotation of customer-managed keys once per year when enabled, which can be done through the KMS console or API without any manual intervention or table modification. Option A is incorrect because creating a new key and updating the DynamoDB table requires manual effort and is more complex than enabling automatic rotation. Option B is incorrect because deleting and recreating the key is disruptive and not simpler. Option D is incorrect because importing new key material does not provide automatic rotation and is not the simplest method.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create a new KMS key every year and update the DynamoDB table to use the new key.
Why it's wrong here
Creating a new KMS key annually and updating the DynamoDB table requires manual reconfiguration of the table’s encryption settings each time, which introduces operational overhead and risks of misconfiguration. This approach is tempting because it directly aligns with the requirement for a customer-managed key and annual rotation, and it would be correct if DynamoDB did not support automatic key rotation. However, DynamoDB can automatically rotate a single customer-managed KMS key each year when you enable automatic key rotation on that key, eliminating the need for table updates.
- ✗
Manually rotate the key by deleting and recreating the KMS key each year.
Why it's wrong here
Manual rotation is error-prone and not recommended when automatic rotation is available.
- ✓
Enable automatic key rotation in AWS KMS for the customer-managed key.
Why this is correct
Automatic rotation rotates the key material annually without manual intervention.
- ✗
Import new key material into the existing KMS key every year.
Why it's wrong here
You cannot import key material for symmetric KMS keys; key material is generated by AWS.
Go deeper
Related to this question
About these practice questions
One of 1,663 original DBS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DBS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DBS-C01 exam.