DEA-C01 Data Security and Governance Practice Question
A data engineer needs to ensure that all data stored in an S3 bucket is encrypted at rest. Which S3 bucket policy condition key should be used to enforce encryption using AWS KMS?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
s3:x-amz-server-side-encryption-aws-kms-key-id
The s3:x-amz-server-side-encryption-aws-kms-key-id condition key allows you to enforce that a specific KMS key is used for server-side encryption with AWS KMS (SSE-KMS). Option A is incorrect because s3:x-amz-server-side-encryption only checks whether server-side encryption is enabled, but does not require a specific KMS key. Option B is incorrect because kms:EncryptionContext is a condition key used in KMS policies, not S3 bucket policies. Option C is incorrect because s3:x-amz-acl is used for access control lists, not encryption.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
s3:x-amz-server-side-encryption
Why it's wrong here
This condition key only ensures that server-side encryption is requested, but does not enforce the use of a specific KMS key.
- ✗
kms:EncryptionContext
Why it's wrong here
This is a KMS-level condition key used to check encryption context in KMS operations, not applicable to S3 bucket policies.
- ✗
s3:x-amz-acl
Why it's wrong here
This condition key is for controlling access to objects via ACLs, not for encryption enforcement.
- ✓
s3:x-amz-server-side-encryption-aws-kms-key-id
Why this is correct
This condition key allows you to require that a specific KMS key is used for server-side encryption, enforcing encryption at rest with a particular key.
Visual reference
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every DEA-C01 question from scratch — 1,711 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DEA-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DEA-C01 exam.