DEA-C01 Data Store Management Practice Question
A data engineer is configuring an Amazon S3 bucket for a data lake. The bucket must store sensitive financial data and comply with a regulation that requires all data to be encrypted at rest with keys that are automatically rotated every year. The engineer also needs to audit key usage and control access to the keys separately from other AWS services. Which encryption option should the engineer choose?
⚠ Common exam trap
The trap here is assuming that any encryption option with automatic rotation meets all compliance needs, ignoring the requirement for separate key access control and auditing.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Server-side encryption with AWS KMS keys (SSE-KMS)
SSE-KMS with customer managed keys provides automatic key rotation, separate access control via key policies and IAM, and detailed auditing through CloudTrail. These features directly address the compliance requirements for encryption at rest, annual key rotation, and auditing key usage. SSE-S3 and SSE-C lack the necessary auditing and separate access control, while client-side encryption shifts management burden to the application.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Server-side encryption with Amazon S3 managed keys (SSE-S3)
Why it's wrong here
SSE-S3 uses keys managed by Amazon S3, which are rotated automatically, but it does not provide separate key access control or detailed key usage auditing. The regulation requires auditing key usage and controlling access to keys independently, which SSE-S3 cannot satisfy. SSE-S3 is suitable for basic encryption needs but not for strict compliance requiring separate key management.
- ✓
Server-side encryption with AWS KMS keys (SSE-KMS)
Why this is correct
SSE-KMS uses AWS KMS customer managed keys, which can be configured for automatic annual rotation. KMS provides separate access control through key policies and IAM, and it logs key usage in AWS CloudTrail for auditing. This meets the compliance requirements for encryption, rotation, auditing, and separate key management. SSE-KMS is the appropriate choice for sensitive data with regulatory mandates.
- ✗
Server-side encryption with customer-provided keys (SSE-C)
Why it's wrong here
SSE-C requires the customer to provide and manage their own encryption keys, and AWS does not store them. While this gives full control, it does not provide automatic key rotation or integrated auditing of key usage. The engineer would need to implement rotation and auditing manually, which is operationally complex and error-prone. SSE-C is not ideal for meeting regulatory requirements easily.
- ✗
Client-side encryption with an AWS KMS customer managed key
Why it's wrong here
Client-side encryption encrypts data before uploading to S3, but it requires the application to manage encryption and decryption. While it can use KMS keys, the auditing and access control are handled by the application, not natively by S3. This adds complexity and may not provide the seamless audit trail that SSE-KMS offers. It is not the simplest solution for the stated requirements.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 1,321 original DEA-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This DEA-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DEA-C01 exam.