DEA-C01 Data Operations and Support Practice Question
A company stores sensitive data in Amazon S3 and requires that all data be encrypted at rest. The data is accessed by multiple AWS services. Which solution meets the encryption requirement with the LEAST operational overhead?
⚠ Common exam trap
DEA-C01 often tests the trade-off between security control and operational overhead, causing candidates to choose SSE-KMS for its stronger key management when the question emphasizes 'least operational overhead,' where SSE-S3 is the correct answer.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable S3 default encryption with SSE-S3
Enabling S3 default encryption with SSE-S3 applies AES-256 encryption automatically to all objects at rest with zero key management overhead. AWS manages the keys, and no per-request KMS calls are needed, making it the lowest operational overhead solution that meets the encryption-at-rest requirement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use server-side encryption with AWS KMS (SSE-KMS)
Why it's wrong here
SSE-KMS encrypts objects with AWS KMS keys and integrates natively with AWS services, but it still requires key policies, grants and IAM permissions to be designed and maintained, plus KMS request costs and possible throttling. It is tempting as the managed default, yet SSE-S3 removes that key administration entirely.
- ✗
Use client-side encryption with AWS KMS
Why it's wrong here
Client-side encryption requires the application to encrypt and decrypt every object itself, and each AWS service reading the data must handle that same key management, adding code and key-handling overhead. It is tempting when data must be encrypted before leaving the client, but the stem asks for least operational overhead across multiple services.
- ✗
Use server-side encryption with customer-provided keys (SSE-C)
Why it's wrong here
SSE-C requires every PUT and GET request to supply the same customer key, so each accessing AWS service must be configured with and transmit that key, creating ongoing operational burden. It is tempting because AWS never stores the key, which suits strict key-custody rules, but not a least-overhead requirement.
- ✓
Enable S3 default encryption with SSE-S3
Why this is correct
SSE-S3 lets Amazon S3 manage the encryption keys entirely, so no key policies, grants or per-service configuration are needed. It satisfies the at-rest encryption requirement for data accessed by multiple AWS services while adding the least operational overhead, unlike SSE-KMS or client-side encryption.
Quick reference
Symmetric Encryption Algorithm Comparison
| Algorithm | Key Size | Block Size | Status | Notes |
|---|---|---|---|---|
| AES-128 | 128-bit | 128-bit | Current standard | NIST approved; WPA3, TLS |
| AES-256 | 256-bit | 128-bit | Current standard | Preferred for sensitive / govt data |
| 3DES | 112-bit effective | 64-bit | Deprecated (2023) | Replaced by AES |
| DES | 56-bit | 64-bit | Broken | Cracked in < 24 h; never deploy |
| ChaCha20 | 256-bit | Stream cipher | Current | TLS 1.3, WireGuard |
Go deeper
Related to this question
About these practice questions
This DEA-C01 question is part of Courseiva's 1,321-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This DEA-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DEA-C01 exam.