DEA-C01 Data Security and Governance Practice Question
A company wants to centrally manage encryption keys for multiple AWS services and automatically rotate them every year. Which AWS service should be used?
⚠ Common exam trap
DEA-C01 often tests the distinction between KMS and CloudHSM; candidates may choose CloudHSM for key management but overlook the automatic rotation and integration features of KMS.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS Key Management Service (KMS)
AWS Key Management Service (KMS) is designed to centrally manage encryption keys for multiple AWS services and supports automatic annual rotation of customer master keys. It integrates with services like S3, EBS, and RDS, making it the correct choice.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AWS CloudHSM
Why it's wrong here
CloudHSM supplies dedicated single-tenant hardware security modules where the customer controls keys, but it has no automatic annual rotation and no native integration for centrally managing keys across AWS services. It tempts for strict compliance key custody, yet the stem requires managed rotation, which AWS KMS delivers.
- ✗
AWS Certificate Manager (ACM)
Why it's wrong here
ACM issues and renews TLS certificates for load balancers and CloudFront; it manages certificate lifecycles, not customer master keys for service-side encryption. It tempts because ACM also rotates credentials automatically, but annual rotation of KMS keys across AWS services is performed by AWS KMS.
- ✗
AWS Secrets Manager
Why it's wrong here
Secrets Manager stores and rotates credentials such as database passwords and API keys, not the customer master keys that encrypt data in AWS services. It tempts because rotation is its headline feature, but the stem concerns encryption keys for multiple services, which AWS KMS manages.
- ✓
AWS Key Management Service (KMS)
Why this is correct
AWS Key Management Service provides customer managed keys with automatic annual rotation, satisfying the yearly rotation requirement. It integrates natively across multiple AWS services, enabling centralised key management. Unlike CloudHSM, which offers dedicated hardware but no built-in automatic rotation, KMS delivers the managed rotation and multi-service integration the scenario demands.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every DEA-C01 question from scratch — 1,321 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This DEA-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DEA-C01 exam.