DEA-C01 Data Security and Governance Practice Question
A financial services company uses a multi-account AWS Organization with hundreds of accounts. The data engineering team needs to enable cross-account access to an encrypted S3 bucket in the data lake account (account ID 111111111111) for a Glue ETL job running in the analytics account (account ID 222222222222). The S3 bucket uses AWS KMS customer managed key (CMK) for server-side encryption (SSE-KMS). The Glue job fails with an AccessDenied error when trying to read data from the bucket. The IAM roles in both accounts have the necessary S3 permissions and the bucket policy allows access from the analytics account. What is the most likely cause of the failure?
⚠ Common exam trap
DEA-C01 often tests the misconception that S3 bucket policies alone are sufficient for cross-account access to encrypted data, ignoring the separate KMS key policy requirement for decryption.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The KMS key policy does not grant the analytics account's IAM role permission to use the key for decryption.
When an S3 bucket is encrypted with SSE-KMS using a customer managed key (CMK), cross-account access requires that the KMS key policy explicitly grants the external account's IAM role permission to use the key for decryption. Even if the S3 bucket policy allows access, KMS enforces its own key policy, and without a grant for kms:Decrypt, the Glue job in the analytics account cannot decrypt the objects. This is the most likely cause because the scenario states that S3 permissions and bucket policy are already correctly configured.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The KMS key policy does not grant the analytics account's IAM role permission to use the key for decryption.
Why this is correct
With SSE-KMS, the caller needs kms:Decrypt on the CMK in addition to S3 permissions. The bucket policy grants S3 access, but the key policy must separately authorise the analytics account's role, so its absence causes the AccessDenied failure.
- ✗
The S3 bucket is in a different region than the Glue job.
Why it's wrong here
S3 buckets are regional, yet Glue reads cross-region buckets over the S3 endpoint without AccessDenied; latency, not authorisation, changes. Region mismatch is a tempting scapegoat for connectivity failures, but the error is authorisation, and the real cause is the KMS key policy omitting the analytics account's role.
- ✗
The Glue job does not have an IAM role assigned.
Why it's wrong here
The stem confirms the IAM roles in both accounts hold the necessary S3 permissions, so the Glue job's role exists and is attached. Missing execution roles are a common cause of Glue AccessDenied, making this tempting, but the actual failure is the KMS key policy not granting decrypt to the analytics role.
- ✗
The S3 bucket policy does not allow the s3:GetObject action for the analytics account's IAM role.
Why it's wrong here
The stem states the bucket policy already allows access from the analytics account, so a missing s3:GetObject grant cannot be the cause. Bucket policies are the standard mechanism for cross-account S3 authorisation, making this tempting, but here the actual blocker is the KMS key policy not permitting the analytics role to decrypt.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every DEA-C01 question from scratch — 1,321 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on DEA-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A data engineer needs to share a dataset from an S3 bucket in Account A with another AWS account (Account B). The data must remain encrypted at rest with KMS. Which steps are required?
easy- A.Update the KMS key policy to allow Account B's root user
- B.Create an IAM role in Account A and grant cross-account access
- ✓ C.Update the S3 bucket policy and the KMS key policy to allow Account B
- D.Update the S3 bucket policy to allow Account B's root user
Why C: The correct steps are to update both the S3 bucket policy to grant Account B access to the objects and the KMS key policy to grant Account B the necessary decrypt permissions. Option A is insufficient because it only updates the KMS key policy; the bucket policy must also be updated to allow Account B's access to the S3 objects. Option B is also insufficient because creating an IAM role alone does not grant KMS decrypt permissions; the KMS key policy must be updated. Option C is correct as it includes both. Option D is insufficient because it only updates the bucket policy, not the KMS key policy.
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This DEA-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DEA-C01 exam.