DEA-C01 Data Security and Governance Practice Question
A data engineer is designing a data pipeline that processes PII data in AWS Glue. They need to ensure data is encrypted at rest and in transit. Which TWO actions should they take? (Choose TWO.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure S3 bucket server-side encryption for job output
To ensure data is encrypted at rest and in transit, the data engineer should configure S3 bucket server-side encryption for job output (Option B) because Glue jobs write output to S3, and server-side encryption protects data at rest. Additionally, enabling encryption at rest for the AWS Glue Data Catalog (Option E) encrypts the catalog metadata at rest. Option A is incorrect because SSL should not be disabled; SSL provides encryption in transit. Option C is incorrect because KMS keys for Glue job bookmarks encrypt only bookmarks, not all data. Option D is incorrect because CloudWatch Logs are for logging, not for encryption.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Disable SSL for Glue connections
Why it's wrong here
SSL should be enabled for encryption in transit.
- ✓
Configure S3 bucket server-side encryption for job output
Why this is correct
Encrypts data stored in S3.
- ✗
Use a KMS key for Glue job bookmarks
Why it's wrong here
Bookmarks are for job state, not data encryption.
- ✗
Use CloudWatch Logs for encryption
Why it's wrong here
CloudWatch Logs does not provide data encryption.
- ✓
Enable encryption at rest for the AWS Glue Data Catalog
Why this is correct
Encrypts metadata at rest.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 1,711 original DEA-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on DEA-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A data engineer is designing a data pipeline that processes PII data using AWS Glue and stores results in S3. Which TWO actions should be taken to protect the data? (Choose 2)
medium- A.Use S3 default encryption with SSE-S3 for the output bucket.
- ✓ B.Store database credentials in AWS Secrets Manager and reference them in Glue connections.
- C.Enable S3 object deletion protection by setting a retention policy.
- ✓ D.Configure AWS Glue to use a KMS key for encrypting data written to S3.
- E.Use HTTPS for all data transfer between Glue and S3.
Why B: Options B and D are correct. Option B: Storing database credentials in AWS Secrets Manager and referencing them in AWS Glue connections ensures that sensitive credentials are not hard-coded or exposed in plaintext, following security best practices for PII data. Option D: Configuring AWS Glue to use a KMS key for encrypting data written to S3 ensures that data at rest in S3 is encrypted with customer-managed keys, providing additional control over encryption. Option A is incorrect because S3 default encryption with SSE-S3 uses Amazon-managed keys and does not provide the same level of control as KMS; more importantly, the question asks for actions to protect PII, and using SSE-S3 alone is not sufficient for compliance with many regulations that require encryption with customer-managed keys. Option C is incorrect because enabling S3 object deletion protection with a retention policy is about preventing accidental deletion, not directly about protecting data from unauthorized access or encryption. Option E is incorrect because HTTPS encrypts data in transit, but the question also requires encryption at rest; HTTPS alone does not protect data at rest in S3.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DEA-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DEA-C01 exam.