DEA-C01 Data Security and Governance Practice Question
A financial services company uses AWS KMS to encrypt data in Amazon S3. The compliance team requires that all encryption keys be rotated automatically every 365 days. The data engineer needs to implement this requirement without manual intervention. Which solution meets the requirement with the LEAST operational overhead?
⚠ Common exam trap
Test-takers frequently assume customer managed keys (CMK) with automatic rotation are the only way to meet a specific rotation interval, overlooking that AWS managed keys already rotate on a 365-day schedule and require zero configuration, making them the least overhead solution.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use the AWS managed key for Amazon S3 (aws/s3) for server-side encryption.
The AWS managed key for Amazon S3 (aws/s3) is automatically rotated by AWS every 365 days (or less) with no configuration or maintenance required. This satisfies the compliance requirement with zero operational overhead, as the rotation is handled entirely by the AWS KMS service without any manual intervention or custom automation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create a customer managed key (CMK) in KMS with automatic rotation enabled every 365 days. Use this CMK to encrypt S3 objects.
Why it's wrong here
CMKs with automatic rotation work but have more overhead (cost, key policy management) than AWS managed keys.
- ✗
Create a customer managed key with imported key material and configure a Lambda function to rotate the key every 365 days.
Why it's wrong here
Imported key material does not support automatic rotation; manual or custom rotation is required.
- ✓
Use the AWS managed key for Amazon S3 (aws/s3) for server-side encryption.
Why this is correct
AWS managed keys are automatically rotated every year with no operational overhead.
- ✗
Use S3 server-side encryption with S3 managed keys (SSE-S3).
Why it's wrong here
SSE-S3 also rotates keys automatically but the question expects KMS; SSE-S3 is less configurable but still rotates, but AWS managed key is the intended answer for KMS scenario.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 1,711 original DEA-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DEA-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DEA-C01 exam.