DEA-C01 Data Security and Governance Practice Question
A data engineer is configuring an AWS Glue ETL job that processes data from an Amazon S3 bucket. The security team requires that all data in transit between AWS Glue and Amazon S3 be encrypted using TLS. The engineer needs to ensure that the Glue job uses HTTPS endpoints when reading from and writing to S3. Which action should the engineer take?
⚠ Common exam trap
The trap here is assuming that you must enable SSL/TLS explicitly for Glue-S3 communication, when it is already enabled by default.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
No action is needed; AWS Glue uses HTTPS for S3 by default.
AWS Glue uses the AWS SDK to interact with Amazon S3, and the SDK uses HTTPS endpoints by default. This means data in transit is encrypted with TLS without any additional configuration. There is no need for special job parameters, connection settings, or IAM permissions to enable TLS. The correct action is to recognize that no action is needed.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Ensure that the Glue job's IAM role has permissions to use HTTPS, and no further configuration is needed.
Why it's wrong here
IAM permissions do not control the protocol used for S3 access. The AWS SDK for S3 uses HTTPS by default regardless of IAM permissions. While the role needs s3:GetObject and s3:PutObject, those permissions do not enforce or enable TLS. This option is incorrect because it suggests additional IAM configuration is required for TLS, which is not the case.
- ✓
No action is needed; AWS Glue uses HTTPS for S3 by default.
Why this is correct
AWS Glue uses the AWS SDK for S3 operations, and the SDK defaults to HTTPS endpoints. Therefore, data in transit between Glue and S3 is encrypted with TLS by default. No additional configuration is required to meet the requirement. This is the correct and simplest answer.
- ✗
Add the --enable-s3-ssl parameter to the Glue job's job parameters.
Why it's wrong here
There is no job parameter called --enable-s3-ssl in AWS Glue. Glue uses the AWS SDK, which automatically uses HTTPS endpoints for S3 by default. Adding an invalid parameter would have no effect and could cause job failures. This option is incorrect because the parameter does not exist.
- ✗
Configure the Glue connection to use an S3 endpoint with the https:// prefix.
Why it's wrong here
Glue connections are used for JDBC data stores, not for S3. S3 access in Glue is handled via the AWS SDK, which uses HTTPS by default. There is no need to configure an S3 endpoint in a Glue connection. This option misunderstands how Glue accesses S3 and would not be applicable.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 1,321 original DEA-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This DEA-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DEA-C01 exam.