A developer is creating an Amazon DynamoDB table by using the AWS CLI. The DynamoDB table must use server-side encryption with an AWS owned encryption key.
How should the developer create the DynamoDB table to meet these requirements?
A.
Create an AWS Key Management Service (AWS KMS) customer managed key. Provide the key’s Amazon Resource Name (ARN) in the KMSMasterKeyId parameter during creation of the DynamoDB table.
B.
Create an AWS Key Management Service (AWS KMS) AWS managed key. Provide the key’s Amazon Resource Name (ARN) in the KMSMasterKeyId parameter during creation of the DynamoDB table.
C.
Create an AWS owned key. Provide the key’s Amazon Resource Name (ARN) in the KMSMasterKeyId parameter during creation of the DynamoDB table.
D.
Create the DynamoDB table with the default encryption options.
If the question asked for "the access to DynamoDB should be monitored via CloudTrail" or "need a centralized place to store the key", we'd need to go with KMS. Since there are no such details, D option is acceptable.
D
The correct answer is D.
When creating an Amazon DynamoDB table using the AWS CLI, server-side encryption with an AWS owned encryption key is enabled by default. Therefore, the developer does not need to create an AWS KMS key or specify the KMSMasterKeyId parameter. Option A and B are incorrect because they suggest creating customer-managed and AWS-managed KMS keys, which are not needed in this scenario. Option C is also incorrect because AWS owned keys are automatically used for server-side encryption by default.
Thank you for your thorough explanation. You are actually the only one who correctly explained why D is the correct answer. Creating DynamoDB with CLI gives you access to AWS owned key by default. This is explained in the link here - https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/encryption.tutorial.html
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
a15ce96
1 year, 1 month agoa15ce96
1 year, 1 month agoAnkit1010
2 years, 2 months agoAgboolaKun
1 year, 10 months agoDrey
2 years, 2 months agoDrey
2 years, 2 months agoJulietHsu
2 years, 3 months agoKT_Yu
2 years, 3 months ago