DEA-C01 Data Security and Governance Practice Question
A data engineer needs to ensure that an S3 bucket is encrypted at rest using AWS KMS. The bucket policy must allow only a specific IAM role to access the bucket and enforce encryption in transit. Which combination of bucket policy statements should be used?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use kms:ViaService: s3.*.amazonaws.com and aws:SecureTransport: true
Option A uses the kms:ViaService condition key to restrict the use of the KMS key to requests that come through Amazon S3 (s3.*.amazonaws.com) and the aws:SecureTransport condition to enforce encryption in transit. This ensures that only requests made via S3 and using HTTPS/TLS are allowed to use the key. Option B uses s3:x-amz-server-side-encryption: AES256, which enforces SSE-S3 (AES-256) encryption, not KMS encryption. Option C uses s3:x-amz-server-side-encryption-aws-kms-key-id, which requires a specific KMS key ID, but the aws:SourceIp condition does not enforce encryption in transit. Option D uses kms:EncryptionContext, which can be used to enforce KMS encryption but does not include the aws:SecureTransport condition, so encryption in transit is not enforced.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use kms:ViaService: s3.*.amazonaws.com and aws:SecureTransport: true
Why this is correct
This enforces KMS encryption via S3 and TLS.
- ✗
Use s3:x-amz-server-side-encryption: AES256 and aws:SecureTransport: true
Why it's wrong here
AES256 is SSE-S3, not KMS.
- ✗
Use s3:x-amz-server-side-encryption-aws-kms-key-id and aws:SourceIp
Why it's wrong here
SourceIp is not encryption in transit.
- ✗
Use kms:EncryptionContext: service:s3 and aws:SecureTransport: true
Why it's wrong here
EncryptionContext alone doesn't enforce KMS key.
Quick reference
Symmetric Encryption Algorithm Comparison
| Algorithm | Key Size | Block Size | Status | Notes |
|---|---|---|---|---|
| AES-128 | 128-bit | 128-bit | Current standard | NIST approved; WPA3, TLS |
| AES-256 | 256-bit | 128-bit | Current standard | Preferred for sensitive / govt data |
| 3DES | 112-bit effective | 64-bit | Deprecated (2023) | Replaced by AES |
| DES | 56-bit | 64-bit | Broken | Cracked in < 24 h; never deploy |
| ChaCha20 | 256-bit | Stream cipher | Current | TLS 1.3, WireGuard |
Go deeper
Related to this question
About these practice questions
One of 1,711 original DEA-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DEA-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DEA-C01 exam.