Encryption at rest and in transit in DynamoDB - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Understanding Encryption at Rest in DynamoDB

Which of the following statements correctly describes how DynamoDB handles encryption at rest?

A DynamoDB automatically encrypts all data at rest using AWS owned keys without any user configuration.

B Encryption at rest in DynamoDB requires manual setup of encryption keys and enabling encryption on each table.

C DynamoDB does not support encryption at rest; users must encrypt data before storing it.

D Encryption at rest is only available for DynamoDB global tables and not for standard tables.

💡 Hint

Think about the default security features AWS provides for DynamoDB data storage.

DynamoDB automatically encrypts all data at rest using AWS owned keys by default. Users can optionally use customer managed keys, but encryption is always enabled.

🧠 Conceptual

intermediate

Encryption in Transit for DynamoDB

How does DynamoDB ensure encryption in transit when clients communicate with the service?

A DynamoDB requires users to manually encrypt data before sending it over the network.

B Encryption in transit is not supported; clients must use VPNs to secure data transfer.

C DynamoDB uses HTTPS (TLS) to encrypt data in transit between clients and the service endpoints.

D Encryption in transit is only available when using AWS Direct Connect.

💡 Hint

Consider the standard protocol used for secure web communication.

DynamoDB uses HTTPS (TLS) by default to encrypt all data transmitted between clients and the service, ensuring data privacy and integrity during transit.

❓ query_result

advanced

Identifying Encryption Status from Table Description

Given the following AWS CLI command output snippet describing a DynamoDB table, what is the encryption status of the table?

{
  "Table": {
    "TableName": "Orders",
    "SSEDescription": {
      "Status": "ENABLED",
      "SSEType": "KMS",
      "KMSMasterKeyArn": "arn:aws:kms:us-east-1:123456789012:key/abcd-1234"
    }
  }
}

A The table uses AWS owned keys for encryption at rest.

B The table encryption is disabled.

C The table is not encrypted at rest because the status is ENABLED but SSEType is KMS.

D The table has server-side encryption enabled using a customer managed KMS key.

💡 Hint

Look at the SSEType and Status fields carefully.

The SSEDescription shows Status as ENABLED and SSEType as KMS, which means server-side encryption is active using a customer managed KMS key.

🔧 Debug

advanced

Troubleshooting Encryption in Transit Failure

A developer notices that data sent to DynamoDB is not encrypted in transit. Which of the following client configurations is most likely causing this issue?

A The client is using a VPN to connect to AWS.

B The client is using HTTP instead of HTTPS to connect to DynamoDB endpoints.

C The client has enabled encryption at rest but not encryption in transit.

D The client is using the AWS SDK with default settings.

💡 Hint

Consider the protocol used for secure communication.

Using HTTP instead of HTTPS means data is sent unencrypted over the network, causing encryption in transit to fail.

❓ optimization

expert

Optimizing DynamoDB Encryption Costs

You want to minimize costs related to encryption while maintaining strong security for your DynamoDB tables. Which approach best balances cost and security?

A Use AWS owned keys for server-side encryption instead of customer managed KMS keys.

B Disable encryption at rest and encrypt data manually before storing it.

C Use customer managed KMS keys with frequent key rotation enabled.

D Disable encryption in transit to reduce overhead.

💡 Hint

Think about the cost differences between AWS owned keys and customer managed keys.

AWS owned keys provide encryption at rest at no additional cost, while customer managed KMS keys incur charges. Disabling encryption or encryption in transit reduces security and is not recommended.