DEA-C01 Data Security and Governance Practice Question
A company is building a data pipeline that ingests sensitive customer data from an on-premises database into Amazon S3 using AWS DMS. The data must be encrypted at rest in S3 and in transit. The security team requires that the encryption keys be managed by the company (not AWS). Which TWO actions should the data engineer take to meet these requirements? (Choose TWO.)
⚠ Common exam trap
A common mix-up: candidates confuse encryption at rest with encryption in transit, and mistakenly think that KMS keys can be used for both, or that default DMS encryption or SSE-S3 satisfies the customer-managed key requirement.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure the S3 bucket to use server-side encryption with AWS KMS (SSE-KMS) using a customer managed key.
SSE-KMS with a customer managed key allows the company to control the encryption keys used for S3 server-side encryption, meeting the requirement that keys be managed by the company, not AWS. Option D is correct because enabling SSL/TLS on both the DMS source and target endpoints ensures data is encrypted in transit between the on-premises database and AWS DMS, and between DMS and S3, satisfying the in-transit encryption requirement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable encryption at rest using the default DMS encryption settings.
Why it's wrong here
DMS encryption at rest is for DMS internal storage, not S3; also does not meet customer-managed key requirement.
- ✓
Configure the S3 bucket to use server-side encryption with AWS KMS (SSE-KMS) using a customer managed key.
Why this is correct
Customer managed keys allow the company to control the keys.
- ✗
Configure the S3 bucket to use server-side encryption with S3 managed keys (SSE-S3).
Why it's wrong here
SSE-S3 uses AWS-managed keys, not customer-managed.
- ✓
Enable SSL/TLS encryption on the DMS source and target endpoints.
Why this is correct
This encrypts data in transit between DMS and the databases/S3.
- ✗
Create an AWS KMS key and use it in the DMS endpoint to encrypt data in transit.
Why it's wrong here
KMS keys are not used for transit encryption; SSL/TLS is used.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This DEA-C01 question is part of Courseiva's 1,711-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DEA-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DEA-C01 exam.