DEA-C01 Practice Question 60: Athena Workgroup Result Encryption

Athena states the capability directly: "Workgroups allow you to enforce the encryption of query results." The enforcement comes from one setting: "when you create or edit a workgroup and select the Override client-side settings field, then all queries that run in this workgroup use the workgroup encryption and query results location settings." The documentation spells out the consequence for the three client types in the stem: "The encryption configuration and the query results location specified on the Settings tab in the Athena console, by API operations and by JDBC and ODBC drivers aren't used." That closes the opt-out, and choosing SSE-KMS or CSE-KMS with the named key satisfies the specific-key requirement.

Option C is the client-side setting, which is precisely what can be overridden or simply not set. It relies on every analyst doing the right thing in every tool, which is not enforcement.

Option A operates on the wrong surface. The condition key governs the request header, and it is fragile here; Athena writes results as a service on the user's behalf, so the policy is easy to get wrong, it cannot pin a particular KMS key on its own, and it produces confusing query failures rather than encrypted output.

Option D is the strongest distractor, because bucket default encryption does encrypt objects written without their own encryption headers. But it applies only to the one bucket, and the stem says analysts can set their own result location; results written elsewhere would be unprotected. The workgroup override fixes the location and the encryption together.

Reference: Encrypt Athena query results stored in Amazon S3