DEA-C01 Data Security and Governance Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Enable server-side encryption on the Kinesis stream using the StartStreamEncryption API with the customer-managed KMS key, and enable automatic key rotation on the KMS key.

  Why this is correct

  The StartStreamEncryption API enables server-side encryption for a Kinesis stream using a specified KMS key. By specifying a customer-managed key, the stream data is encrypted at rest with that key. Enabling automatic key rotation on the KMS key ensures the key is rotated annually, meeting the requirement. This is the correct and direct way to achieve both encryption and rotation.

• ✗

  Enable encryption at rest by setting the Kinesis stream's EncryptionType to KMS and specifying a customer-managed key, then manually rotate the key by creating a new key and updating the stream configuration every year.

  Why it's wrong here

  While setting EncryptionType to KMS with a customer-managed key is correct, manual rotation by creating a new key and updating the stream is operationally heavy and error-prone. AWS KMS supports automatic key rotation for customer-managed keys, which is simpler and less risky. The requirement is for annual rotation, which automatic rotation can provide.

• ✗

  Use AWS CloudFormation to deploy the Kinesis stream with the KmsKeyId property set to a customer-managed key, and set the EnableKeyRotation property to true on the key resource.

  Why it's wrong here

  AWS CloudFormation can deploy a Kinesis stream with encryption using the KmsKeyId property, and it can create a KMS key with EnableKeyRotation set to true. However, the Kinesis stream resource does not have a property to enable encryption directly; you must use the StreamEncryption property. The option as described might not correctly enable encryption on the stream, and the property names may be inaccurate.

• ✗

  Configure the Kinesis stream to use AWS-managed KMS keys for encryption, and create a custom AWS Lambda function that rotates the key every 365 days.

  Why it's wrong here

  AWS-managed KMS keys cannot be rotated by the customer; rotation is managed by AWS automatically every three years (or as AWS decides). A custom Lambda function cannot rotate an AWS-managed key. Additionally, the requirement specifies a customer-managed key, so using AWS-managed keys does not meet the mandate.

Go deeper

Related to this question