DEA-C01 Data Security and Governance Practice Question
A data engineer is configuring an Amazon Redshift cluster to encrypt data at rest. The company policy requires that encryption keys be stored in AWS CloudHSM. Which integration should the engineer use to meet this requirement?
⚠ Common exam trap
Many exam-takers confuse encryption in transit (SSL/TLS) with encryption at rest, and assuming AWS KMS keys are stored in CloudHSM when they are actually stored in AWS-managed HSMs.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure Redshift to use an HSM for encryption.
Amazon Redshift supports encryption at rest using either AWS KMS or a hardware security module (HSM) via CloudHSM. When company policy mandates that encryption keys be stored in AWS CloudHSM, the engineer must configure Redshift to use an HSM connection for encryption, which is the only option that satisfies the CloudHSM key storage requirement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use AWS KMS with a customer managed key.
Why it's wrong here
A customer managed key resides in AWS KMS, not AWS CloudHSM, so the mandated key storage location is not satisfied. It is tempting because KMS customer managed keys give control over rotation and policies, and would be correct when the policy permits KMS rather than requiring a dedicated HSM.
- ✓
Configure Redshift to use an HSM for encryption.
Why this is correct
Configuring Redshift with a hardware security module directly satisfies the CloudHSM key-storage mandate, since Redshift supports HSM connections for at-rest encryption via CloudHSM. This keeps keys inside the dedicated HSM rather than AWS-managed KMS, meeting the policy's explicit key custody constraint.
- ✗
Enable encryption using the AWS Redshift SSL/TLS feature.
Why it's wrong here
SSL/TLS encrypts data in transit between clients and the cluster, leaving data at rest unencrypted and keys outside AWS CloudHSM entirely. It is tempting because Redshift offers it as a one-click encryption setting, and it would be correct when the requirement is protecting connections rather than stored blocks.
- ✗
Use Redshift automatic key rotation.
Why it's wrong here
Automatic key rotation only cycles the AWS KMS key already backing the cluster; it never places key material in AWS CloudHSM, so the policy requirement is unmet. Rotation is tempting because it strengthens key hygiene, and it would be the right choice when a KMS-backed cluster must satisfy a periodic rotation mandate.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 1,321 original DEA-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This DEA-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DEA-C01 exam.