How to Create a DynamoDB Table with an AWS-Owned Encryption Key?

A developer is creating an Amazon DynamoDB table by using the AWS CLI. The DynamoDB table must use server-side encryption with an AWS owned encryption key. How should the developer create the DynamoDB table to meet these requirements?

Create an AWS Key Management Service (AWS KMS) customer managed key. Provide the key's Amazon Resource Name (ARN) in the KMSMasterKeyId parameter during creation of the DynamoDB table.
Create an AWS Key Management Service (AWS KMS) AWS managed key. Provide the key's Amazon Resource Name (ARN) in the KMSMasterKeyId parameter during creation of the DynamoDB table.
Create an AWS owned key. Provide the key's Amazon Resource Name (ARN) in the KMSMasterKeyId parameter during creation of the DynamoDB table.
Create the DynamoDB table with the default encryption options. Source Reference Answer

Community Votes

100%

100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

This question tests your understanding of DynamoDB's default server-side encryption and the difference between AWS-owned, AWS-managed, and customer-managed KMS keys. The trap is assuming you must explicitly specify a key ARN when the default option already satisfies the requirement.

To use an AWS-owned encryption key for Amazon DynamoDB, simply create the table with default encryption settings—no KMS key ARN is required. Community experts confirm that DynamoDB encrypts data at rest with AWS-owned keys by default.

A common mistake is choosing option C, which mentions creating an AWS-owned key and providing its ARN. AWS-owned keys are not created by users and have no ARN to supply; using the default encryption options automatically enables them.

Community Discussion (6 comments)

albert_kuo 👍 1 Selected: D

aws dynamodb create-table \ --table-name MyTable \ --attribute-definitions AttributeName=Id,AttributeType=S \ --key-schema AttributeName=Id,KeyType=HASH \ --billing-mode PAY_PER_REQUEST

Anandesh 👍 2 Selected: D

https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/EncryptionAtRest.html You can switch between key types at any time

65703c1 👍 1 Selected: D

D is the correct answer.

SerialiDr 👍 3 Selected: D

When creating a DynamoDB table, if no specific encryption options are provided, it uses the default encryption setting which is server-side encryption with AWS managed keys (SSE with AWS owned key). This option does not require specifying a key ARN in the creation process, making it the simplest and most straightforward way to ensure data at rest is encrypted using keys managed by AWS.

KarBiswa 👍 2 Selected: D

https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/EncryptionAtRest.html

CrescentShared 👍 2 Selected: D

D is good enough to meet the requirement.

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Expert Analysis

Why the Answer Is Correct

DynamoDB uses server-side encryption (SSE) at rest by default, and the default encryption settings use AWS-owned keys. These keys are managed by AWS and do not require you to specify any KMS key ID or ARN during table creation. As comment [1] notes, using the default encryption option is the simplest way to meet the requirement without adding unnecessary configuration. The other options ask you to supply a KMSMasterKeyId, which is only needed when you want to use an AWS-managed or customer-managed key.

Why the Other Options Are Wrong

Options A, B, and C all instruct you to provide a key ARN in the KMSMasterKeyId parameter. AWS-owned keys cannot be created, do not have ARNs, and are not specified in table creation. Option B is incorrect because an AWS-managed key (aws/dynamodb) is not the same as an AWS-owned key, and specifying it would override the default. Option A requires unnecessary customer-managed key setup, and Option C falsely assumes AWS-owned keys have ARNs.

Community Comment Notes

Comment [2] and [3] direct learners to the official DynamoDB encryption at rest documentation, emphasizing that you can switch between key types at any time. Comment [5] provides a sample create-table CLI command without a KMSMasterKeyId, demonstrating the default behavior. The community unanimously voted for D (100%), reinforcing that no key ARN is needed for AWS-owned encryption.

Official Reference

https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/EncryptionAtRest.html

Exam Strategy

Remember: if the question says 'AWS-owned key' or 'default encryption,' the answer is to omit KMSMasterKeyId. In the exam, look for wording about providing an ARN—if it's not needed, choose the default option.

Related Analysis

Practice All DVA-C02 Questions

Access 100 questions with complete answers and detailed explanations.

View Full DVA-C02 Practice Test →

← Back to DVA-C02 Study Guide