DEA-C01 Data Security and Governance Practice Question
Which TWO actions are required to enforce encryption in transit for data being loaded into Amazon Redshift from Amazon S3? (Choose two.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure Redshift to require SSL connections
To enforce encryption in transit for data loaded from S3 into Redshift, you need SSL connections on Redshift (option A) to encrypt the connection between the client and Redshift, and S3 VPC endpoints with HTTPS (option E) to encrypt data transfer from S3 to Redshift via the VPC endpoint. Option B is client-side encryption, which encrypts data before it reaches S3 and is not required for transit. Option C enables encryption at rest on the Redshift cluster, not in transit. Option D is about server-side encryption at rest in S3, not transit.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Configure Redshift to require SSL connections
Why this is correct
Ensures data in transit to Redshift is encrypted.
- ✗
Use client-side encryption for data in S3
Why it's wrong here
Encrypts data before uploading to S3, but does not enforce transit encryption to Redshift.
- ✗
Enable encryption at rest on Redshift cluster
Why it's wrong here
Encrypts data at rest, not in transit.
- ✗
Enable S3 server-side encryption
Why it's wrong here
Encrypts objects at rest in S3, not in transit.
- ✓
Use S3 VPC endpoints with HTTPS
Why this is correct
Enforces encryption in transit between S3 and Redshift.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every DEA-C01 question from scratch — 1,711 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DEA-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DEA-C01 exam.