SAA-C03 Q100 · Security

Question

A company discovers that an Amazon DynamoDB Accelerator (DAX) cluster for the company's web application workload is not encrypting data at rest. The company needs to resolve thesecurity issue. Which solution will meet this requirement?

Accepted Answer

**Answer B is correct** because DAX encryption at rest is an **immutable setting** — it can only be configured at cluster creation time.

**Step-by-step reasoning:**
1. **Requirement**: The existing DAX cluster lacks encryption at rest and must be secured.
2. **DAX Limitation**: Unlike some AWS services that allow you to toggle encryption, DAX encryption at rest is a **create-time only** setting. Once a cluster is created without encryption, you **cannot** retroactively enable it.
3. **Solution**: The only path is to **delete the existing cluster** and **recreate a new one** with encryption at rest enabled during the creation process.
4. **Implementation**: During recreation, you specify `--sse-specification Enabled=true` in the CLI or check the encryption option in the console. The new cl

📖 Explanation

✅ Correct Answer

❌ Wrong Answers

📘 Key Concepts

🏗️ Architecture

⚙️ Operations

💰 Cost

🔒 Security

🎯 Exam Tips