DVA-C02 Encryption at Rest, In Transit and Key Management Guide

Encryption questions on DVA-C02 usually look easy until they mix storage behavior, transport security, KMS permissions, and certificate handling into one stem. The exam wants you to know where encryption happens, who manages the keys, and which permission boundary can still block access.

Encryption at rest: Protection applied while data is stored in a database, object store, volume, or backup.

Encryption in transit: Protection applied while data moves between clients, services, or networks, usually through TLS.

What AWS is really testing here

AWS wants you to separate:

• at rest from in transit
• server-side from client-side encryption
• key usage from key permission
• certificate management from ordinary application secrets
• service access from decrypt rights

Choose the right encryption lane

Encryption decision flow

    flowchart TD
	    A["Data protection requirement"] --> B{"Data stored or moving?"}
	    B -->|"Stored"| C["Choose at-rest encryption model"]
	    B -->|"Moving"| D["Choose TLS / certificate path"]
	    C --> E{"Who encrypts?"}
	    E -->|"Service"| F["Server-side encryption"]
	    E -->|"Application"| G["Client-side encryption"]
	    C --> H["Check KMS key access if decryption fails"]

Strong answers usually keep three questions separate:

1. where is the data right now
2. who is performing the encryption
3. who is allowed to use the key

KMS is often the hidden blocker

DVA-C02 likes stems where IAM looks correct but the application still cannot decrypt. That usually means:

• the principal can call the service
• but the key policy, grant, or cross-account permission path still blocks KMS use

This is one of the clearest examples of why security questions need lane separation.

Rotation and cross-account use

If the question asks about operational security rather than app logic, key rotation may be the stronger answer. If it asks about decryption from another account, think about both the caller’s permissions and the key’s cross-account policy path.

Common traps

Decision order that usually wins

1. First classify the requirement as encryption at rest, encryption in transit, or key-usage authorization.
2. If the need is stored-data protection in a managed service, think server-side encryption at rest.
3. If traffic must be protected between client and service, think TLS and certificate management.
4. If decryption fails even though service access works, inspect the KMS permission path separately.
5. DVA-C02 often tests that service access and key access are related but distinct control paths.

Quiz