DEA-C01 Data Security and Governance Practice Question
A data engineer needs to store encryption keys used for protecting data in Amazon S3 and automatically rotate them every year. Which service should be used?
⚠ Common exam trap
The trap is confusing key management (KMS) with secret management (Secrets Manager) or certificate management (ACM) — only KMS handles encryption key storage and rotation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS KMS
AWS KMS is the managed service for creating, storing, and rotating encryption keys, and it supports automatic annual rotation for customer managed keys. It integrates natively with S3 SSE-KMS, making it the correct choice for key storage and yearly rotation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
AWS KMS
Why this is correct
AWS KMS stores customer master keys and supports automatic annual rotation, satisfying the yearly rotation constraint. S3 server-side encryption with SSE-KMS references these keys, so key material never leaves KMS and rotation is transparent to applications reading the protected objects.
- ✗
AWS CloudHSM
Why it's wrong here
AWS CloudHSM provides dedicated hardware security modules but requires you to implement rotation yourself; it has no built-in annual key-rotation schedule. It is tempting because CloudHSM suits scenarios demanding single-tenant key custody or custom cryptographic operations under FIPS 140-2 Level 3, where regulatory control over the hardware matters more than automated lifecycle management.
- ✗
AWS Certificate Manager
Why it's wrong here
AWS Certificate Manager issues and renews TLS/SSL certificates, not S3 encryption keys, so annual key rotation is impossible. It is correct when provisioning public or private certificates for load balancers and CloudFront distributions, not for KMS key material.
- ✗
AWS Secrets Manager
Why it's wrong here
Secrets Manager stores credentials and rotates secrets, not S3 data-encryption keys; it cannot perform the annual rotation the scenario requires. It is the right choice for database passwords or API keys needing automated rotation, not KMS customer managed keys.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 1,321 original DEA-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This DEA-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DEA-C01 exam.