DBS-C01 Database Security Practice Question
A financial services company uses Amazon DynamoDB to store transaction data. The table is encrypted with an AWS managed KMS key. The compliance team requires that the encryption key be rotated every 90 days. The current key was created 6 months ago and has not been rotated. The company also needs to ensure that all access to the table is logged for audit purposes. The security engineer proposes to enable DynamoDB Streams and AWS CloudTrail. However, the compliance team notes that CloudTrail only logs management plane events (e.g., CreateTable) and not data plane events (e.g., GetItem, PutItem). What should the engineer do to meet both requirements?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a customer managed KMS key, enable automatic key rotation, and configure CloudTrail to log data events for the DynamoDB table.
To meet both requirements, the engineer should create a customer managed KMS key, enable automatic key rotation (which rotates the key annually, but for 90-day rotation, the engineer can create a new key every 90 days and update the table), and configure CloudTrail to log data events for the DynamoDB table. CloudTrail data events capture data plane operations like GetItem and PutItem, which addresses the logging requirement. Option A is incorrect because AWS managed keys do not support automatic rotation; also, CloudTrail data events are not tied to key type. Option B is incorrect because switching to a customer managed key alone does not enable data event logging. Option C is incorrect because DynamoDB Streams are used for change data capture and streaming to other services, not for audit logging of data plane operations; CloudWatch Logs from Streams do not capture all API calls.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use AWS CloudTrail data events to capture DynamoDB data plane operations and store the logs in S3.
Why it's wrong here
CloudTrail can log data events, but the engineer should also address key rotation.
- ✗
Switch to an AWS managed KMS key and enable automatic rotation.
Why it's wrong here
AWS managed keys rotate automatically but not on a schedule of 90 days.
- ✗
Enable DynamoDB Streams and stream write events to CloudWatch Logs for auditing.
Why it's wrong here
DynamoDB Streams capture changes, not all read/write operations.
- ✓
Create a customer managed KMS key, enable automatic key rotation, and configure CloudTrail to log data events for the DynamoDB table.
Why this is correct
Customer managed keys support rotation; CloudTrail data events log data plane operations.
Go deeper
Related to this question
About these practice questions
Courseiva writes every DBS-C01 question from scratch — 1,663 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DBS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DBS-C01 exam.