DEA-C01 Data Store Management Practice Question

A company stores sensitive data in Amazon S3 and needs to ensure that data is encrypted at rest. The security team requires that the company manage its own encryption keys and have the ability to audit key usage. Which S3 encryption option should the data engineer choose?

⚠ Common exam trap

Watch out — candidates often confuse SSE-C with SSE-KMS; SSE-C lets you provide keys but does not offer built-in auditability of key usage.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Server-side encryption with AWS KMS keys (SSE-KMS)

SSE-KMS allows the use of AWS KMS customer managed keys, providing control over key management and auditability through CloudTrail. This satisfies the requirements for self-managed keys and auditing key usage. Other options either do not provide key control or lack auditability, making SSE-KMS the correct choice.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Client-side encryption with an AWS KMS key
Why it's wrong here
Client-side encryption encrypts data before uploading to S3, and the company manages the keys. While it provides control and potential auditability if using KMS, it requires more implementation effort and may not integrate as seamlessly with S3 features. The question asks for an S3 encryption option, and SSE-KMS is more directly aligned with managing keys and auditing via KMS.
✗
Server-side encryption with customer-provided keys (SSE-C)
Why it's wrong here
SSE-C requires the company to provide encryption keys with every request, and AWS does not store the keys. While the company manages the keys, there is no built-in audit trail for key usage because AWS does not track the keys. This makes it difficult to audit key usage, failing the security team's requirement for auditability.
✗
Server-side encryption with Amazon S3 managed keys (SSE-S3)
Why it's wrong here
SSE-S3 uses encryption keys managed entirely by Amazon S3. The company does not manage the keys, cannot audit key usage, and has no control over key rotation. While it provides encryption at rest, it does not meet the requirement for self-managed keys and auditability, so it is not suitable for this scenario.
✓
Server-side encryption with AWS KMS keys (SSE-KMS)
Why this is correct
SSE-KMS allows the company to use AWS KMS customer managed keys, giving them control over key management and the ability to audit key usage via AWS CloudTrail. This meets the requirements for self-managed keys and auditability. It also supports key rotation and granular access policies, making it the correct choice for sensitive data with strict security requirements.

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

DEA-C01 Data Store Management Practice Question

Why each option matters

Option-by-option breakdown

AWS S3 Storage Class Comparison

Related to this question