The correct answer is to enable default encryption on the S3 bucket using SSE-KMS, because this satisfies the requirement for company-managed encryption keys while also ensuring that multiple AWS services can access the data. The key technical concept here is that when you enforce S3 encryption with SSE-KMS using a customer-managed key, the KMS key policy must explicitly grant decryption permissions (kms:Decrypt) to any AWS service that needs to read the objects—otherwise, even with bucket-level default encryption enabled, services like Lambda or Athena will fail with access denied errors. On the AWS Certified Data Engineer Associate DEA-C01 exam, this scenario tests your understanding of the interplay between S3 bucket policies and KMS key policies, with a common trap being that candidates assume bucket-level encryption settings alone are sufficient for cross-service access. A helpful memory tip is "bucket encrypts, key permits"—the bucket enforces encryption at rest, but the key policy is what actually allows services to decrypt and use the data.
DEA-C01 Data Store Management Practice Question
This DEA-C01 practice question tests your understanding of data store management. This is a configuration task: choose the command set that satisfies every stated requirement. Small differences — like 'secret' vs 'password' or 'transport input ssh' vs 'all' — change whether the answer is correct. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A company stores sensitive data in Amazon S3. The security team requires encryption at rest and that the encryption keys are managed by the company using AWS KMS. The data is frequently accessed by multiple AWS services. Which THREE steps should be taken to meet these requirements?
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure the KMS key policy to allow the necessary AWS services to use the key for decryption
Option B is correct because the security team requires that encryption keys be managed by the company using AWS KMS, and that multiple AWS services can access the data. To allow those services to decrypt objects encrypted with a customer-managed KMS key, the KMS key policy must explicitly grant the necessary AWS services (e.g., AWS Lambda, Amazon Athena) permission to use the key for decryption (kms:Decrypt). Without this policy, even if the bucket is configured for SSE-KMS, the services will fail to read the encrypted objects.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
Use client-side encryption with the KMS key before uploading to S3
Why it's wrong here
Client-side encryption is not necessary; server-side encryption suffices.
✓
Configure the KMS key policy to allow the necessary AWS services to use the key for decryption
Why this is correct
Services must have decrypt permissions to access the encrypted objects.
Related concept
Read the scenario before looking for a memorised answer.
✗
Enable default encryption on the S3 bucket using SSE-S3
Why it's wrong here
SSE-S3 uses AWS-managed keys, not customer-managed.
✓
Create a bucket policy that denies s3:PutObject if the object is not encrypted with SSE-KMS
Why this is correct
This ensures all objects are encrypted with the required KMS key.
Related concept
Read the scenario before looking for a memorised answer.
✓
Enable default encryption on the S3 bucket using SSE-KMS
Why this is correct
SSE-KMS allows you to use your own KMS key for encryption.
Related concept
Read the scenario before looking for a memorised answer.
Common exam traps
Common exam trap: answer the scenario, not the keyword
AWS often tests the distinction between enforcing encryption (bucket policy) and enabling access to encrypted data (KMS key policy), leading candidates to overlook the KMS key policy step when multiple services need to decrypt objects.
Detailed technical explanation
How to think about this question
SSE-KMS uses envelope encryption: S3 requests KMS to generate a data key (via GenerateDataKey), encrypts the object with that data key, and stores the encrypted data key alongside the object. When an AWS service reads the object, it must call kms:Decrypt to unwrap the data key, which requires the KMS key policy to grant the service principal the kms:Decrypt permission. Additionally, the bucket policy in option D (deny s3:PutObject if not SSE-KMS) enforces encryption at upload time, but it does not control key management; it is a complementary step to ensure all objects are encrypted with SSE-KMS, but the key policy is the critical step for service access.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A media company stores terabytes of video archives that are accessed once a year for audit purposes. Moving these objects to a cold storage tier (Azure Archive, S3 Glacier, or Google Nearline) costs a fraction of hot storage. Questions like this test whether you understand storage tiers, access frequency tradeoffs, and retrieval latency requirements.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Data Store Management — This question tests Data Store Management — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Configure the KMS key policy to allow the necessary AWS services to use the key for decryption — Option B is correct because the security team requires that encryption keys be managed by the company using AWS KMS, and that multiple AWS services can access the data. To allow those services to decrypt objects encrypted with a customer-managed KMS key, the KMS key policy must explicitly grant the necessary AWS services (e.g., AWS Lambda, Amazon Athena) permission to use the key for decryption (kms:Decrypt). Without this policy, even if the bucket is configured for SSE-KMS, the services will fail to read the encrypted objects.
