DEA-C01 Data Security and Governance Practice Question
A data engineer is using AWS Glue to process data stored in Amazon S3. The security team requires that all data in transit between AWS Glue and Amazon S3 be encrypted using TLS. The engineer has verified that the Glue job uses the AWS Glue Data Catalog and that the S3 bucket policy allows access. What should the engineer do to ensure that the Glue job enforces TLS when reading from and writing to S3?
⚠ Common exam trap
The trap here is thinking that S3 default encryption or a non-existent Glue parameter enforces TLS, when the correct approach is an IAM policy condition on aws:SecureTransport.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Attach an IAM policy to the Glue job role that denies requests where the aws:SecureTransport condition is false.
To enforce TLS for AWS Glue access to S3, an IAM policy denying requests when aws:SecureTransport is false is the most direct method. This condition key evaluates to true for HTTPS requests and false for HTTP. By denying when false, all non-TLS requests are blocked. This applies to any principal using the role, including AWS Glue, ensuring encryption in transit.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Attach an IAM policy to the Glue job role that denies requests where the aws:SecureTransport condition is false.
Why this is correct
By attaching an IAM policy that denies S3 actions when aws:SecureTransport is false, any request made over HTTP (non-TLS) will be denied. This enforces TLS for all S3 access, including from AWS Glue. This is a best practice for ensuring encryption in transit. The Glue job will then only be able to access S3 over HTTPS, meeting the security requirement.
- ✗
Configure the Glue job to use the --enable-tls parameter.
Why it's wrong here
AWS Glue does not have a parameter called --enable-tls. Encryption in transit for Glue is handled automatically when using the AWS Glue service endpoints, which support TLS. The engineer does not need to set a specific job parameter. This option is incorrect because such a parameter does not exist, and the requirement is already met by default when using the service.
- ✗
Enable S3 default encryption on the bucket to enforce TLS.
Why it's wrong here
S3 default encryption enforces encryption at rest, not in transit. It automatically encrypts objects when they are stored, but it does not control the protocol used for data transfer. Data in transit encryption is about the connection between the client and S3. Therefore, enabling default encryption does not meet the requirement for TLS in transit.
- ✗
Use an S3 VPC endpoint with a policy that allows only TLS connections.
Why it's wrong here
An S3 VPC endpoint can be used to route traffic privately, and its policy can enforce TLS by denying non-secure transport. However, this only applies to traffic within the VPC. AWS Glue jobs run outside the customer VPC by default, so an S3 VPC endpoint would not affect Glue's traffic unless the job is configured to use the VPC. Without additional configuration, this does not enforce TLS for the Glue job.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 1,321 original DEA-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This DEA-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DEA-C01 exam.