DEA-C01 Data Operations and Support Practice Question
A company uses Amazon S3 to store sensitive data. The security team requires that all data in transit between on-premises applications and S3 be encrypted. The data engineer must implement a solution that meets this requirement without changing the applications. Which TWO solutions should the engineer consider? (Choose two.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use an S3 VPC Endpoint and enforce the use of HTTPS through bucket policies.
Using an S3 VPC Endpoint with a bucket policy that enforces HTTPS ensures all traffic to S3 is encrypted in transit, without any application changes. Option E is correct because AWS Storage Gateway can mount S3 as a file system and be configured to use HTTPS, enforcing encryption in transit. Option A is incorrect because S3 Transfer Acceleration only improves speed over long distances, it does not enforce encryption—it optionally uses HTTPS but the application must still use HTTPS. Option B is incorrect because default encryption (SSE-S3, SSE-KMS, DSSE-KMS) encrypts data at rest, not in transit. Option C is incorrect because server-side encryption with SSE-S3 also only encrypts data at rest.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable S3 Transfer Acceleration on the bucket.
Why it's wrong here
Transfer Acceleration speeds up transfers but does not enforce encryption.
- ✗
Enable default encryption on the S3 bucket.
Why it's wrong here
Default encryption applies to data at rest, not in transit.
- ✗
Use server-side encryption with S3 managed keys (SSE-S3).
Why it's wrong here
SSE-S3 is for data at rest, not in transit.
- ✓
Use an S3 VPC Endpoint and enforce the use of HTTPS through bucket policies.
Why this is correct
VPC Endpoint with HTTPS policy ensures encrypted transit.
- ✓
Use AWS Storage Gateway to mount S3 as a file system and configure it to use HTTPS.
Why this is correct
Storage Gateway with HTTPS encrypts data in transit.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This DEA-C01 question is part of Courseiva's 1,711-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DEA-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DEA-C01 exam.