DBS-C01 Database Security Practice Question
A company is using Amazon DynamoDB with a global table that replicates data across two AWS Regions. The security team requires that all data be encrypted at rest with a customer-managed AWS KMS key. How should the company configure the KMS keys to meet this requirement?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a separate KMS key in each region and assign each replica table its regional KMS key.
For DynamoDB global tables, each replica table can use a different KMS key. You must create a KMS key in each region and configure the table to use the regional key. Option A is incorrect because a single KMS key cannot be used across regions; KMS keys are region-specific. Option B is incorrect because using the same key across regions is not possible. Option D is incorrect because DynamoDB global tables support encryption with customer managed keys.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create a single KMS key in the primary region and use it for both replicas.
Why it's wrong here
KMS keys are region-specific and cannot be used across regions.
- ✗
Use AWS managed encryption as DynamoDB does not support customer managed KMS keys for global tables.
Why it's wrong here
DynamoDB global tables support customer managed KMS keys for each replica.
- ✓
Create a separate KMS key in each region and assign each replica table its regional KMS key.
Why this is correct
Each replica table can use its own regional KMS key.
- ✗
Create a multi-Region KMS key and use it for both replicas.
Why it's wrong here
DynamoDB global tables do not support multi-Region KMS keys for encryption at rest.
Go deeper
Related to this question
About these practice questions
One of 1,663 original DBS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DBS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DBS-C01 exam.