What should I do if I get this DEA-C01 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company is using Amazon S3 to store sensitive data. They need to ensure that all objects are encrypted at rest. Which combination of actions should be taken? (Choose TWO.)
medium
A.Enable S3 Versioning on the bucket.
B.Enable MFA Delete on the bucket.
C.Configure S3 Access Points with network policies.
✓ D.Use a bucket policy to deny PutObject requests that do not include the x-amz-server-side-encryption header.
✓ E.Enable default encryption on the S3 bucket.
Why D: Option D is correct because a bucket policy that denies PutObject requests lacking the `x-amz-server-side-encryption` header enforces encryption at the time of upload, ensuring that any object written without explicit encryption headers is rejected. Option E is correct because enabling default encryption on the S3 bucket automatically applies server-side encryption (SSE-S3 or SSE-KMS) to any object uploaded without specifying encryption headers, providing a fallback that covers all objects. Together, these actions ensure that every object stored in the bucket is encrypted at rest, either by explicit client request or by default bucket settings.
Variation 2. A company uses Amazon S3 to store sensitive data. The security team requires that all data be encrypted at rest using a customer-managed key that is rotated annually. Which encryption option should be used?
easy
✓ A.SSE-KMS (Server-Side Encryption with AWS KMS).
B.SSE-S3 (Server-Side Encryption with S3-managed keys).
C.Client-side encryption.
D.SSE-C (Server-Side Encryption with Customer-Provided keys).
Why A: SSE-KMS is the correct choice because it allows you to use a customer-managed key (CMK) in AWS KMS, which you can configure to rotate automatically on an annual schedule. This satisfies the security team's requirement for encryption at rest with a key you control and rotate yearly, while still leveraging server-side encryption that integrates with S3's existing infrastructure.
Variation 3. A company uses Amazon S3 to store sensitive data. The security team wants to ensure that all objects uploaded to a specific S3 bucket are automatically encrypted at rest using server-side encryption with AWS KMS managed keys (SSE-KMS). Which bucket policy statement should be added to enforce this requirement?
medium
A.Deny put requests where 's3:x-amz-server-side-encryption' is 'aws:kms'
✓ B.Deny put requests where 's3:x-amz-server-side-encryption' is not 'aws:kms'
C.Deny put requests where 's3:x-amz-server-side-encryption' is not 'AES256'
D.Deny put requests where 's3:x-amz-server-side-encryption' is not set
Why B: Option C is correct because the condition 's3:x-amz-server-side-encryption': 'aws:kms' enforces SSE-KMS. Option A denies requests with SSE-S3 but allows unencrypted uploads. Option B denies without encryption but allows SSE-S3. Option D denies SSE-KMS, which is the opposite of what is needed.
Variation 4. A company is using Amazon S3 to store sensitive data. The security team requires that all data be encrypted at rest using a customer-managed AWS KMS key. The data engineer must ensure that only a specific IAM role can decrypt the data. Which policy should the data engineer attach to the KMS key?
hard
✓ A.A KMS key policy that allows the IAM role to perform kms:Decrypt
B.An IAM user policy that allows kms:Decrypt for the specific key
C.An IAM policy attached to the role that allows kms:Decrypt
D.An S3 bucket policy that denies access unless encryption is used
Why A: Option C is correct because the KMS key policy must grant the IAM role permission to decrypt. Option A is wrong because the IAM policy alone is not sufficient; KMS key policy must allow the role to decrypt. Option B is wrong because the S3 bucket policy controls access to S3, not KMS. Option D is wrong because the IAM user policy is less secure and doesn't address role-based access.
Last reviewed: Jun 30, 2026
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This DEA-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DEA-C01 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.