DBS-C01 Database Security Practice Question
A financial services company stores sensitive data in an Amazon DynamoDB table. The security team requires that all data at rest be encrypted with a customer-managed key that is rotated automatically every 12 months. The company also needs to audit key usage. Which solution meets these requirements?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable encryption at rest using an AWS KMS customer-managed CMK. Configure automatic key rotation with a 12-month period. Use AWS CloudTrail to audit key usage.
DynamoDB supports encryption at rest with AWS KMS customer-managed CMKs. Automatic key rotation every 12 months is a feature of KMS for CMKs. CloudTrail logs KMS API calls for auditing. Option A is incorrect because SSE-S3 is for S3, not DynamoDB. Option B is incorrect because CloudHSM does not provide automatic key rotation every 12 months and requires application-side encryption. Option C is incorrect because the default DynamoDB encryption uses an AWS owned key, which is not customer-managed and rotates automatically every 3 years, not 12 months. Option D is correct: it uses a customer-managed CMK with yearly rotation and CloudTrail for auditing.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use server-side encryption with S3-managed keys (SSE-S3) for the DynamoDB table.
Why it's wrong here
SSE-S3 is for Amazon S3, not DynamoDB. DynamoDB does not support SSE-S3.
- ✗
Use AWS CloudHSM to generate and store the encryption key. Configure the application to encrypt data before writing to DynamoDB.
Why it's wrong here
AWS CloudHSM provides hardware security modules but does not automatically rotate keys. Key rotation would require custom implementation and CloudHSM does not natively provide automatic 12-month rotation or native CloudTrail auditing for key usage.
- ✗
Enable encryption at rest using the default DynamoDB encryption option (AWS owned key). Use AWS CloudTrail to audit key usage.
Why it's wrong here
The default DynamoDB encryption uses an AWS owned key, which rotates automatically but not necessarily every 12 months. Also, it is not customer-managed, so it does not meet the requirement for a customer-managed key.
- ✓
Enable encryption at rest using an AWS KMS customer-managed CMK. Configure automatic key rotation with a 12-month period. Use AWS CloudTrail to audit key usage.
Why this is correct
Encryption at rest with an AWS KMS customer-managed CMK allows automatic key rotation every 12 months (configurable) and CloudTrail can audit KMS API calls for key usage, meeting all requirements.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 1,663 original DBS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DBS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DBS-C01 exam.