DEA-C01 Data Security and Governance Practice Question
A data engineer needs to ensure that an Amazon Redshift cluster encrypts data at rest using a customer-managed AWS KMS key. Which configuration step is required?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a new cluster and specify a customer-managed KMS key for encryption.
To use a customer-managed KMS key for encryption at rest in Amazon Redshift, you must specify the key when creating a new cluster. Encryption cannot be enabled on an existing cluster (option D is incorrect). Option A is incorrect because the default AWS managed key is not customer-managed. Option C is incorrect because AWS CloudHSM is not used for Redshift encryption; Redshift integrates directly with AWS KMS for key management.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create a new cluster and select the default AWS managed key for encryption.
Why it's wrong here
Default key is AWS managed, not customer-managed.
- ✓
Create a new cluster and specify a customer-managed KMS key for encryption.
Why this is correct
Encryption must be set at cluster creation with a KMS key.
- ✗
Use AWS CloudHSM to generate a key and attach it to the cluster.
Why it's wrong here
CloudHSM is not directly integrated with Redshift for encryption.
- ✗
Enable encryption on the existing cluster by modifying the cluster configuration.
Why it's wrong here
Redshift does not support enabling encryption on an existing unencrypted cluster.
Go deeper
Related to this question
About these practice questions
One of 1,711 original DEA-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on DEA-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A data engineer needs to ensure that an Amazon Redshift cluster encrypts all data at rest. Which setting must be enabled when creating the cluster?
easy- A.Enable automated snapshots
- ✓ B.Enable encryption
- C.Enable SSL/TLS
- D.Enable VPC
Why B: Amazon Redshift encryption at rest is enabled during cluster creation by selecting the encryption option. Option A is incorrect because enabling automated snapshots is for backup and recovery, not encryption. Option C is incorrect because SSL/TLS ensures encryption in transit, not at rest. Option D is incorrect because VPC is for network isolation, not encryption.
Variation 2. A data engineer is setting up an Amazon Redshift cluster. Which TWO measures can be taken to secure the data at rest?
easy- ✓ A.Enable encryption on the Redshift cluster using AWS KMS
- B.Encrypt data on the client side before loading into Redshift
- C.Enable AWS IAM database authentication
- D.Use VPC security groups to restrict network access
- ✓ E.Use an HSM (Hardware Security Module) to manage encryption keys
Why A: Redshift supports encryption at rest using KMS or HSM. Cluster encryption can be enabled at launch. Client-side encryption before loading protects data before it reaches Redshift, but not necessarily at rest. VPC security groups control network access. IAM roles control who can access the cluster.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DEA-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DEA-C01 exam.