DBS-C01 Database Security Practice Question
A financial services company is using Amazon DynamoDB to store customer transaction data. The compliance team requires that all data be encrypted at rest using a customer-managed AWS KMS key, and that access to the key be auditable via AWS CloudTrail. Additionally, the security team wants to ensure that DynamoDB can only be accessed from within the VPC using a VPC endpoint. Which combination of steps should the company take to meet these requirements?
⚠ Common exam trap
A common trap is assuming that DynamoDB only supports gateway VPC endpoints. DynamoDB also supports interface VPC endpoints, providing private connectivity within the VPC. Also, ensure the KMS key is customer-managed for full control and auditing.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable server-side encryption with a customer-managed KMS key and create an interface VPC endpoint for DynamoDB.
Option C. To meet the encryption requirement, the company must use a customer-managed KMS key, not an AWS managed key. For VPC-only access, DynamoDB supports interface VPC endpoints (via AWS PrivateLink), which provide private connectivity. Option C correctly uses a customer-managed KMS key and an interface VPC endpoint. Option D is incorrect because it uses an AWS managed KMS key. Option A is incorrect because CloudHSM is unnecessary and VPC peering is not the correct method. Option B is incorrect because a NAT gateway still routes traffic over the internet.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use a CloudHSM key for encryption and create a VPC peering connection to DynamoDB.
Why it's wrong here
Incorrect. CloudHSM is not required; KMS is sufficient. VPC peering is not used for DynamoDB access.
- ✗
Enable server-side encryption with a customer-managed KMS key and route all traffic through a NAT gateway.
Why it's wrong here
Incorrect. A NAT gateway routes traffic over the internet, not keeping it strictly within the VPC.
- ✓
Enable server-side encryption with a customer-managed KMS key and create an interface VPC endpoint for DynamoDB.
Why this is correct
Correct. Customer-managed KMS key meets encryption requirement; interface VPC endpoint ensures private VPC-only access.
- ✗
Use AWS managed KMS key and a gateway VPC endpoint for DynamoDB.
Why it's wrong here
Incorrect. AWS managed KMS key does not meet the customer-managed key requirement. Although DynamoDB supports gateway endpoints, the key type is wrong.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 1,663 original DBS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DBS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DBS-C01 exam.