DBS-C01 Database Security Practice Question
A company uses Amazon DynamoDB to store session data. The security team has enabled DynamoDB Accelerator (DAX) for performance. However, they are concerned about data encryption at rest. DAX encrypts data at rest by default. The security team wants to use a customer managed key (CMK) in AWS KMS. How can this be configured?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a DAX cluster and specify the KMS key ID of a symmetric customer managed key during creation.
DAX supports encryption at rest using a KMS key. You must specify a symmetric customer managed key (CMK) at cluster creation time; encryption configuration cannot be modified after creation. Option A is wrong because DAX does support encryption with a CMK, and asymmetric keys are not supported for DAX; only symmetric keys are allowed. Option B is wrong because DAX does allow the use of customer managed keys; it is not limited to AWS managed keys. Option C is wrong because encryption cannot be enabled after cluster creation; it must be configured during creation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use an asymmetric customer managed key because it provides better security.
Why it's wrong here
DAX requires a symmetric CMK for encryption at rest.
- ✗
DAX does not support encryption at rest with a customer managed key; only AWS managed keys are supported.
Why it's wrong here
DAX supports customer managed keys.
- ✗
Enable encryption at rest on the DAX cluster after creation by modifying the cluster settings.
Why it's wrong here
Encryption at rest configuration for DAX cannot be modified after creation.
- ✓
Create a DAX cluster and specify the KMS key ID of a symmetric customer managed key during creation.
Why this is correct
DAX allows specifying a symmetric CMK during cluster creation.
Quick reference
Symmetric Encryption Algorithm Comparison
| Algorithm | Key Size | Block Size | Status | Notes |
|---|---|---|---|---|
| AES-128 | 128-bit | 128-bit | Current standard | NIST approved; WPA3, TLS |
| AES-256 | 256-bit | 128-bit | Current standard | Preferred for sensitive / govt data |
| 3DES | 112-bit effective | 64-bit | Deprecated (2023) | Replaced by AES |
| DES | 56-bit | 64-bit | Broken | Cracked in < 24 h; never deploy |
| ChaCha20 | 256-bit | Stream cipher | Current | TLS 1.3, WireGuard |
Go deeper
Related to this question
About these practice questions
This DBS-C01 question is part of Courseiva's 1,663-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DBS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DBS-C01 exam.