DVA-C02 Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Server-side encryption with a customer-managed KMS key

  Why this is correct

  Server-side encryption with a customer-managed KMS key (CMK) is the most appropriate choice for sensitive data like credit card payments. This option grants the company's security team full administrative control over the encryption key's policy, rotation schedule, and access permissions within AWS Key Management Service (KMS). Such granular control is often a strict requirement for compliance standards like PCI DSS, ensuring the organization maintains ownership and oversight of its cryptographic assets used for data at rest in DynamoDB.

• ✗

  Server-side encryption with an AWS managed KMS key

  Why it's wrong here

  Server-side encryption with an AWS managed KMS key (AWS_KMS) is less suitable for highly sensitive data requiring stringent compliance. While it provides server-side encryption for data at rest, the customer's security team has limited control over the key's lifecycle, policy, or audit trails, as AWS manages these aspects. For credit card payments, compliance frameworks typically mandate greater customer control over encryption keys than AWS managed keys offer, making this option insufficient.

• ✗

  Client-side encryption

  Why it's wrong here

  Client-side encryption involves encrypting data within the application before it is sent to DynamoDB, meaning the data is encrypted in transit and stored encrypted at rest. However, the question implies a need for encryption managed by the database service for data at rest, which is server-side encryption. Implementing client-side encryption adds significant complexity to the application code and requires the customer to manage key distribution and rotation on the client side, which is often more burdensome than leveraging AWS KMS for server-side encryption.

• ✗

  Static key encryption

  Why it's wrong here

  The term 'static key encryption' is not a recognized or supported encryption mechanism provided by AWS DynamoDB for server-side encryption. DynamoDB's server-side encryption (SSE) exclusively integrates with AWS Key Management Service (KMS) to manage and utilize encryption keys, offering robust features like automatic key rotation and detailed access control. Relying on a single, unchanging 'static key' without the advanced key management capabilities of KMS would introduce significant security vulnerabilities and fail to meet industry best practices for protecting sensitive data like credit card information.