DEA-C01 Data Security and Governance Practice Question

A data engineer is designing a data lake on S3 with sensitive data. The security policy mandates that data must be encrypted at rest and in transit, and that an inventory of all objects must be maintained for compliance. Which actions should be taken?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Enforce HTTPS via bucket policy, enable default SSE-S3 encryption, and enable S3 Inventory.

It covers all requirements: encryption in transit (HTTPS enforcement via bucket policy), encryption at rest (default SSE-S3), and compliance inventory (S3 Inventory). Option B uses SSE-KMS which is not required and lacks inventory. Option C includes at-rest encryption and inventory but misses in-transit encryption. Option D includes in-transit encryption but lacks at-rest encryption and compliance inventory.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Enforce HTTPS via bucket policy, enable default SSE-S3 encryption, and enable S3 Inventory.
Why this is correct
Enforcing HTTPS via bucket policy satisfies the in-transit encryption mandate, while default SSE-S3 provides AES-256 server-side encryption at rest without key management overhead. S3 Inventory delivers scheduled CSV or Parquet reports of all objects and their metadata, meeting the compliance inventory requirement. Together these three controls cover every stated constraint.
✗
Use SSE-KMS encryption and enable CloudTrail for S3 events.
Why it's wrong here
SSE-KMS satisfies encryption at rest and CloudTrail records API activity, but CloudTrail is an event audit trail, not a scheduled inventory of every object and its metadata. It is tempting because CloudTrail is the default audit answer, and would be correct where the requirement is tracking who accessed or changed objects rather than listing them.
✗
Enable S3 default encryption using SSE-S3 and enable S3 Inventory.
Why it's wrong here
SSE-S3 with default encryption and S3 Inventory covers encryption at rest and object listing, but leaves encryption in transit unenforced, so the policy's transit mandate fails. It is tempting because S3 Inventory is the genuine object-inventory feature, and would be correct if the policy only required at-rest encryption plus inventory.
✗
Enforce HTTPS using bucket policy and enable S3 Server Access Logging.
Why it's wrong here
HTTPS enforcement covers encryption in transit and Server Access Logging records requests, but neither encrypts objects at rest nor produces the required object inventory. This pairing is tempting because access logging is often mistaken for inventory, and would be correct where the mandate is only transit encryption plus request auditing.

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

DEA-C01 Data Security and Governance Practice Question

Why each option matters

Option-by-option breakdown

AWS S3 Storage Class Comparison

Related to this question