nerdexam
Amazon

DVA-C02 · Question #264

A developer needs to use Amazon DynamoDB to store customer orders. The developer's company requires all customer data to be encrypted at rest with a key that the company generates. What should the…

The correct answer is B. Store the key by using AWS Key Management Service (AWS KMS). Choose an AWS KMS. To use a company-generated encryption key for DynamoDB at rest, the key must be stored in AWS KMS as a customer managed key (CMK) and the DynamoDB table must be configured to use that CMK.

Submitted by yuriko_h· Mar 5, 2026Security

Question

A developer needs to use Amazon DynamoDB to store customer orders. The developer's company requires all customer data to be encrypted at rest with a key that the company generates. What should the developer do to meet these requirements?

Options

  • ACreate the DynamoDB table with encryption set to None. Code the application to use the key to
  • BStore the key by using AWS Key Management Service (AWS KMS). Choose an AWS KMS
  • CStore the key by using AWS Key Management Service (AWS KMS). Create the DynamoDB table
  • DStore the key by using AWS Key Management Service (AWS KMS). Choose an AWS KMS AWS

How the community answered

(71 responses)
  • A
    7% (5)
  • B
    77% (55)
  • C
    4% (3)
  • D
    11% (8)

Why each option

To use a company-generated encryption key for DynamoDB at rest, the key must be stored in AWS KMS as a customer managed key (CMK) and the DynamoDB table must be configured to use that CMK.

ACreate the DynamoDB table with encryption set to None. Code the application to use the key to

Setting encryption to None and handling encryption in application code is error-prone, bypasses DynamoDB's native encryption integration, and does not use KMS for key management as intended.

BStore the key by using AWS Key Management Service (AWS KMS). Choose an AWS KMSCorrect

Storing the key in AWS KMS as a customer managed key (CMK) and selecting that CMK when creating or updating the DynamoDB table configures server-side encryption (SSE) with a customer-managed key. DynamoDB integrates natively with KMS to encrypt data at rest using the specified CMK, satisfying both the encryption and key-ownership requirements.

CStore the key by using AWS Key Management Service (AWS KMS). Create the DynamoDB table

This option is a distractor; while storing the key in KMS is correct, the specifics of this choice conflict with using a true customer managed key (CMK) versus an AWS managed key, or the table configuration is incorrect.

DStore the key by using AWS Key Management Service (AWS KMS). Choose an AWS KMS AWS

Using an AWS managed KMS key means AWS controls the key material and rotation, which does not satisfy the requirement that the company generates and controls the key.

Concept tested: DynamoDB encryption at rest with customer managed KMS key

Source: https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/EncryptionAtRest.html

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full DVA-C02 Practice