DEA-C01 Data Security and Governance Practice Question
A financial services company uses Amazon Redshift for its data warehouse. The compliance team requires that all access to the database be logged, including the SQL queries executed, and that the logs be stored in a separate S3 bucket that is encrypted with a customer-managed KMS key. Additionally, the logs must be retained for 7 years. The data engineer has enabled audit logging on the Redshift cluster and configured it to deliver logs to an S3 bucket. However, the compliance team reports that the logs are not being delivered. The S3 bucket policy allows the Redshift service to write logs. What is the most likely reason for the failure?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The S3 bucket policy does not include a statement allowing the Redshift service principal to write objects.
Amazon Redshift audit logging requires a specific S3 bucket policy that grants the Redshift service principal permission to write objects. Without this policy statement, log delivery fails. Option A is incorrect because the S3 bucket can be in a different region. Option B is incorrect because versioning does not block log delivery. Option C is incorrect because the issue is the bucket policy, not the KMS key policy; the Redshift service principal needs s3:PutObject permission, not KMS decrypt.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The S3 bucket is in a different region than the Redshift cluster.
Why it's wrong here
Cross-region delivery is supported.
- ✗
The S3 bucket has versioning enabled, which blocks log delivery.
Why it's wrong here
Versioning does not block delivery.
- ✗
The KMS key policy does not grant the Redshift service principal decrypt permissions.
Why it's wrong here
Redshift does not need decrypt for writing logs.
- ✓
The S3 bucket policy does not include a statement allowing the Redshift service principal to write objects.
Why this is correct
Redshift requires explicit bucket policy for audit logging.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 1,711 original DEA-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DEA-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DEA-C01 exam.