DEA-C01 Data Store Management Practice Question
A company stores sensitive data in an Amazon S3 bucket. A compliance requirement mandates that all data must be encrypted at rest with a key that is automatically rotated every year. The company also needs to maintain an audit trail of who used the key. Which solution meets these requirements?
⚠ Common exam trap
Test-takers frequently confuse SSE-S3's automatic rotation (which is invisible and lacks audit trails) with SSE-KMS's automatic rotation (which provides both rotation and CloudTrail logging), or they mistakenly think SSE-C or bucket policies can satisfy the audit trail requirement.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use AWS KMS customer managed keys (SSE-KMS) with automatic key rotation enabled.
AWS KMS customer managed keys (SSE-KMS) with automatic key rotation enabled satisfies both requirements: it encrypts data at rest in S3 and automatically rotates the KMS key every year. Additionally, KMS integrates with AWS CloudTrail to log every API call (e.g., Decrypt, GenerateDataKey) that uses the key, providing an audit trail of who used the key and when.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use AWS KMS customer managed keys (SSE-KMS) with automatic key rotation enabled.
Why this is correct
AWS KMS customer managed keys with SSE-KMS satisfy both constraints: automatic annual rotation is configurable, and every cryptographic operation is logged to CloudTrail, providing the required audit trail of key usage. AWS managed keys rotate automatically but cannot be audited per-customer or configured to a yearly schedule.
- ✗
Use customer-provided encryption keys (SSE-C) and rotate keys manually.
Why it's wrong here
SSE-C keys are supplied and rotated by the customer, so S3 cannot perform the mandated automatic annual rotation, and CloudTrail key-usage events are unavailable because AWS never holds the key. It tempts when an organisation must retain full key custody outside AWS, such as strict data-residency rules.
- ✗
Use S3 managed keys (SSE-S3) and enable S3 server access logs.
Why it's wrong here
SSE-S3 rotates keys automatically but its keys are AWS-owned, so CloudTrail cannot record per-request key usage for an audit trail of who used the key. It suits scenarios needing baseline encryption at rest with no key-management or key-audit obligations.
- ✗
Configure a bucket policy to enforce encryption using the 'aws:SecureTransport' condition.
Why it's wrong here
The aws:SecureTransport condition only rejects requests made over HTTP, enforcing encryption in transit; it neither encrypts objects at rest nor creates a rotatable key. It is tempting because this condition is the standard way to mandate TLS for S3 access, and would be correct if the requirement concerned transport security rather than at-rest encryption with annual rotation and key-usage auditing.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every DEA-C01 question from scratch — 1,321 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on DEA-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company stores sensitive customer data in an Amazon S3 bucket. The security team requires that all data be encrypted at rest using a key that is automatically rotated every year. Which encryption solution should the data engineer use?
medium- A.SSE-S3
- ✓ B.SSE-KMS with a customer managed key
- C.SSE-C
- D.Client-side encryption
Why B: SSE-KMS with a customer managed key is correct because it allows you to use an AWS KMS key that you control, enabling automatic annual key rotation via the KMS key rotation feature. This satisfies the security team's requirement for encryption at rest with a key that is automatically rotated every year, while maintaining control over the key lifecycle.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DEA-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DEA-C01 exam.