DEA-C01 Data Store Management Practice Question

A company is designing a data lake on Amazon S3. The data includes personal identifiable information (PII). The data engineer must ensure that only authorized users can access the data, and that access is logged for auditing. Which combination of services should the data engineer use?

⚠ Common exam trap

It's easy for candidates to assume CloudTrail automatically logs all S3 operations, but it only logs management events by default; data events must be explicitly enabled, and many overlook this distinction when designing for auditing.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

S3 bucket policies with IAM policies and AWS CloudTrail with data events

S3 bucket policies combined with IAM policies provide fine-grained access control to restrict who can access the data, while AWS CloudTrail with data events logs every S3 object-level operation (e.g., GetObject, PutObject) for auditing. This combination directly meets the requirements of authorized access and logging for PII data.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
S3 bucket policies with IAM policies and AWS CloudTrail with data events
Why this is correct
S3 bucket policies and IAM policies together enforce least-privilege authorisation on the PII objects, while CloudTrail data events capture object-level API activity such as GetObject, satisfying the auditing requirement that management events alone would not record.
✗
Amazon S3 access points and VPC endpoints
Why it's wrong here
Access points and VPC endpoints control network reachability and per-application access policies, but neither writes access events to an audit log; CloudTrail data events and S3 server access logging do. They are tempting because access points do simplify scaling bucket policies for many applications.
✗
Amazon Macie to discover PII and S3 Object Lock to prevent deletion
Why it's wrong here
Amazon Macie classifies and discovers PII but does not enforce per-user access control, and S3 Object Lock only enforces WORM retention against deletion or overwrite — neither authorises users nor records access events. Macie suits data-discovery audits, and Object Lock suits compliance retention, so this pairing addresses classification and immutability rather than the required authorisation and access logging.
✗
AWS KMS to encrypt data and AWS CloudTrail to log access
Why it's wrong here
KMS encrypts data at rest but does not itself restrict which users may read objects; CloudTrail logs API activity yet grants no access control. The option omits the identity-based authorisation layer. It tempts because encryption and logging are both required, but neither enforces per-user access.

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

DEA-C01 Data Store Management Practice Question

Why each option matters

Option-by-option breakdown

AWS S3 Storage Class Comparison

Related to this question