A project manager says signing the Lambda deployment package with code signing means citizen SSN fields are encrypted at rest in DynamoDB. What distinction should the developer draw?
Select an answer to reveal the explanation.
Short Explanation
Signing the deployment ZIP proves who built it—integrity and authenticity. Encrypting SSN fields or table storage keeps secrets secret—confidentiality. The PM mixed the wax seal with the locked vault; the city still needs both stories where policy requires them.
Full Explanation
Code signing verifies that a deployment artifact is untampered and from an expected publisher; it does not encrypt application data at rest in DynamoDB. Confidentiality of stored citizen fields requires encryption controls such as DynamoDB encryption at rest, KMS, or application-level field encryption. The two concerns are complementary, not interchangeable.