DEA-C01 Data Security and Governance Practice Question
A data engineer needs to ensure that an Amazon S3 bucket containing sensitive customer data is encrypted at rest. Which AWS service can be used to manage the encryption keys?
⚠ Common exam trap
DEA-C01 often tests whether candidates confuse services that manage different secret types — ACM handles TLS certificates, Secrets Manager handles credentials, and KMS handles encryption keys, so candidates who pick ACM or Secrets Manager for S3 key management fall into the trap.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS Key Management Service (KMS)
AWS Key Management Service (KMS) is the managed service for creating, rotating, and controlling the keys used to encrypt data at rest in S3 (SSE-KMS). It integrates natively with S3 so that objects are encrypted with a KMS customer master key, and access to the key is governed by IAM and key policies. This is the standard answer for managing S3 encryption keys.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AWS Certificate Manager
Why it's wrong here
AWS Certificate Manager issues and renews TLS certificates for encryption in transit; it cannot manage the customer master keys protecting S3 objects at rest. It is tempting because it handles encryption material, but its scope is public/private certificates for endpoints, not KMS-style key management for stored data.
- ✗
AWS Secrets Manager
Why it's wrong here
AWS Secrets Manager stores and rotates credentials such as database passwords and API keys; it does not generate or manage the customer master keys that encrypt S3 objects. It is tempting because it handles sensitive material, but the scenario needs key management for data at rest, which is AWS KMS's role.
- ✗
AWS CloudHSM
Why it's wrong here
AWS CloudHSM provides dedicated hardware security modules for custom key operations, not the managed S3 default encryption keys the scenario implies. It is tempting because it genuinely manages keys, but it suits regulatory single-tenant HSM requirements, whereas S3 server-side encryption with KMS keys needs no dedicated appliance.
- ✓
AWS Key Management Service (KMS)
Why this is correct
AWS KMS centrally creates, rotates and controls the customer-managed keys used for S3 server-side encryption (SSE-KMS), satisfying the encryption-at-rest requirement. KMS also provides audit trails of key usage through CloudTrail, giving the key management capability the scenario demands.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 1,321 original DEA-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This DEA-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DEA-C01 exam.