DEA-C01 Data Security and Governance Practice Question
A data engineer needs to ensure that an S3 bucket containing sensitive customer data is encrypted at rest. The company requires that all encryption keys be managed by AWS and rotated annually. Which encryption option meets these requirements?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use server-side encryption with S3-managed keys (SSE-S3)
SSE-S3 uses AWS-managed keys and automatically handles annual key rotation, meeting both requirements of encryption at rest and AWS-managed keys with rotation. SSE-KMS also uses AWS-managed keys but does not automatically rotate keys (unless using a custom KMS key with rotation enabled, but the question implies automatic rotation without extra configuration). SSE-C requires customer-provided keys, which violates the requirement that AWS manages the keys. Client-side encryption (B) is not server-side and also involves customer management. Thus, only SSE-S3 fully satisfies the requirements.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use server-side encryption with AWS KMS (SSE-KMS)
Why it's wrong here
AWS KMS managed keys rotate every three years, not annually, so SSE-KMS with an AWS managed key fails the annual rotation requirement; using a customer managed key would break the condition that keys be managed by AWS. This option is tempting because SSE-KMS offers encryption with separate key control and audit trails, and it would be correct if the required rotation period were three years or if customer key management were allowed.
- ✗
Use client-side encryption with AWS KMS
Why it's wrong here
Client-side encryption encrypts data before sending to S3 and does not meet the requirement of server-side encryption at rest.
- ✗
Use server-side encryption with customer-provided keys (SSE-C)
Why it's wrong here
SSE-C requires the customer to manage the keys, not AWS.
- ✓
Use server-side encryption with S3-managed keys (SSE-S3)
Why this is correct
SSE-S3 uses AWS-managed keys that are rotated automatically.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every DEA-C01 question from scratch — 1,711 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DEA-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DEA-C01 exam.