DEA-C01 Data Security and Governance Practice Question
A company is using AWS KMS with customer-managed keys to encrypt data in Amazon RDS. The security team wants to ensure that the key can be rotated automatically every year. Which THREE steps are required to achieve automatic key rotation?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable automatic key rotation in the KMS key configuration.
Options B, C, and D are correct. To enable automatic rotation for a customer-managed KMS key, you must enable rotation via the KMS console or API (B), ensure the key is a symmetric key (C) as asymmetric keys do not support automatic rotation, and configure the RDS instance to use the key (D) for encryption. Option A is incorrect because rotation can be enabled for existing keys. Option E is incorrect because CloudHSM is not involved.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Migrate the key to AWS CloudHSM.
Why it's wrong here
CloudHSM is not required for automatic rotation.
- ✓
Enable automatic key rotation in the KMS key configuration.
Why this is correct
This is required to rotate the key automatically.
- ✓
Use a symmetric KMS key.
Why this is correct
Only symmetric keys support automatic rotation.
- ✓
Configure the RDS instance to use the KMS key for encryption.
Why this is correct
RDS must be configured to use the KMS key.
- ✗
Create a new KMS key and configure RDS to use it.
Why it's wrong here
Automatic rotation can be enabled on existing customer-managed keys.
Quick reference
Symmetric Encryption Algorithm Comparison
| Algorithm | Key Size | Block Size | Status | Notes |
|---|---|---|---|---|
| AES-128 | 128-bit | 128-bit | Current standard | NIST approved; WPA3, TLS |
| AES-256 | 256-bit | 128-bit | Current standard | Preferred for sensitive / govt data |
| 3DES | 112-bit effective | 64-bit | Deprecated (2023) | Replaced by AES |
| DES | 56-bit | 64-bit | Broken | Cracked in < 24 h; never deploy |
| ChaCha20 | 256-bit | Stream cipher | Current | TLS 1.3, WireGuard |
Go deeper
Related to this question
About these practice questions
One of 1,711 original DEA-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
3 more ways this is tested on DEA-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Refer to the exhibit. A data engineer runs the commands shown. What can be determined about the key with ID 1234abcd-12ab-34cd-56ef-1234567890ab?
hard- A.It is pending deletion.
- B.It was created in us-west-2.
- C.It is a customer managed key.
- ✓ D.It is an AWS managed key.
Why D: The command output shows that the key's KeyManager is 'AWS', indicating it is an AWS managed key, which corresponds to option D. Option A is incorrect because the key state is 'Enabled', not 'PendingDeletion'. Option B is incorrect because the ARN does not specify a region; the key was created in us-east-1 by default. Option C is incorrect because AWS managed keys have KeyManager set to 'AWS', not 'CUSTOMER'.
Variation 2. Refer to the exhibit. The exhibit shows output from AWS CLI commands. Which key can be used to enable automatic annual rotation?
medium- A.The second key (5678efgh-...)
- B.Both keys
- C.Neither key
- ✓ D.The first key (1234abcd-...)
Why D: (the first key) is correct because automatic annual rotation is only configurable for customer managed keys. The first key is customer managed, allowing the user to enable or disable automatic rotation with a specified frequency (e.g., annually). The second key is AWS managed, which rotates automatically every three years without user configuration, so its rotation cannot be enabled or disabled by the user. Options A and B are incorrect because the second key (AWS managed) does not support user-controlled automatic rotation, and both keys cannot have rotation configured independently. Option C is incorrect because the first key (customer managed) does support automatic annual rotation.
Variation 3. A company uses AWS KMS to encrypt sensitive data stored in S3. To meet compliance requirements, they need to ensure that the encryption keys are automatically rotated every year. Which type of KMS key should they use?
hard- A.Customer managed key with manual rotation
- B.AWS managed key
- C.Custom key store (CloudHSM) key
- ✓ D.Customer managed key with automatic rotation enabled
Why D: Customer managed keys with automatic rotation enabled support automatic annual rotation, meeting the compliance requirement. AWS managed keys rotate automatically every year, but they cannot be controlled or customized by the customer, so they are not the best choice when the customer needs to manage the key policy or rotation schedule. Custom key stores (CloudHSM) do not support automatic rotation. Option A (customer managed key with manual rotation) requires manual intervention to rotate, not automatic. Therefore, D is the correct answer.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DEA-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DEA-C01 exam.