DEA-C01 Data Security and Governance Practice Question
A data engineer is setting up a data pipeline using AWS DMS to migrate data from an on-premises database to Amazon RDS for MySQL. The data must be encrypted in transit. Which TWO options can the engineer use? (Choose TWO.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable SSL encryption on the DMS endpoint
DMS supports SSL/TLS for encrypting connections. Option A (VPC peering) is incorrect because VPC peering does not encrypt traffic. Option B (Enable SSL encryption on the DMS endpoint) is correct because SSL/TLS encrypts the data in transit. Option C (Set up a VPN connection) is correct because VPN creates an encrypted tunnel. Option D (Use KMS) is incorrect because KMS is for encryption at rest, not in transit. Option E (VPC endpoint) is incorrect because VPC endpoints provide private connectivity but do not encrypt transit.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use VPC peering between on-premises and AWS
Why it's wrong here
VPC peering is for VPCs, not on-premises, and does not encrypt.
- ✓
Enable SSL encryption on the DMS endpoint
Why this is correct
SSL encrypts the connection.
- ✓
Set up a VPN connection between on-premises and AWS
Why this is correct
VPN encrypts all traffic.
- ✗
Use KMS to encrypt the DMS connection
Why it's wrong here
KMS is for at-rest encryption.
- ✗
Use a VPC endpoint for DMS
Why it's wrong here
VPC endpoints provide private connectivity but not encryption by default.
Go deeper
Related to this question
About these practice questions
This DEA-C01 question is part of Courseiva's 1,711-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DEA-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DEA-C01 exam.