DEA-C01 Data Security and Governance Practice Question
A financial services company needs to share sensitive customer data with a third-party analytics firm. The data resides in an S3 bucket encrypted with an AWS KMS customer managed key. The third party has their own AWS account. Which combination of steps is required to securely share the data? (Choose TWO.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Update the KMS key policy to include the third-party account as a principal with kms:Decrypt permission
To share encrypted data cross-account, you must grant the third-party account access to both the S3 objects and the KMS key. Option B is correct: the KMS key policy must include the third-party account as a principal with kms:Decrypt permission to allow decryption. Option E is correct: the S3 bucket policy must grant the third-party account access to the objects (e.g., s3:GetObject). Option A is wrong because sharing the key material is insecure and not necessary; instead, you grant decrypt permissions via the key policy. Option C is wrong: the IAM role should be created in the data owner's account, not the third-party's, and the third-party would assume that role; however, this alone does not provide KMS decrypt access. Option D is wrong because the third party does not need key management permissions (e.g., kms:PutKeyPolicy); only decrypt is needed.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Share the KMS key material with the third party
Why it's wrong here
Sharing the KMS key material is insecure and not a recommended practice. Instead, grant decrypt permissions via the key policy.
- ✓
Update the KMS key policy to include the third-party account as a principal with kms:Decrypt permission
Why this is correct
Correct. The KMS key policy must include the third-party account as a principal with kms:Decrypt permission to enable decryption of the data.
- ✗
Create an IAM role in the third-party account that can be assumed by the data owner
Why it's wrong here
An IAM role in the third-party account that can be assumed by the data owner is not the correct approach. Typically, you create a role in the data owner's account that the third party can assume.
- ✗
Grant the third-party account access to the KMS key management
Why it's wrong here
Granting access to KMS key management (e.g., key deletion or policy modification) is unnecessary and overly permissive. Only decrypt permission is needed.
- ✓
Configure an S3 bucket policy that grants the third-party account access to the objects
Why this is correct
Correct. An S3 bucket policy must grant the third-party account access to the objects (e.g., s3:GetObject) to allow retrieval of the encrypted data.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every DEA-C01 question from scratch — 1,711 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DEA-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DEA-C01 exam.