Encryption and masking: DEA-C01 study notes and practice questions
What to know about Encryption and masking for the DEA-C01 exam, from the Data Security and Governance domain (18% of the exam guide), then 2 free questions to test it. Part of the DEA-C01 study guide.
Encryption questions ask which option meets a control rule, such as “the company must manage the keys” or “audit every key use”, at lowest cost.
KMS keys
Key type
Control
Notes
AWS owned
None
Free, invisible
AWS managed (aws/s3)
View only
Rotated automatically; can’t be shared cross-account
Customer managed
Full: key policy, rotation, disable, delete
Needed for cross-account use and custom policies; usage logged in CloudTrail
Key policies are the primary control; IAM policies work only if the key policy allows them.
Automatic rotation (yearly by default, configurable) keeps old versions to decrypt existing data.
Multi-Region keys encrypt in one Region and decrypt in another.
CloudHSM or external key stores when keys must stay in your own HSM.
S3
SSE-S3 (default for new objects): S3 manages keys.
SSE-KMS: KMS keys with audit trail and policy control. S3 Bucket Keys cut KMS request costs by up to 99%.
DSSE-KMS: two layers for strict rules.
SSE-C: you supply the key on every request.
Client-side encryption before upload.
Enforce with default encryption and bucket policies that deny other options; enforce TLS with aws:SecureTransport.
Other services
Redshift: KMS encryption for the cluster and snapshots.
Glue: security configurations encrypt S3 output, CloudWatch logs and job bookmarks; Data Catalog encryption setting.
Kinesis Data Streams, Firehose, MSK, DynamoDB, EMR (at-rest and in-transit settings in a security configuration), Athena query results all support KMS.
Amazon Macie finds sensitive data (PII) in S3.
Common traps
AWS managed key for cross-account access. Use a customer managed key and add the other account to the key policy.
SSE-KMS at very high request rates without Bucket Keys, causing throttling and cost.
Missing KMS permissions for a role that can read the bucket.
A bank's central data account stores encrypted loan files in an Amazon S3 bucket, using a customer managed KMS key that the central account owns. A reporting account runs an AWS Glue job that must read those files. The reporting account's Glue role has full S3 read access to the bucket, but the job fails with access denied when it tries to decrypt the files.
The central team wants to keep the key in its own account and to grant access to only the reporting account's Glue role.
Which change meets these requirements?
Choose one answer.
AA. Turn off the key's encryption for the bucket and use S3 managed keys, so the reporting account needs no KMS key.
BB. Give the reporting account's Glue role a copy of the central account's administrator role, so that it can use every KMS key there.
CC. Copy the encrypted files to the reporting account, and re-encrypt them there with a key that the reporting account owns.
DD. Grant the reporting account's Glue role kms:Decrypt in the key policy, and the same action in its own IAM policy.
Show the answer and explanation
Answer: D
A. Wrong: Turning off KMS removes the customer managed key the bank requires, and it changes the protection of the data. The option breaks the stated encryption requirement.
B. Wrong: Sharing the administrator role gives the reporting account control over every key and resource in the central account. The option grants far more than the single decrypt the job needs.
C. Wrong: Copying the data duplicates the loan files outside the central account and gives the central team no control over them. The option also needs a re-encryption job the team does not want.
D. Right: Correct. Cross-account KMS use needs permission in both places: the key policy in the owning account and an IAM policy on the principal in its own account. Granting only one of them leaves the decrypt call denied, and this design grants both to the one role. Learn more: Allowing users in other accounts to use a KMS key (opens in a new tab)
Explanation
Using a KMS key from another account needs two grants that point at each other: the owning account's key policy must allow the external principal, and that principal's own IAM policy must allow the KMS action. Granting only the key policy or only the IAM policy is not enough. Turning encryption off, sharing an admin role or copying the files each break a stated requirement.
A healthcare-analytics company's partners upload extracts to an Amazon S3 bucket with their own tools, and a few older systems still send requests over plain HTTP. The company's security policy requires that all data in transit to the bucket be encrypted, and the bucket is already encrypted at rest with SSE-KMS.
The company has told partners to use HTTPS, and it wants the bucket itself to reject any request that is not encrypted in transit.
Which change meets this requirement?
Choose one answer.
AA. Add a bucket policy that denies all s3:* actions when the aws:SecureTransport condition key is false, so that only HTTPS requests are accepted.
BB. Turn on default SSE-KMS encryption for the bucket, which already protects the data at rest and so covers requests made over HTTP.
CC. Put the bucket behind an Amazon CloudFront distribution that accepts HTTP and forwards requests to S3 over HTTPS.
DD. Create a security group that allows only port 443 to the bucket, and attach it to the partners' networks.
Show the answer and explanation
Answer: A
A. Right: Correct. The aws:SecureTransport condition key is true only for requests made over TLS. A bucket policy that denies requests when it is false rejects plain HTTP, while partner tools that use HTTPS keep working. Learn more: Security best practices for Amazon S3 (opens in a new tab)
B. Wrong: Encryption at rest protects the stored objects, but it does not secure the requests that carry data to the bucket. Plain HTTP requests would still be accepted, which the policy forbids.
C. Wrong: A CloudFront distribution that accepts HTTP would still let plain HTTP requests in from the partners. The option does not stop the requests the policy forbids.
D. Wrong: Security groups apply to resources in a VPC, not to S3 bucket requests, and partners' networks are outside the company's VPC. The option does not control requests to the bucket.
Explanation
Encryption at rest and encryption in transit are separate controls. The aws:SecureTransport condition key is true only for TLS requests, so a bucket policy that denies requests when it is false rejects plain HTTP while the partners' HTTPS tools keep working. SSE-KMS, a CloudFront front end and security groups do not stop plain HTTP requests to the bucket.
Want more on Encryption and masking? The 5 full-length practice sets have 7 more Encryption and masking questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →