DEA-C01 Data Security and Governance Practice Question
A company uses Amazon Kinesis Data Streams to ingest real-time data. The compliance team requires that all data in the stream be encrypted at rest. Which configuration should be enabled?
⚠ Common exam trap
Many candidates confuse encryption in transit (TLS) with encryption at rest (SSE), leading candidates to select TLS as the solution for at-rest compliance.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable server-side encryption using an AWS KMS key
Server-side encryption (SSE) for Amazon Kinesis Data Streams uses an AWS KMS key to automatically encrypt data at rest as it is written to the stream and decrypt it when read. This meets the compliance requirement for encryption at rest without requiring any changes to the producer or consumer applications.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable TLS encryption on the Kinesis stream
Why it's wrong here
TLS is for data in transit.
- ✓
Enable server-side encryption using an AWS KMS key
Why this is correct
Kinesis supports SSE with KMS.
- ✗
Use client-side encryption in the producer application
Why it's wrong here
Client-side encryption is not a service configuration.
- ✗
Store the data in Amazon CloudWatch Logs instead
Why it's wrong here
CloudWatch Logs is not for real-time streaming.
Go deeper
Related to this question
About these practice questions
This DEA-C01 question is part of Courseiva's 1,711-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DEA-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DEA-C01 exam.