Exam AWS Certified Developer Associate topic 1 question 288 discussion

With server-side encryption, TLS encrypts your data in transit over an HTTPS connection. Your data is decrypted at the DynamoDB endpoint, and then re-encrypted before being stored in DynamoDB. Client-side encryption provides end-to-end protection for your data from its source through storage in DynamoDB and back to you. https://docs.aws.amazon.com/kms/latest/developerguide/services-dynamodb.html

So, let's proceede by exclusion. A and B are for sure incorrect because the encryption at rest doesn't meet the requirements. Then, since we have to encrypt the data at each stage, also the HTTPS protocol is not suitable because it encrypt data in transit but when we store on the database, it won't be encoded. For this reason, also D is incorrect. TBH, I didn't know that there is the possibility to use client-side encryption by using the DynamoDB Encryption Client but it is, according to the documentation: https://docs.aws.amazon.com/crypto/latest/userguide/awscryp-service-ddb-client.html So C is for sure correct given that the client-side encryption will provide us encryption everywhere in the cloud

optionB is correct

C is the correct answer

Client-side and server-side encryption: "DynamoDB Encryption Client" supports client-side encryption, where you encrypt your table data before you send it to DynamoDB. However, DynamoDB provides a server-side encryption at rest feature that transparently encrypts your table when it is persisted to disk and decrypts it when you access the table. https://docs.aws.amazon.com/dynamodb-encryption-client/latest/devguide/client-server-side.html

https://docs.aws.amazon.com/kms/latest/developerguide/services-dynamodb.html In addition to encryption at rest, which is a server-side encryption feature, AWS provides the Amazon DynamoDB Encryption Client. This client-side encryption library enables you to protect your table data before submitting it to DynamoDB. With server-side encryption, TLS encrypts your data in transit over an HTTPS connection.

I'm going for B as the data needs to be encrypted at all times

Choosing A

C DynomoDB encryts at rest by default using AWS owned key. FOr transit , use client side encryption using DynamoDB encryption client