DEA-C01 Data Store Management Practice Question
A data engineer is setting up an Amazon S3 bucket for storing sensitive financial data. The compliance team requires that all data be encrypted at rest using a customer-managed AWS KMS key. Additionally, the bucket must block public access. Which combination of settings should the engineer configure?
⚠ Common exam trap
Candidates often think a bucket policy denying unencrypted uploads is sufficient, but it does not enforce the use of a customer-managed KMS key, nor does it automatically encrypt objects that lack encryption headers.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable default encryption with AWS-KMS and a customer managed key. Enable block public access settings.
Enabling default encryption with AWS-KMS using a customer-managed key ensures that all objects uploaded to the S3 bucket are automatically encrypted at rest with the required key type. Additionally, enabling block public access settings prevents any public access to the bucket, satisfying the compliance team's requirements.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Enable default encryption with AWS-KMS and a customer managed key. Enable block public access settings.
Why this is correct
This ensures all objects are encrypted with the specified KMS key and public access is blocked.
- ✗
Use S3 Object Ownership to enforce bucket owner enforced. Enable block public access.
Why it's wrong here
Object Ownership controls object ownership, not encryption.
- ✗
Use S3 Bucket Keys to reduce KMS costs. Enable block public access.
Why it's wrong here
Bucket Keys reduce costs but do not set default encryption.
- ✗
Create a bucket policy that denies PutObject without encryption. Enable block public access.
Why it's wrong here
Bucket policy can enforce encryption but does not set a default; objects can still be uploaded without encryption if the policy is bypassed.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This DEA-C01 question is part of Courseiva's 1,711-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DEA-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DEA-C01 exam.