DEA-C01 Data Store Management Practice Question
A company uses Amazon S3 to store customer documents. The data engineer needs to ensure that all objects uploaded to a specific S3 bucket are automatically encrypted with a customer-managed AWS KMS key. What should the data engineer do?
⚠ Common exam trap
Candidates often confuse bucket policies that deny unencrypted uploads (which only reject non-compliant requests) with default encryption (which automatically encrypts objects), leading them to choose Option B instead of D.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Set default encryption on the bucket to use SSE-KMS with the customer-managed key.
Setting default encryption on the S3 bucket to SSE-KMS with the customer-managed key ensures that all objects uploaded without explicit encryption headers are automatically encrypted using that KMS key. This satisfies the requirement without relying on client-side behavior, as S3 applies the encryption server-side at the time of write.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use pre-signed URLs for all uploads that include encryption parameters.
Why it's wrong here
Pre-signed URLs grant temporary access and can carry encryption headers, but they only cover uploads made through those URLs; direct PUTs or other clients bypass the requirement entirely. Default bucket encryption with a customer-managed AWS KMS key enforces encryption on every object regardless of upload method, which is what the scenario demands.
- ✗
Create a bucket policy that denies uploads without encryption.
Why it's wrong here
A deny-without-encryption bucket policy blocks unencrypted PUTs but does not itself apply a customer-managed KMS key; uploads using SSE-S3 or a different key still succeed. It is tempting because it enforces encryption, and it would be correct when the requirement is merely that some form of encryption be present.
- ✗
Enable S3 Versioning on the bucket.
Why it's wrong here
Versioning retains multiple object revisions; it applies no encryption and cannot select a KMS key. It is tempting because it is a common bucket-level safeguard, and it would be correct when the requirement is preserving or recovering overwritten and deleted objects rather than enforcing encryption.
- ✓
Set default encryption on the bucket to use SSE-KMS with the customer-managed key.
Why this is correct
Setting default bucket encryption to SSE-KMS with the customer-managed key enforces encryption at upload without changing client behaviour, satisfying the requirement that every object be encrypted automatically. S3 applies the default to objects lacking an explicit encryption header, and SSE-KMS provides the customer-managed key control the stem demands.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every DEA-C01 question from scratch — 1,321 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DEA-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DEA-C01 exam.