DEA-C01 Data Security and Governance Practice Question
A company is using Amazon Redshift for data warehousing. They need to ensure that data is encrypted at rest and in transit. Which TWO configurations are required to meet these requirements?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable encryption on the Redshift cluster using AWS KMS.
To encrypt data at rest in Amazon Redshift, you must enable encryption on the cluster using AWS KMS (Option A). To encrypt data in transit, you must configure the cluster to require SSL connections (Option B). Option C (CloudHSM) can be used for key management but is not a required configuration. Option D (VPC Flow Logs) captures network metadata and does not encrypt traffic. Option E (EBS encryption) is not applicable to Redshift's managed storage.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Enable encryption on the Redshift cluster using AWS KMS.
Why this is correct
KMS encrypts data at rest.
- ✓
Configure the Redshift cluster to require SSL connections.
Why this is correct
SSL encrypts data in transit.
- ✗
Use AWS CloudHSM to manage encryption keys for Redshift.
Why it's wrong here
Redshift does not support CloudHSM; it uses KMS.
- ✗
Enable VPC Flow Logs on the Redshift subnet.
Why it's wrong here
Flow Logs do not provide encryption.
- ✗
Enable EBS encryption on the Redshift cluster nodes.
Why it's wrong here
Redshift uses its own encryption; EBS encryption is not required.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every DEA-C01 question from scratch — 1,711 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on DEA-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company uses Amazon Redshift for data warehousing. The security team requires that all data in transit between the Redshift cluster and clients be encrypted. Which feature should be enabled?
easy- A.Client-side VPN
- ✓ B.SSL/TLS encryption
- C.AWS KMS key
- D.VPC peering
Why B: Amazon Redshift supports SSL/TLS encryption for client connections to ensure data in transit is encrypted. Option A (Client-side VPN) is not a Redshift feature for encrypting client connections. Option C (AWS KMS key) is used for encrypting data at rest, not in transit. Option D (VPC peering) does not provide encryption of data in transit between the cluster and clients.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DEA-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DEA-C01 exam.