DVA-C02 Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Enable DynamoDB encryption at rest using an AWS KMS managed key (SSE-KMS).

  Why this is correct

  DynamoDB encryption at rest with an AWS managed KMS key (aws/dynamodb) is enabled by default for all new tables, so specifying SSE-KMS with that key provides transparent AES-256 server-side encryption. Because the key is managed by AWS, you cannot control rotation or permissions, but it fully satisfies the at-rest encryption requirement without extra operational overhead.

• ✓

  Enable DynamoDB encryption at rest using an AWS KMS customer managed key.

  Why this is correct

  Using a customer managed KMS key gives you direct control over the key lifecycle, including enabling automatic yearly rotation, setting IAM policies and key policies, and creating grants for cross-account or application-specific access. DynamoDB integrates with KMS to encrypt and decrypt table data and indexes on every read and write, so this also meets the at-rest requirement while adding auditability through CloudTrail key usage events.

• ✓

  Use HTTPS for all API calls to DynamoDB.

  Why this is correct

  HTTPS ensures that all data exchanged between the application and the DynamoDB API endpoint is protected in transit, preventing eavesdropping and man-in-the-middle attacks. DynamoDB only exposes a secure HTTPS endpoint, so making HTTPS a mandatory call policy is a valid transport-layer control for sensitive data.

• ✗

  Use TLS 1.2 for all connections.

  Why it's wrong here

  DynamoDB already enforces TLS 1.2 (and now TLS 1.3) on its HTTPS endpoints, so this is not an action the developer must take; there is no DynamoDB setting to enable or disable TLS versions. Treating it as a separate security configuration is redundant and reflects a common misconception that TLS is optional or needs to be enabled, whereas it is already the default for all API calls.

• ✗

  Implement client-side encryption before writing items to DynamoDB.

  Why it's wrong here

  Client-side encryption would encrypt items before they leave the application, protecting data even if the network or server-side configuration were compromised, but it is not required when server-side encryption at rest and HTTPS are already in place. It also introduces key management complexity, because the client must manage its own encryption keys and the encrypted attributes become opaque to DynamoDB queries such as filtering and indexing. Therefore, it is an optional defense-in-depth measure, not a necessary or mandated control for this requirement.