DEA-C01 Data Store Management Practice Question
A company stores sensitive data in an Amazon S3 bucket. A compliance requirement mandates that all data must be encrypted at rest with a key that is automatically rotated every year. The company also needs to maintain an audit trail of who used the key. Which solution meets these requirements?
⚠ Common exam trap
Test-takers frequently confuse SSE-S3's automatic rotation (which is invisible and lacks audit trails) with SSE-KMS's automatic rotation (which provides both rotation and CloudTrail logging), or they mistakenly think SSE-C or bucket policies can satisfy the audit trail requirement.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use AWS KMS customer managed keys (SSE-KMS) with automatic key rotation enabled.
AWS KMS customer managed keys (SSE-KMS) with automatic key rotation enabled satisfies both requirements: it encrypts data at rest in S3 and automatically rotates the KMS key every year. Additionally, KMS integrates with AWS CloudTrail to log every API call (e.g., Decrypt, GenerateDataKey) that uses the key, providing an audit trail of who used the key and when.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use AWS KMS customer managed keys (SSE-KMS) with automatic key rotation enabled.
Why this is correct
KMS customer managed keys support automatic annual rotation and CloudTrail auditing.
- ✗
Use customer-provided encryption keys (SSE-C) and rotate keys manually.
Why it's wrong here
SSE-C requires customer to manage and rotate keys; no automatic rotation.
- ✗
Use S3 managed keys (SSE-S3) and enable S3 server access logs.
Why it's wrong here
SSE-S3 does not provide key usage audit trail.
- ✗
Configure a bucket policy to enforce encryption using the 'aws:SecureTransport' condition.
Why it's wrong here
Bucket policy enforces encryption in transit, not at rest.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every DEA-C01 question from scratch — 1,711 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on DEA-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company stores sensitive customer data in an Amazon S3 bucket. The security team requires that all data be encrypted at rest using a key that is automatically rotated every year. Which encryption solution should the data engineer use?
medium- A.SSE-S3
- ✓ B.SSE-KMS with a customer managed key
- C.SSE-C
- D.Client-side encryption
Why B: SSE-KMS with a customer managed key is correct because it allows you to use an AWS KMS key that you control, enabling automatic annual key rotation via the KMS key rotation feature. This satisfies the security team's requirement for encryption at rest with a key that is automatically rotated every year, while maintaining control over the key lifecycle.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DEA-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DEA-C01 exam.