DBS-C01 Database Security Practice Question
Which THREE practices should be implemented to secure an Amazon DynamoDB table that stores personally identifiable information (PII)? (Select THREE.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable encryption at rest using an AWS KMS customer-managed key.
Using IAM policies to restrict access is a security best practice. Encrypting the table at rest with a KMS key protects data. Monitoring with CloudTrail provides audit trail. VPC endpoints help but are not a security practice for the table itself. Encryption in transit is done by DynamoDB automatically via HTTPS. Fine-grained access control can be achieved with IAM conditions, not attribute-based access control on the table itself.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use a VPC endpoint to access the table.
Why it's wrong here
VPC endpoints keep traffic within AWS network but do not provide security beyond IAM.
- ✓
Enable encryption at rest using an AWS KMS customer-managed key.
Why this is correct
Encryption at rest protects data.
- ✓
Use an IAM policy to restrict who can access the table.
Why this is correct
IAM policies control access.
- ✓
Enable AWS CloudTrail to log all DynamoDB API calls.
Why this is correct
CloudTrail provides audit logging.
- ✗
Enable encryption in transit using SSL/TLS.
Why it's wrong here
DynamoDB enforces HTTPS; this is already enabled.
Go deeper
Related to this question
About these practice questions
One of 1,663 original DBS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DBS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DBS-C01 exam.