DBS-C01 Database Security Practice Question
A security engineer is designing a disaster recovery plan for an Amazon DynamoDB table that contains sensitive data. The table is encrypted using an AWS KMS customer managed key (CMK). The engineer needs to ensure that the table can be restored in a different AWS Region. Which TWO actions must be taken to enable cross-region restores with the same encryption? (Choose TWO.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable point-in-time recovery (PITR) on the table.
To enable cross-region restores of an encrypted DynamoDB table, you need to have the table's backups available in the destination region. Cross-region restores require point-in-time recovery (PITR) to be enabled on the source table (Option A). Additionally, because the table uses a customer managed KMS key, you must create a multi-Region KMS key (or replicate the key) in the destination region so that DynamoDB can use it to decrypt the backup during restore (Option D). Option B (global tables) is for live replication, not for backup/restore scenarios. Option C (export to S3 and copy) does not preserve the same encryption because the exported data is not encrypted with the KMS key. Option E (CloudHSM) is not supported for DynamoDB encryption.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Enable point-in-time recovery (PITR) on the table.
Why this is correct
PITR is required for cross-region restores.
- ✗
Enable DynamoDB global tables.
Why it's wrong here
Global tables replicate live data, not backups.
- ✗
Export the table to S3 and copy the S3 objects to the destination Region.
Why it's wrong here
This would require re-encryption with a new key.
- ✓
Create a multi-Region KMS key in the source and replicate it to the destination Region.
Why this is correct
Multi-Region keys allow decryption in the destination.
- ✗
Create a CloudHSM key and use it for encryption.
Why it's wrong here
DynamoDB does not support CloudHSM.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every DBS-C01 question from scratch — 1,663 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DBS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DBS-C01 exam.