DEA-C01 Data Security and Governance Practice Question
A data engineer must ensure that all objects written to an S3 bucket by an AWS Glue ETL job are encrypted with a customer-managed AWS KMS key, even if the job does not explicitly specify encryption parameters. The bucket policy already denies unencrypted PUT requests. Which configuration will enforce the required encryption with the LEAST operational overhead?
⚠ Common exam trap
The trap here is assuming that a bucket policy denying unencrypted PUTs is sufficient, but it only blocks requests and does not apply encryption automatically.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Set the default encryption on the S3 bucket to SSE-KMS with the customer-managed key.
Default bucket encryption with SSE-KMS using the customer-managed key automatically encrypts all objects written without explicit encryption headers, satisfying the requirement without modifying the Glue job. It also works with the existing bucket policy denial for non-compliant requests. This approach minimizes operational effort and ensures consistent encryption across all writers.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable S3 Bucket Keys for the bucket to reduce KMS costs.
Why it's wrong here
S3 Bucket Keys reduce AWS KMS request costs by using a bucket-level key, but they do not enforce that objects are encrypted with a customer-managed key. They only change how the KMS key is used for SSE-KMS encryption. Without default encryption or explicit headers, objects may still be unencrypted.
- ✓
Set the default encryption on the S3 bucket to SSE-KMS with the customer-managed key.
Why this is correct
Configuring default bucket encryption with SSE-KMS and the customer-managed key ensures that any object PUT without explicit encryption headers is automatically encrypted with that key. This meets the requirement with no changes to the Glue job and works even if the job omits encryption parameters. The bucket policy can still deny non-compliant requests as an additional layer.
- ✗
Attach an IAM policy to the Glue job role that allows only s3:PutObject with the s3:x-amz-server-side-encryption condition.
Why it's wrong here
An IAM policy condition can enforce that PUT requests include the encryption header, but it does not automatically encrypt objects if the header is missing; the request would be denied. This requires the job to be modified to send the header, increasing operational overhead and risking job failures.
- ✗
Modify the Glue job to set the --encryption-type parameter to SSE-KMS for all writes.
Why it's wrong here
While specifying SSE-KMS in the Glue job ensures encryption, it requires modifying the job and does not cover other writers. It also adds operational overhead if multiple jobs or applications write to the bucket. Default bucket encryption is simpler and applies uniformly.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This DEA-C01 question is part of Courseiva's 1,321-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This DEA-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DEA-C01 exam.