DBS-C01 Database Security Practice Question
A financial company uses Amazon DynamoDB to store customer transaction data. The compliance team requires that all data be encrypted at rest using a customer-managed AWS KMS key. Additionally, they need to ensure that the key is used only for DynamoDB and no other AWS service. How can the company meet these requirements?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a KMS key with a key policy that includes a condition such as "kms:ViaService": "dynamodb.amazonaws.com" to restrict usage to DynamoDB.
A KMS key policy can use the 'kms:ViaService' condition key to restrict usage of the key to requests that originate from DynamoDB (dynamodb.amazonaws.com). This ensures the key is used only for DynamoDB and no other AWS service. Option A is incorrect because IAM policies alone cannot restrict key usage if the key policy allows all principals; the key policy must explicitly enforce the restriction. Option B is incorrect because AWS Organizations SCPs do not control KMS key permissions; they control permissions for IAM entities. Option D is incorrect because IAM policies cannot prevent other services from using the key if the key policy allows them; the key policy itself must include the restriction.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use a KMS key with no key policy, and rely on IAM policies to restrict access to only DynamoDB.
Why it's wrong here
Without a key policy, no one can use the key; also, IAM alone cannot restrict key usage if the key policy allows it.
- ✗
Use an AWS Organizations service control policy (SCP) to deny all AWS services except DynamoDB from using the KMS key.
Why it's wrong here
SCPs cannot restrict KMS key usage; key policies are required.
- ✓
Create a KMS key with a key policy that includes a condition such as "kms:ViaService": "dynamodb.amazonaws.com" to restrict usage to DynamoDB.
Why this is correct
This condition ensures the key can only be used through DynamoDB, preventing other services.
- ✗
Create a KMS key with a key policy that allows DynamoDB to use the key, and attach an IAM policy to deny all other services.
Why it's wrong here
IAM policies cannot override a key policy that grants access to other services.
Go deeper
Related to this question
About these practice questions
This DBS-C01 question is part of Courseiva's 1,663-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DBS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DBS-C01 exam.