DEA-C01 Data Security and Governance Practice Question
A data engineer is configuring an S3 bucket policy to allow cross-account access for a partner account to read objects. The bucket is encrypted with SSE-KMS using a customer-managed key. What additional configuration is needed to allow the partner account to decrypt the objects?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Update the KMS key policy to grant the partner account kms:Decrypt permission
For cross-account access with SSE-KMS, the KMS key policy must grant the partner account access to use the key. The bucket policy alone is insufficient. The partner account does not need VPC endpoints, and the bucket policy for decryption is not needed. The partner account does not need access to the S3 bucket's encryption configuration.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Add a bucket policy that grants the partner account s3:GetObject
Why it's wrong here
Granting s3:GetObject permits object retrieval but not kms:Decrypt, so the partner's request fails against the customer-managed key. It is tempting because bucket-policy read access normally suffices for unencrypted or SSE-S3 objects, but SSE-KMS additionally requires a key policy or grant for the partner account.
- ✗
Create a VPC endpoint for S3 and add it to the bucket policy
Why it's wrong here
A VPC endpoint controls network routing to S3 and cannot authorise decryption; kms:Decrypt on the customer-managed key remains absent, so reads fail. It is tempting for restricting access to private networks, but the scenario needs cross-account key permission, not network path control.
- ✓
Update the KMS key policy to grant the partner account kms:Decrypt permission
Why this is correct
Granting the partner account kms:Decrypt in the KMS key policy satisfies the stem's requirement that cross-account readers decrypt SSE-KMS objects. S3 bucket policies alone cannot authorise key usage; the customer-managed key's policy must separately permit the partner principal, since KMS enforces its own authorisation independently of S3.
- ✗
Add a bucket policy that grants s3:GetObject and s3:GetEncryptionConfiguration
Why it's wrong here
s3:GetEncryptionConfiguration only lets the partner read the bucket's encryption settings, not decrypt objects; kms:Decrypt on the customer-managed key is still missing. It is tempting because it sounds encryption-related, but the actual requirement is a key policy or grant permitting the partner account to use the KMS key.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every DEA-C01 question from scratch — 1,321 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DEA-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DEA-C01 exam.