DEA-C01 Data Security and Governance Practice Question
A data engineer needs to ensure that an Amazon Redshift cluster encrypts data at rest using a customer-managed AWS KMS key. Which configuration step is required?
⚠ Common exam trap
DEA-C01 often tests the misconception that you can modify an existing Redshift cluster to add or change encryption — in reality, encryption is fixed at creation and requires snapshot/restore to change.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a new cluster and specify a customer-managed KMS key for encryption.
To encrypt an Amazon Redshift cluster with a customer-managed KMS key, you must specify that key at cluster creation time; Redshift does not allow you to change the encryption key of an existing cluster after it is created. The customer-managed key gives you control over key rotation, grants, and audit via CloudTrail, which is required when the default AWS-managed key (aws/redshift) does not satisfy compliance.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create a new cluster and select the default AWS managed key for encryption.
Why it's wrong here
The default AWS managed key (aws/s3 or aws/redshift) is owned by AWS, so it cannot satisfy a customer-managed KMS key requirement. It is tempting because it encrypts at rest with zero key administration, which suits workloads with no compliance mandate over key ownership, rotation, or key policy control.
- ✓
Create a new cluster and specify a customer-managed KMS key for encryption.
Why this is correct
A Redshift cluster's encryption key is fixed at creation time; you cannot swap the KMS key on an existing cluster. Creating a new cluster and specifying the customer-managed KMS key is therefore the required configuration step.
- ✗
Use AWS CloudHSM to generate a key and attach it to the cluster.
Why it's wrong here
CloudHSM produces keys in a single-tenant HSM cluster, not a customer-managed KMS key, and Redshift cannot attach an arbitrary CloudHSM key directly. It is tempting because CloudHSM gives dedicated hardware key custody, which is the right choice when regulations demand exclusive HSM control rather than KMS-managed keys.
- ✗
Enable encryption on the existing cluster by modifying the cluster configuration.
Why it's wrong here
Redshift cannot switch an existing unencrypted cluster to KMS encryption in place; you must create a new encrypted cluster and migrate data. It is tempting because modifying a cluster is the normal route for many settings, and it would be correct for toggling non-encryption parameters such as node type or maintenance windows.
Go deeper
Related to this question
About these practice questions
One of 1,321 original DEA-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on DEA-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A data engineer needs to ensure that an Amazon Redshift cluster encrypts all data at rest. Which setting must be enabled when creating the cluster?
easy- A.Enable automated snapshots
- ✓ B.Enable encryption
- C.Enable SSL/TLS
- D.Enable VPC
Why B: Amazon Redshift encryption at rest is enabled during cluster creation by selecting the encryption option. Option A is incorrect because enabling automated snapshots is for backup and recovery, not encryption. Option C is incorrect because SSL/TLS ensures encryption in transit, not at rest. Option D is incorrect because VPC is for network isolation, not encryption.
Variation 2. A data engineer is setting up an Amazon Redshift cluster. Which TWO measures can be taken to secure the data at rest?
easy- ✓ A.Enable encryption on the Redshift cluster using AWS KMS
- B.Encrypt data on the client side before loading into Redshift
- C.Enable AWS IAM database authentication
- D.Use VPC security groups to restrict network access
- ✓ E.Use an HSM (Hardware Security Module) to manage encryption keys
Why A: Option A is correct because enabling encryption on the Redshift cluster using AWS KMS provides at-rest encryption of the cluster's data and metadata, including backups, using keys managed by AWS KMS (or customer-managed keys). Option E is correct because Redshift supports using a hardware security module (HSM) to manage and store the encryption keys used for at-rest encryption, giving customers control over key material for compliance requirements. Option B is not correct in this context because client-side encryption protects data before it reaches Redshift but does not secure the data at rest within the Redshift cluster itself. Option C is not correct because IAM database authentication controls access to the database (authentication), not encryption of stored data. Option D is not correct because VPC security groups restrict network access to the cluster, which is a network-level control rather than data-at-rest encryption.
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This DEA-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DEA-C01 exam.