DEA-C01 Data Security and Governance Practice Question
A data engineer is configuring an Amazon Redshift cluster for compliance. The cluster must encrypt data at rest and automatically rotate the encryption key every year. Which steps should the engineer take? (Choose THREE.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create the Redshift cluster with encryption enabled.
The correct steps to meet the compliance requirements are A, B, and E. Option A is correct because encryption must be enabled during Redshift cluster creation; it cannot be added afterward. Option B is correct because using a customer-managed KMS key allows you to enable automatic yearly rotation of the key itself, satisfying the key rotation requirement. Option E is correct because specifying a customer-managed KMS key gives you control over the key and its rotation policy. Option C is incorrect because Redshift does not provide a native mechanism to rotate the cluster's encryption key; key rotation is handled at the KMS level. Option D is incorrect because encryption cannot be enabled on an existing unencrypted Redshift cluster; you must create a new cluster with encryption enabled.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create the Redshift cluster with encryption enabled.
Why this is correct
Encryption must be enabled at creation.
- ✓
Enable automatic yearly rotation of the KMS key.
Why this is correct
KMS supports automatic rotation for customer-managed keys.
- ✗
Configure the Redshift cluster to rotate its encryption key every year.
Why it's wrong here
Redshift does not rotate the cluster encryption key automatically; KMS key rotation is separate.
- ✗
Modify an existing unencrypted cluster to enable encryption.
Why it's wrong here
Redshift does not support enabling encryption on an existing cluster.
- ✓
Specify a customer-managed AWS KMS key for encryption.
Why this is correct
Customer-managed keys allow control over rotation.
Go deeper
Related to this question
About these practice questions
Courseiva writes every DEA-C01 question from scratch — 1,711 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DEA-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DEA-C01 exam.