DBS-C01 Database Security Practice Question
A company is using Amazon DynamoDB with a global table. The security team requires that all data be encrypted at rest using a customer-managed KMS key. The table was originally created with AWS managed key encryption. The company wants to switch to a customer-managed key without downtime. What should they do?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a new table with the customer-managed key, export the data from the old table using AWS Data Pipeline, and import into the new table.
You cannot modify the encryption key of an existing DynamoDB table. To switch to a customer-managed KMS key without downtime, you must create a new table with the desired key, export data from the old table using AWS Data Pipeline, and import into the new table. Option A is incorrect because the UpdateTable API does not support changing the KMS key after table creation. Option B is incorrect because DynamoDB Streams and Lambda are not suitable for full table migration, especially for global tables. Option C is incorrect because replicas inherit the table's encryption key and cannot have a different key.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use the UpdateTable API to change the KMS key to the customer-managed key.
Why it's wrong here
DynamoDB does not support changing the KMS key on an existing table.
- ✗
Enable DynamoDB Streams on the old table and use a Lambda function to copy data to a new table with the customer-managed key.
Why it's wrong here
This approach fails because creating a new table with a customer-managed key and copying data breaks the existing global table configuration. Re-establishing global table replication and switching application endpoints to the new table would incur downtime, violating the requirement. However, using DynamoDB Streams with Lambda is a valid pattern for migrating data between *different* tables, performing transformations, or replicating data to a separate system, making it tempting for general data movement scenarios.
- ✗
Create a new replica in the global table with the customer-managed key and then delete the old replica.
Why it's wrong here
Global tables use the same encryption key for all replicas.
- ✓
Create a new table with the customer-managed key, export the data from the old table using AWS Data Pipeline, and import into the new table.
Why this is correct
This avoids downtime if done carefully, but there is no direct migration tool; however, it is the only way.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
This DBS-C01 question is part of Courseiva's 1,663-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DBS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DBS-C01 exam.