Redshift Encryption with Customer Managed KMS Key and Automatic Rotation
A company uses Amazon Redshift for data warehousing. The security team requires that data be encrypted at rest using a customer-managed key (CMK) in AWS KMS, and that the key be rotated automatically every year. Additionally, the team wants to restrict access to the key to only the Redshift cluster and a security admin IAM role. Which steps should the company take? (Choose THREE.)
Quick Answer
The answer is to create a new Redshift cluster specifying the customer managed KMS key, enable automatic yearly key rotation, and restrict the key policy to the Redshift cluster and a security admin IAM role. This works because Redshift encryption with a customer managed KMS key must be configured at cluster launch, as encryption cannot be enabled on an existing cluster without a snapshot restore. Automatic rotation is a KMS property you enable on the CMK itself, ensuring the key material changes annually without manual intervention. On the AWS Certified Data Engineer Associate DEA-C01 exam, this scenario tests your understanding that encryption settings are immutable after cluster creation and that key policies, not IAM roles alone, control access to the CMK. A common trap is thinking you can alter an existing encrypted cluster or that disabling rotation meets compliance. Remember the mnemonic "Launch, Rotate, Restrict" to recall the three required steps: specify the CMK at launch, enable automatic rotation on the key, and restrict the key policy.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add the security admin IAM role as a key user in the KMS key policy.
Options A, C, and E are correct. Option A adds the security admin IAM role as a key user in the KMS key policy. Option C enables automatic yearly rotation of the CMK. Option E creates a new Redshift cluster and specifies the CMK for encryption. Option B is wrong because you cannot enable encryption on an existing unencrypted cluster by altering it; you must create a new cluster or restore from an encrypted snapshot. Option D is wrong because it disables rotation, which conflicts with the security requirement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Add the security admin IAM role as a key user in the KMS key policy.
Why this is correct
Allows the admin to manage the key.
- ✗
Alter the existing Redshift cluster to enable encryption with the CMK.
Why it's wrong here
Redshift does not support enabling encryption on an existing cluster without restoring from snapshot.
- ✓
Enable automatic key rotation in the KMS key policy.
Why this is correct
Rotates the key automatically every year.
- ✗
Disable automatic key rotation to comply with security policy.
Why it's wrong here
Security policy requires rotation.
- ✓
Create a new Redshift cluster and specify the CMK for encryption.
Why this is correct
Enables encryption with a customer-managed key.
Go deeper
Related to this question
About these practice questions
One of 1,711 original DEA-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on DEA-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company uses Amazon Redshift for data warehousing. The security team requires that all data stored in Redshift be encrypted at rest using a customer-managed KMS key. How should the data engineer configure this?
medium- ✓ A.Enable encryption using a KMS key when creating the Redshift cluster
- B.Configure S3 SSE-KMS on the underlying S3 storage
- C.Use the AWS KMS console to encrypt the Redshift cluster after creation
- D.Set a cluster parameter group with encryption enabled
Why A: Redshift supports encryption at rest using KMS. You enable encryption when launching the cluster by choosing a KMS key. Option B is wrong because Redshift doesn't use S3 SSE-KMS for its own storage. Option C is wrong because you cannot encrypt an existing cluster without restoring from snapshot. Option D is wrong because cluster parameter groups do not control encryption. Option A is correct.
Variation 2. A company uses Amazon Redshift for data warehousing. The security team requires that all data be encrypted at rest using a key managed by the company. Which Redshift encryption option should be used?
hard- A.Enable encryption using AWS managed key (default)
- B.Use SSL/TLS encryption
- C.Use hardware security module (HSM)
- ✓ D.Specify a customer managed KMS key when enabling encryption
Why D: Amazon Redshift supports encryption at rest using AWS KMS. To use a key managed by the company (customer managed key), you must specify a customer managed KMS key when enabling encryption. Option D is correct. Option A uses an AWS managed key (default), which is not managed by the company. Option B refers to encryption in transit, not at rest. Option C: HSM is not directly supported for Redshift encryption; KMS is used.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DEA-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DEA-C01 exam.