DEA-C01 Data Security and Governance Practice Question
A healthcare company stores sensitive patient data in an S3 bucket (bucket name: patient-data-prod). The security team requires that all data be encrypted in transit and at rest, and that access be logged for auditing. The company currently uses S3 default encryption with SSE-S3. An external auditor finds that some objects have been uploaded without encryption because the default encryption setting was not applied to objects uploaded before the setting was enabled. The company wants to prevent any future unencrypted uploads and ensure all existing objects are encrypted. Which combination of actions should the data engineer take? (Choose TWO.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use S3 Batch Operations to copy all existing objects in place with the 'Copy' operation to apply default encryption.
To prevent future unencrypted uploads, the bucket policy must deny PutObject requests that do not include the x-amz-server-side-encryption header set to 'AES256' (Option E). This ensures all new objects are encrypted with SSE-S3. To encrypt existing objects that were uploaded before default encryption was enabled, S3 Batch Operations can perform a copy in place to apply default encryption (Option A). Option C alone would not apply to existing objects. Option B is unrelated, and Option D references KMS, which is not needed since SSE-S3 uses AES256. Therefore, the correct combination is Options A and E.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use S3 Batch Operations to copy all existing objects in place with the 'Copy' operation to apply default encryption.
Why this is correct
Use S3 Batch Operations with the 'Copy' operation to copy objects in place, which applies the bucket's default encryption setting to each object.
- ✗
Enable S3 Object Ownership and set the bucket ACL to private.
Why it's wrong here
Object Ownership and ACLs do not enforce encryption. They control access permissions, not data encryption.
- ✗
Enable S3 default encryption on the bucket.
Why it's wrong here
Enabling default encryption only applies to new objects uploaded after the setting is enabled. It does not encrypt existing objects or prevent unencrypted uploads unless combined with a bucket policy.
- ✗
Create a bucket policy that denies s3:PutObject if the x-amz-server-side-encryption-aws-kms-key-id is not present.
Why it's wrong here
This policy denies PutObject if the KMS key ID is missing, but SSE-S3 uses AES256 (not KMS). The condition should check for the x-amz-server-side-encryption header set to 'AES256'.
- ✓
Create a bucket policy that denies s3:PutObject if the x-amz-server-side-encryption header is not set to 'AES256'.
Why this is correct
A bucket policy that denies s3:PutObject when the x-amz-server-side-encryption header is not set to 'AES256' ensures all new objects are encrypted with SSE-S3, preventing unencrypted uploads.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every DEA-C01 question from scratch — 1,711 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on DEA-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company has an S3 bucket with versioning enabled and a bucket policy that denies access if the request does not include encryption. A data engineer notices that some objects are not encrypted. What is the most likely cause?
hard- A.The bucket policy does not evaluate requests from the same account.
- ✓ B.The policy only applies to new uploads; existing objects remain unencrypted.
- C.Default encryption was not enabled at the bucket level.
- D.Versioning was enabled after the objects were uploaded.
Why B: A bucket policy that denies unencrypted requests only applies to new uploads made after the policy is effective. Objects already in the bucket remain unencrypted. Option A is wrong because bucket policies apply to all requests, including those from the same account. Option C is wrong because default encryption would only apply to new objects, not existing ones. Option D is wrong because versioning does not retroactively encrypt existing objects.
Variation 2. A company wants to enforce that all data written to an S3 bucket is encrypted with a customer-managed AWS KMS key. The data engineer has created the KMS key and attached an S3 bucket policy. However, users are still able to upload objects without specifying the KMS key. What is the most likely cause?
easy- ✓ A.The S3 bucket policy does not include a condition that denies s3:PutObject without the correct encryption
- B.The S3 bucket has default encryption enabled with SSE-S3
- C.The KMS key policy does not grant the users kms:Encrypt permission
- D.The IAM role for the users does not have s3:PutObject permission
Why A: The bucket policy must explicitly deny s3:PutObject if the encryption header does not match the required KMS key. Without this condition, users can upload objects without specifying the KMS key, even if the bucket has default encryption. Option B is wrong because default encryption with SSE-S3 does not enforce a customer-managed KMS key. Option C is wrong because the KMS key policy grants encryption permissions, but the issue is that the bucket policy does not deny non-compliant uploads. Option D is wrong because the IAM role's s3:PutObject permission is not the issue; the issue is the lack of a condition in the bucket policy.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DEA-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DEA-C01 exam.