DEA-C01 Data Security and Governance Practice Question
A company is using Amazon EMR with Kerberos authentication. They want to ensure that data in transit between EMR cluster nodes is encrypted. Which configuration should be applied?
⚠ Common exam trap
The trap is confusing encryption at rest (EBS, S3 SSE) with encryption in transit; candidates often pick EBS or S3 encryption because they sound like security controls but do not secure node-to-node traffic.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure the EMR cluster to use in-transit encryption.
In-transit encryption on Amazon EMR is enabled through a security configuration that specifies a PEM certificate and, optionally, a TLS certificate provider, which encrypts traffic between cluster nodes and to the EMR service. This is the only option that directly addresses data in transit between nodes.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use VPC peering to connect the cluster nodes.
Why it's wrong here
VPC peering provides private network routing between VPCs; it does not encrypt traffic between EMR nodes, so it fails the in-transit encryption requirement. It is tempting because peering isolates traffic from the public internet, which is the right answer when the scenario asks for private connectivity between separate VPCs rather than Kerberos-protected node-to-node encryption.
- ✓
Configure the EMR cluster to use in-transit encryption.
Why this is correct
EMR security configurations enable in-transit encryption using TLS for inter-node communication, plus encryption of data within the cluster. This satisfies the requirement to encrypt data moving between EMR cluster nodes, which at-rest encryption and Kerberos alone do not provide.
- ✗
Enable S3 server-side encryption for the cluster's output data.
Why it's wrong here
S3 server-side encryption protects objects at rest in the bucket, not traffic between EMR cluster nodes. It is the right control for data stored in S3, whereas in-transit node encryption needs TLS enabled on the cluster.
- ✗
Enable EBS encryption on the cluster instances.
Why it's wrong here
EBS encryption protects data at rest on attached volumes, not traffic between cluster nodes, so it leaves inter-node transit unencrypted. It is tempting because EBS encryption is the standard control for securing EMR instance storage, and would be the right choice if the requirement were encrypting data at rest rather than in transit.
Go deeper
Related to this question
About these practice questions
One of 1,321 original DEA-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This DEA-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DEA-C01 exam.