DBS-C01 Database Security Practice Question
Which THREE of the following are best practices for securing an Amazon DynamoDB table? (Select THREE.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable point-in-time recovery (PITR) to protect against accidental writes or deletes.
Options A, B, and D are correct. Point-in-time recovery (PITR) protects against accidental writes or deletes by allowing you to restore the table to any point within the last 35 days. Encryption at rest using AWS KMS secures data at rest. IAM policies based on least privilege restrict access to only necessary actions and resources. Option C (public access) is not a best practice; DynamoDB tables are private by default and should not be exposed publicly. Option E (limiting item size) is a performance consideration, not a security best practice.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Enable point-in-time recovery (PITR) to protect against accidental writes or deletes.
Why this is correct
PITR allows restoring to any point within the last 35 days.
- ✓
Enable encryption at rest using AWS KMS.
Why this is correct
Encryption at rest protects data if the underlying storage is compromised.
- ✗
Enable public access to the table to allow easy data sharing.
Why it's wrong here
DynamoDB tables are private and should not be made publicly accessible.
- ✓
Use IAM policies to restrict access to the table based on the principle of least privilege.
Why this is correct
IAM policies are the primary mechanism for access control.
- ✗
Limit the maximum item size to 100 KB to reduce storage costs.
Why it's wrong here
Item size limit is a design consideration, not a security best practice.
Go deeper
Related to this question
About these practice questions
This DBS-C01 question is part of Courseiva's 1,663-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DBS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DBS-C01 exam.