DBS-C01 Database Security Practice Question
A company uses Amazon DynamoDB with a global secondary index (GSI) on a table that contains sensitive data. The security team requires that the GSI be encrypted with a different AWS KMS key than the base table. Can this be achieved, and if so, how?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
No, DynamoDB encrypts the entire table and all its indexes with the same KMS key.
DynamoDB encrypts all data at rest using a single KMS key per table. The base table and all of its GSIs are encrypted with the same key. It is not possible to use a different KMS key for a GSI. Option A is wrong because the GSI cannot have a separate key. Option B is wrong because KMS key policies do not allow per-index encryption. Option D is wrong because the table and its GSIs always use the same key.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Yes, by using a custom KMS key policy that differentiates between table and index.
Why it's wrong here
KMS key policies cannot be used to differentiate between table and index encryption.
- ✗
Yes, by specifying a different KMS key ID when creating the GSI.
Why it's wrong here
DynamoDB does not support per-index KMS keys.
- ✓
No, DynamoDB encrypts the entire table and all its indexes with the same KMS key.
Why this is correct
DynamoDB uses one KMS key for the table and all associated indexes.
- ✗
No, but you can use a different KMS key for the table and then the GSI will automatically use a different key.
Why it's wrong here
The GSI uses the same key as the table.
Go deeper
Related to this question
About these practice questions
Courseiva writes every DBS-C01 question from scratch — 1,663 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DBS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DBS-C01 exam.