DEA-C01 Data Security and Governance Practice Question
A company uses Amazon RDS for PostgreSQL to store financial data. The security team requires that all database connections be encrypted in transit and that the database audit logs be stored in Amazon S3 for at least 7 years. Which steps should the data engineer take to meet these requirements?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Set the `rds.force_ssl` parameter to 1 in the DB parameter group, and export RDS audit logs to Amazon CloudWatch Logs with a subscription to Amazon S3
Setting `rds.force_ssl` to 1 in the DB parameter group forces all connections to use SSL/TLS, ensuring encryption in transit. To store audit logs in S3 for at least 7 years, you can export RDS audit logs to Amazon CloudWatch Logs and create a subscription filter to stream them to Amazon S3, where an S3 lifecycle policy can manage retention. Option A is incorrect because encryption at rest does not enforce TLS for connections, and RDS cannot publish logs directly to S3. Option B is incorrect because security groups control network access, not encryption protocol, and CloudTrail logs AWS API calls, not database queries. Option C is incorrect because ACM certificates are not used with RDS for SSL connections, and streaming to Kinesis Firehose is unnecessary and not directly supported for RDS audit logs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable encryption at rest using AWS KMS, and configure the RDS instance to publish logs to an S3 bucket with a lifecycle policy
Why it's wrong here
Encryption at rest does not enforce TLS.
- ✗
Configure the DB security group to allow only TLS connections, and set up AWS CloudTrail to log all database queries
Why it's wrong here
Security groups do not enforce TLS; CloudTrail does not log SQL queries.
- ✗
Use an SSL certificate from AWS Certificate Manager (ACM) and attach it to the RDS instance, and stream logs to Amazon Kinesis Data Firehose with S3 destination
Why it's wrong here
ACM certificates are not used for RDS SSL; it uses server certificates.
- ✓
Set the `rds.force_ssl` parameter to 1 in the DB parameter group, and export RDS audit logs to Amazon CloudWatch Logs with a subscription to Amazon S3
Why this is correct
Forces TLS and enables long-term storage.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This DEA-C01 question is part of Courseiva's 1,711-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DEA-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DEA-C01 exam.