DEA-C01 Data Security and Governance Practice Question
A company is building a data pipeline that ingests sensitive customer data from an on-premises database into Amazon S3 using AWS DMS. The data must be encrypted at rest in S3 and in transit. The security team requires that the encryption keys be managed by the company (not AWS). Which TWO actions should the data engineer take to meet these requirements? (Choose TWO.)
⚠ Common exam trap
A common mix-up: candidates confuse encryption at rest with encryption in transit, and mistakenly think that KMS keys can be used for both, or that default DMS encryption or SSE-S3 satisfies the customer-managed key requirement.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure the S3 bucket to use server-side encryption with AWS KMS (SSE-KMS) using a customer managed key.
Option B is correct because SSE-KMS with a customer managed key lets the company own and control the KMS key that protects the data at rest in Amazon S3, satisfying the requirement that keys be managed by the company rather than AWS. Option D is correct because enabling SSL/TLS on the DMS source and target endpoints encrypts data in transit between the on-premises database and Amazon S3, which is the required in-transit protection. Option A is incorrect because the default DMS encryption settings do not provide company-managed keys for S3 data at rest. Option C is incorrect because SSE-S3 uses S3-managed keys, which AWS controls, not the company. Option E is incorrect because KMS keys are used for encryption at rest, not for encrypting DMS data in transit; in-transit encryption is handled by SSL/TLS on the endpoints.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable encryption at rest using the default DMS encryption settings.
Why it's wrong here
Default DMS encryption settings use AWS-managed keys, so the company does not control the keys as the security team demands. It is tempting because it satisfies encryption at rest with minimal configuration, but it would be correct only where AWS-owned key management is acceptable.
- ✓
Configure the S3 bucket to use server-side encryption with AWS KMS (SSE-KMS) using a customer managed key.
Why this is correct
SSE-KMS with a customer managed key encrypts objects at rest while the company retains control over key rotation and access policy, satisfying the requirement that keys not be AWS-managed. It also complements TLS for the in-transit requirement.
- ✗
Configure the S3 bucket to use server-side encryption with S3 managed keys (SSE-S3).
Why it's wrong here
SSE-S3 has AWS generate and hold the data keys, so the company does not manage them, breaching the stated requirement. It is tempting because SSE-S3 is the zero-configuration default for S3 encryption at rest, and would be correct where AWS-owned key management is acceptable.
- ✓
Enable SSL/TLS encryption on the DMS source and target endpoints.
Why this is correct
Enabling SSL/TLS on the DMS source and target endpoints encrypts replication traffic in transit, satisfying the in-transit requirement. This is separate from the at-rest requirement, which needs customer-managed keys via SSE-KMS or SSE-C on the S3 target.
- ✗
Create an AWS KMS key and use it in the DMS endpoint to encrypt data in transit.
Why it's wrong here
KMS keys encrypt data at rest; DMS in-transit encryption uses TLS certificates on the endpoint, not a KMS key. It is tempting because KMS is the company-managed key service the stem demands, but that requirement applies to the S3 at-rest layer.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This DEA-C01 question is part of Courseiva's 1,321-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DEA-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DEA-C01 exam.