EMR to S3 Encryption in Transit Using TLS
A company runs an Amazon EMR cluster that processes sensitive data stored in Amazon S3. The security team requires that all data in transit between the EMR cluster and S3 be encrypted. Which configuration ensures this requirement is met?
Quick Answer
The correct choice is to configure the S3 endpoint to use TLS and ensure the EMR cluster uses HTTPS for S3 access. This works because TLS (Transport Layer Security) encrypts the data channel between the EMR cluster and S3, while HTTPS is the application-layer protocol that enforces that encryption for every S3 request made by the cluster. On the AWS Certified Data Engineer Associate DEA-C01 exam, this question tests your ability to distinguish between encryption in transit and encryption at rest—a common trap is confusing SSE-S3 (which protects data at rest in S3) with TLS-based transit encryption. Remember that S3 endpoints can be configured with a policy that denies HTTP requests, forcing all traffic to use HTTPS, which is the key to enforcing EMR to S3 encryption in transit. A useful memory tip: “Transit needs TLS, rest needs SSE.”
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure the S3 endpoint to use TLS and ensure the EMR cluster uses HTTPS for S3 access.
Configuring the S3 endpoint to use TLS and ensuring the EMR cluster uses HTTPS for S3 access enforces encryption in transit between the cluster and S3. Option A is incorrect because enabling in-transit encryption within the EMR cluster using EMRFS encrypts data within the cluster, not data between the cluster and S3. Option B is incorrect because SSE-S3 encrypts data at rest on S3, not data in transit. Option D is incorrect because an S3 access point with a bucket policy denying HTTP requests does not directly configure encryption in transit from the EMR cluster; it only denies non-HTTPS requests, but the cluster could still use HTTPS, and this is a bucket-level enforcement, not a direct configuration for the cluster.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable in-transit encryption within the EMR cluster using EMRFS.
Why it's wrong here
EMRFS can use SSE but does not enforce TLS for S3 communication.
- ✗
Enable server-side encryption with S3 managed keys (SSE-S3) on the S3 bucket.
Why it's wrong here
SSE-S3 encrypts data at rest, not in transit.
- ✓
Configure the S3 endpoint to use TLS and ensure the EMR cluster uses HTTPS for S3 access.
Why this is correct
TLS encrypts data in transit between EMR and S3.
- ✗
Use an S3 access point with a bucket policy that denies HTTP requests.
Why it's wrong here
Access points do not enforce encryption in transit; a bucket policy can deny HTTP but that's not the same as configuring TLS.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 1,711 original DEA-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on DEA-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A data engineer is setting up an Amazon EMR cluster to process sensitive data. The data is stored in S3 with SSE-S3. The company policy requires that data in transit between the EMR cluster and S3 be encrypted. Which configuration should be used?
hard- ✓ A.Enable S3 encryption in transit using TLS
- B.Disable encryption and use VPC endpoints
- C.Configure EMRFS to use SSE-KMS
- D.Use SSE-C for S3 objects
Why A: Enabling S3 encryption in transit using TLS encrypts data between the EMR cluster and S3. Amazon S3 supports HTTPS (TLS) endpoints by default, and this ensures that data is encrypted during transfer. Option B is wrong because disabling encryption is not allowed per policy. Option C is incorrect because EMRFS with SSE-KMS encrypts data at rest, not in transit. Option D is wrong because SSE-C is also an at-rest encryption mechanism, not for transit.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DEA-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DEA-C01 exam.