How to Create a DynamoDB Table with an AWS-Owned Encryption Key?

DVA-C02 By islever Editorial Last updated

Short answer

D Create the DynamoDB table with the default encryption options.

Question

A developer is creating an Amazon DynamoDB table by using the AWS CLI. The DynamoDB table must use server-side encryption with an AWS owned encryption key. How should the developer create the DynamoDB table to meet these requirements?
  1. Create an AWS Key Management Service (AWS KMS) customer managed key. Provide the key's Amazon Resource Name (ARN) in the KMSMasterKeyId parameter during creation of the DynamoDB table.
  2. Create an AWS Key Management Service (AWS KMS) AWS managed key. Provide the key's Amazon Resource Name (ARN) in the KMSMasterKeyId parameter during creation of the DynamoDB table.
  3. Create an AWS owned key. Provide the key's Amazon Resource Name (ARN) in the KMSMasterKeyId parameter during creation of the DynamoDB table.
  4. Create the DynamoDB table with the default encryption options. Correct Answer

Key Takeaways

This question tests your understanding of DynamoDB's default server-side encryption and the difference between AWS-owned, AWS-managed, and customer-managed KMS keys. The trap is assuming you must explicitly specify a key ARN when the default option already satisfies the requirement.

To use an AWS-owned encryption key for Amazon DynamoDB, simply create the table with default encryption settings—no KMS key ARN is required. Community experts confirm that DynamoDB encrypts data at rest with AWS-owned keys by default.

Common mistake: A common mistake is choosing option C, which mentions creating an AWS-owned key and providing its ARN. AWS-owned keys are not created by users and have no ARN to supply; using the default encryption options automatically enables them.

Expert Analysis

Why the Answer Is Correct

DynamoDB uses server-side encryption (SSE) at rest by default, and the default encryption settings use AWS-owned keys. These keys are managed by AWS and do not require you to specify any KMS key ID or ARN during table creation. As comment [1] notes, using the default encryption option is the simplest way to meet the requirement without adding unnecessary configuration. The other options ask you to supply a KMSMasterKeyId, which is only needed when you want to use an AWS-managed or customer-managed key.

Why the Other Options Are Wrong

Options A, B, and C all instruct you to provide a key ARN in the KMSMasterKeyId parameter. AWS-owned keys cannot be created, do not have ARNs, and are not specified in table creation. Option B is incorrect because an AWS-managed key (aws/dynamodb) is not the same as an AWS-owned key, and specifying it would override the default. Option A requires unnecessary customer-managed key setup, and Option C falsely assumes AWS-owned keys have ARNs.

Community Comment Notes

Comment [2] and [3] direct learners to the official DynamoDB encryption at rest documentation, emphasizing that you can switch between key types at any time. Comment [5] provides a sample create-table CLI command without a KMSMasterKeyId, demonstrating the default behavior. The community unanimously voted for D (100%), reinforcing that no key ARN is needed for AWS-owned encryption.

Official Reference

https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/EncryptionAtRest.html

This link opens the official vendor documentation in a new tab.

Exam Strategy

Remember: if the question says 'AWS-owned key' or 'default encryption,' the answer is to omit KMSMasterKeyId. In the exam, look for wording about providing an ARN—if it's not needed, choose the default option.

Community Votes

D
100%

100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 6 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 6

  1. SerialiDr 👍 3 Answered D
    When creating a DynamoDB table, if no specific encryption options are provided, it uses the default encryption setting which is server-side encryption with AWS managed keys (SSE with AWS owned key). This option does not require specifying a key ARN in the creation process, making it the simplest and most straightforward way to ensure data at rest is encrypted using keys managed by AWS.
  2. Anandesh 👍 2 Answered D
    https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/EncryptionAtRest.html You can switch between key types at any time
  3. KarBiswa 👍 2 Answered D
    https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/EncryptionAtRest.html
  4. CrescentShared 👍 2 Answered D
    D is good enough to meet the requirement.
  5. albert_kuo 👍 1 Answered D
    aws dynamodb create-table \ --table-name MyTable \ --attribute-definitions AttributeName=Id,AttributeType=S \ --key-schema AttributeName=Id,KeyType=HASH \ --billing-mode PAY_PER_REQUEST
Show 1 more comment
  1. 65703c1 👍 1 Answered D
    D is the correct answer.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

How to Log Every Lambda Invocation to an SQS Queue?

S-grade

How to Test Updated Lambda Functions with a Subset of Users Using API Gateway?

S-grade

How to automate S3 object tagging after delayed third-party content audit?

S-grade

How to automatically rotate encryption keys for API keys in serverless apps with no development effort?

S-grade

Practice All DVA-C02 Questions

Access 100 questions with complete answers and detailed explanations.

View Full DVA-C02 Practice Test →

← Back to DVA-C02 Study Guide