DEA-C01 Data Store Management Practice Question
A company uses Amazon S3 to store historical financial records. A compliance policy requires that all objects be encrypted with a customer-managed key stored in AWS KMS. The bucket is already configured with SSE-S3. What is the LEAST disruptive way to change the encryption to SSE-KMS?
⚠ Common exam trap
Many candidates assume updating default encryption settings (Option B) will retroactively encrypt existing objects, but S3 default encryption only applies to new uploads, not to objects already stored with a different encryption method.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Copy all objects to a new bucket that has default encryption set to SSE-KMS.
Changing the default encryption settings of an existing bucket (SSE-S3 to SSE-KMS) does not retroactively encrypt objects that were already stored with SSE-S3. Copying all objects to a new bucket that has default encryption set to SSE-KMS ensures every object is encrypted with a customer-managed key, as the copy operation re-encrypts each object using the new bucket's default settings. This approach is the least disruptive because it avoids modifying the original bucket's configuration or policies, which could break existing applications or access patterns.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Add a bucket policy to enforce SSE-KMS.
Why it's wrong here
Policy can enforce encryption for new uploads but does not re-encrypt existing objects.
- ✗
Update the bucket's default encryption settings to SSE-KMS.
Why it's wrong here
Default encryption applies only to new objects; existing objects remain with SSE-S3.
- ✓
Copy all objects to a new bucket that has default encryption set to SSE-KMS.
Why this is correct
Copying objects to a new bucket with SSE-KMS default encryption will re-encrypt them with the new key and is straightforward.
- ✗
Use S3 Batch Operations to apply SSE-KMS to all existing objects.
Why it's wrong here
S3 Batch Operations can indeed re-encrypt existing objects to SSE-KMS by performing a copy operation, which is useful for modifying encryption on a large scale. However, this method involves reading and rewriting every object, incurring API call costs and potential throttling, which is not the *least* disruptive approach for a bucket-wide change. It would be the correct choice if only a subset of objects required re-encryption, or if the bucket policy could not be relied upon for future uploads.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every DEA-C01 question from scratch — 1,711 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DEA-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DEA-C01 exam.