DEA-C01 Data Security and Governance Practice Question
A financial services company needs to share sensitive customer data with a third-party analytics firm. The data resides in an S3 bucket encrypted with an AWS KMS customer managed key. The third party has their own AWS account. Which combination of steps is required to securely share the data? (Choose TWO.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Update the KMS key policy to include the third-party account as a principal with kms:Decrypt permission
Option B is correct because when an S3 object is encrypted with a customer managed KMS key, any principal in another AWS account must be explicitly granted kms:Decrypt on that key via the key policy (or a grant); the key policy is the primary cross-account authorization mechanism for KMS keys. Option E is correct because the third-party account also needs S3-level permission to read the objects, which is provided by a bucket policy granting actions such as s3:GetObject to the third-party principal. Together, the bucket policy authorizes the S3 data access and the KMS key policy authorizes decryption of the objects. Option A is wrong because KMS key material is never exported or shared; the third party uses the key through KMS APIs without ever seeing the material. Option C is wrong because creating a role in the third-party account assumable by the data owner reverses the trust direction and does not grant the third party access to the data. Option D is wrong because key management (e.g., kms:CreateGrant, kms:PutKeyPolicy) is not needed and would over-privilege the third party; only kms:Decrypt is required.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Share the KMS key material with the third party
Why it's wrong here
KMS key material never leaves AWS; it cannot be exported or shared, so this step is impossible. It tempts because sharing a decryption secret resembles handing over a password, but the correct approach grants cross-account access to the KMS key via its key policy, letting the third party decrypt without ever holding the material.
- ✓
Update the KMS key policy to include the third-party account as a principal with kms:Decrypt permission
Why this is correct
The KMS key policy must name the third-party account as a principal granted kms:Decrypt, because key policies govern who may use a customer managed key. Without this grant, cross-account decryption of the S3 objects fails regardless of bucket permissions.
- ✗
Create an IAM role in the third-party account that can be assumed by the data owner
Why it's wrong here
An IAM role in the third-party account that can be assumed by the data owner is not the correct approach. Typically, you create a role in the data owner's account that the third party can assume.
- ✗
Grant the third-party account access to the KMS key management
Why it's wrong here
Key management permissions allow administering the key's policy and rotation, not decrypting objects, so the third party still cannot read the data. It tempts because cross-account access does require a KMS key policy change, but the required grant is kms:Decrypt and kms:DescribeKey usage access, not management rights.
- ✓
Configure an S3 bucket policy that grants the third-party account access to the objects
Why this is correct
A bucket policy granting the third-party account s3:GetObject access is required, because cross-account access to S3 objects is authorised at the resource level. The partner's own IAM permissions alone cannot grant access to another account's bucket.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every DEA-C01 question from scratch — 1,321 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DEA-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DEA-C01 exam.