DEA-C01 Data Security and Governance Practice Question
A data engineer is designing a data pipeline that processes sensitive financial data. The data must be encrypted at rest and in transit. The pipeline uses Amazon Kinesis Data Streams to ingest data and AWS Lambda to process it. Which combination of actions ensures the data is encrypted in transit? (Select TWO.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable TLS for Kinesis Data Streams.
Enabling TLS for Kinesis Data Streams encrypts data in transit between producers and the stream. Option B is correct because enabling encryption in transit for the Lambda function's VPC configuration ensures TLS is used when Lambda communicates, such as with Kinesis over a VPC endpoint. Option C is incorrect because SSE-S3 encrypts data at rest in S3, not in transit. Option D is incorrect because encrypting data at rest in Kinesis using KMS does not address encryption in transit. Option E is incorrect because encrypting CloudWatch Logs with KMS is for data at rest.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Enable TLS for Kinesis Data Streams.
Why this is correct
TLS encrypts data in transit between producers and Kinesis.
- ✓
Enable Encryption in Transit for the Lambda function's VPC configuration.
Why this is correct
This ensures Lambda uses TLS for network connections.
- ✗
Enable Server-Side Encryption (SSE-S3) on the S3 bucket used for data storage.
Why it's wrong here
SSE-S3 encrypts data at rest, not in transit.
- ✗
Use AWS KMS to encrypt data at rest in Kinesis Data Streams.
Why it's wrong here
KMS encryption encrypts data at rest, not in transit.
- ✗
Encrypt the Lambda function's CloudWatch Logs using KMS.
Why it's wrong here
CloudWatch Logs encryption is at rest.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every DEA-C01 question from scratch — 1,711 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DEA-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DEA-C01 exam.