DEA-C01 Data Store Management Practice Question
A data engineer is designing a data lake on Amazon S3. The data includes personally identifiable information (PII) that must be encrypted at rest. Which encryption option provides the most control over encryption keys?
⚠ Common exam trap
Test-takers frequently confuse 'most control' with 'customer-provided keys' (SSE-C), but SSE-C requires you to manage the keys entirely outside AWS, losing AWS-managed key rotation and auditing, whereas SSE-KMS gives you control over key policies and rotation while still leveraging AWS infrastructure.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Server-side encryption with AWS KMS managed keys (SSE-KMS).
SSE-KMS allows you to use AWS Key Management Service (KMS) to manage your encryption keys, providing you with control over key rotation, access policies, and auditing via AWS CloudTrail. This offers more control than SSE-S3 (where AWS manages the keys entirely) and more flexibility than SSE-C (where you manage the keys yourself but lose AWS-managed key rotation and auditing). Client-side encryption (Option A) gives you control but requires you to manage the encryption process and keys outside of S3, which is not a server-side encryption option and adds complexity.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Client-side encryption using Amazon S3 Encryption Client.
Why it's wrong here
Client-side encryption encrypts data before sending to S3, but the question asks for encryption at rest on server side.
- ✗
Server-side encryption with S3 managed keys (SSE-S3).
Why it's wrong here
Amazon manages the keys, less control.
- ✓
Server-side encryption with AWS KMS managed keys (SSE-KMS).
Why this is correct
Allows use of customer-managed KMS keys, giving more control.
- ✗
Server-side encryption with customer-provided keys (SSE-C).
Why it's wrong here
Customer provides keys but S3 manages encryption; customer still manages keys.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 1,711 original DEA-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DEA-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DEA-C01 exam.