DEA-C01 Data Security and Governance Practice Question
A company uses AWS KMS to encrypt sensitive data stored in S3. To meet compliance requirements, they need to ensure that the encryption keys are automatically rotated every year. Which type of KMS key should they use?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Customer managed key with automatic rotation enabled
Customer managed keys with automatic rotation enabled support automatic annual rotation, meeting the compliance requirement. AWS managed keys rotate automatically every year, but they cannot be controlled or customized by the customer, so they are not the best choice when the customer needs to manage the key policy or rotation schedule. Custom key stores (CloudHSM) do not support automatic rotation. Option A (customer managed key with manual rotation) requires manual intervention to rotate, not automatic. Therefore, D is the correct answer.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Customer managed key with manual rotation
Why it's wrong here
Customer managed keys with manual rotation require an administrator to trigger rotation, so annual automatic rotation is not delivered. It is tempting because customer managed keys do support rotation, but only when automatic rotation is enabled; manual rotation fails the compliance requirement for automatic yearly rotation.
- ✗
AWS managed key
Why it's wrong here
AWS managed keys rotate automatically every three years, not yearly, and their rotation schedule cannot be changed, so the annual compliance requirement fails. They are tempting because they require no key policy administration, making them the right pick when default rotation and automatic lifecycle management suffice.
- ✗
Custom key store (CloudHSM) key
Why it's wrong here
Keys in a custom key store (CloudHSM) never rotate automatically; AWS KMS rotation is unavailable for them, so annual rotation must be scripted manually. They are tempting when compliance demands single-tenant HSM key material, which is the correct scenario for this option.
- ✓
Customer managed key with automatic rotation enabled
Why this is correct
Customer managed keys in AWS KMS support automatic annual rotation, which AWS-managed keys handle on a fixed three-year cycle you cannot change. Enabling rotation on a customer managed key satisfies the yearly compliance requirement, since the key material is replaced without altering the key ID or ARN.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every DEA-C01 question from scratch — 1,321 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on DEA-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Refer to the exhibit. The exhibit shows output from AWS CLI commands. Which key can be used to enable automatic annual rotation?
medium- A.The second key (5678efgh-...)
- B.Both keys
- C.Neither key
- ✓ D.The first key (1234abcd-...)
Why D: (the first key) is correct because automatic annual rotation is only configurable for customer managed keys. The first key is customer managed, allowing the user to enable or disable automatic rotation with a specified frequency (e.g., annually). The second key is AWS managed, which rotates automatically every three years without user configuration, so its rotation cannot be enabled or disabled by the user. Options A and B are incorrect because the second key (AWS managed) does not support user-controlled automatic rotation, and both keys cannot have rotation configured independently. Option C is incorrect because the first key (customer managed) does support automatic annual rotation.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DEA-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DEA-C01 exam.