DBS-C01 Database Security Practice Question
A company is using Amazon DynamoDB with encryption at rest using an AWS managed key. The security team now requires that the encryption key be rotated every 90 days. What should they do?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use a customer managed key and manually rotate it every 90 days by creating a new key and updating the DynamoDB table.
DynamoDB encryption at rest using an AWS managed key does not support customer-controlled rotation. Option D is correct because using a customer managed key allows you to manually rotate the key every 90 days by creating a new key and updating the DynamoDB table. Option A is incorrect because AWS managed keys rotate automatically every year, not on a 90-day schedule. Option B is incorrect because KMS automatic rotation for customer managed keys is also yearly and cannot be set to 90 days. Option C is incorrect because disabling encryption at rest is not a valid solution and adds security risk.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable automatic key rotation in AWS KMS for the default DynamoDB key.
Why it's wrong here
AWS managed keys rotate automatically every year, but cannot be customized to 90 days.
- ✗
Create a new customer managed key and enable automatic rotation every 90 days.
Why it's wrong here
KMS automatic rotation minimum is 1 year.
- ✗
Disable encryption at rest and implement client-side encryption.
Why it's wrong here
Disabling encryption is not a security improvement.
- ✓
Use a customer managed key and manually rotate it every 90 days by creating a new key and updating the DynamoDB table.
Why this is correct
Manual rotation is required to achieve a 90-day rotation schedule.
Go deeper
Related to this question
About these practice questions
Courseiva writes every DBS-C01 question from scratch — 1,663 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DBS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DBS-C01 exam.