DVA-C02 Question 172
Select 2A developer is designing a serverless application that stores sensitive customer information in an Amazon DynamoDB table. The application needs to ensure that data is encrypted at rest and encrypted in transit when being accessed via the AWS SDK. Which of the following actions should the developer take to meet these requirements?
- A
Enable DynamoDB encryption at rest using an AWS Key Management Service (AWS KMS) key.
- B
Use HTTPS endpoints for API calls to DynamoDB.
- C
Manually encrypt data within the application before storing it in DynamoDB.
- D
Use IAM policies to restrict access to the DynamoDB table.
- E
Enable DynamoDB Streams with encryption enabled.
Show answer and explanation
Correct answers: A, B
Explanation
To meet the requirements of encrypting data both at rest and in transit, the developer should enable DynamoDB encryption at rest using AWS KMS and ensure that all communications with DynamoDB use HTTPS. These actions ensure that data is securely encrypted when stored and during transmission. Other options, while potentially useful for security or other purposes, do not specifically address the encryption requirements in this scenario.
- A. Correct.
Correct. Enabling DynamoDB encryption at rest with AWS KMS ensures that the data stored in DynamoDB is encrypted on disk.
- B. Correct.
Correct. Using HTTPS endpoints ensures that data is encrypted in transit when being transmitted between the application and DynamoDB.
- C. Incorrect.
Incorrect. While manual encryption adds an additional layer of security, it is not necessary in this case because DynamoDB already supports encryption at rest natively.
- D. Incorrect.
Incorrect. IAM policies are used to restrict access but do not provide encryption for data at rest or in transit.
- E. Incorrect.
Incorrect. Enabling DynamoDB Streams does not address encryption at rest or in transit; it is used for change data capture.