DEA-C01 Data Store Management Practice Question
A company is using Amazon S3 to store sensitive financial data. They need to ensure that all objects are encrypted at rest. Which TWO methods can achieve this? (Choose TWO.)
⚠ Common exam trap
The trap here is that candidates might think client-side encryption (Option D) is not a valid method for encryption at rest, or they might confuse S3 Transfer Acceleration (Option A) with encryption, or believe that a bucket policy (Option B) alone encrypts objects rather than just enforcing encryption requirements.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use SSE-KMS to encrypt objects with AWS KMS.
SSE-KMS (Server-Side Encryption with AWS Key Management Service) allows you to encrypt objects at rest in S3 using customer-managed or AWS-managed KMS keys. This provides envelope encryption, separate key management, and audit trails via AWS CloudTrail, meeting compliance requirements for sensitive financial data.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable S3 Transfer Acceleration on the bucket.
Why it's wrong here
Transfer Acceleration improves upload speed, not encryption.
- ✗
Apply a bucket policy that denies PutObject without encryption.
Why it's wrong here
This policy enforces encryption but does not actually encrypt objects; objects could still be uploaded with SSE-C.
- ✓
Use SSE-KMS to encrypt objects with AWS KMS.
Why this is correct
SSE-KMS provides server-side encryption with customer-managed keys.
- ✗
Use client-side encryption before uploading objects.
Why it's wrong here
Client-side encryption is performed by the client, not S3; it does not ensure at-rest encryption within S3.
- ✓
Enable default encryption on the S3 bucket using SSE-S3.
Why this is correct
SSE-S3 provides server-side encryption with Amazon S3-managed keys.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This DEA-C01 question is part of Courseiva's 1,711-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on DEA-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company stores sensitive data in Amazon S3. They need to ensure that all objects are encrypted at rest. Which approach meets this requirement with minimal effort?
medium- A.Use client-side encryption before uploading
- ✓ B.Enable default encryption on the S3 bucket with SSE-S3
- C.Enable S3 Versioning and MFA Delete
- D.Use a bucket policy to deny PutObject without encryption
Why B: Enabling default encryption on an S3 bucket with SSE-S3 (Server-Side Encryption with S3-Managed Keys) automatically encrypts all objects at rest using AES-256, with no additional effort from the user. This ensures that any object uploaded without explicit encryption headers is encrypted by default, meeting the requirement with minimal configuration overhead.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DEA-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DEA-C01 exam.