DEA-C01 Data Security and Governance Practice Question
A data engineer needs to audit all AWS KMS key usage events for the past 90 days to verify compliance. Which AWS service should be used?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS CloudTrail
(AWS CloudTrail). AWS CloudTrail logs all API calls made to AWS KMS, including key usage events, and retains event history for the past 90 days by default, making it suitable for auditing. Option A (VPC Flow Logs) captures network traffic, not API calls. Option C (AWS Config) tracks resource configuration changes, not API calls. Option D (Amazon Inspector) performs vulnerability assessments, not API logging.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
VPC Flow Logs
Why it's wrong here
VPC Flow Logs capture IP traffic metadata for network interfaces, containing no KMS API call records such as Encrypt, Decrypt or GenerateDataKey. CloudTrail logs those events. Flow Logs are tempting for auditing network-level activity and connectivity troubleshooting, where they are the correct tool, but they cannot evidence key usage.
- ✓
AWS CloudTrail
Why this is correct
AWS CloudTrail records KMS API calls such as Encrypt, Decrypt and GenerateDataKey, capturing the identity, timestamp and key involved. This gives the 90-day audit trail of key usage events needed to verify compliance, which KMS alone does not provide.
- ✗
AWS Config
Why it's wrong here
AWS Config records resource configuration changes and compliance against rules; it does not log individual KMS API invocations. CloudTrail captures key usage events for the 90-day audit. Config is tempting for tracking key policy or rotation state drift, which is its real purpose, not per-call usage auditing.
- ✗
Amazon Inspector
Why it's wrong here
Amazon Inspector performs vulnerability scanning of EC2 instances, container images and Lambda functions; it does not record KMS key usage events. It is tempting because it audits AWS workloads for exposure and software flaws, which suits vulnerability-management scenarios, but the stem requires an immutable 90-day event trail, which CloudTrail delivers.
Go deeper
Related to this question
About these practice questions
This DEA-C01 question is part of Courseiva's 1,321-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DEA-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DEA-C01 exam.