Get Your CertDEA-C01PlayCompete
‹ All DEA-C01 questions

DEA-C01 Practice Question 69: Redshift Require SSL Parameter

AWS Certified Data Engineer – Associate (DEA-C01) · Test 7 · question 9 of 10

Data Security and Governanceeasy

A security policy states that all client connections to an Amazon Redshift cluster must be encrypted in transit. An audit shows that some legacy tools connect with SSL turned off, and the cluster accepts them. What should the data engineer do to enforce the policy?

Select one answer
Show answer and explanation

Answer:

  • B. Set the require_SSL parameter to true in the cluster's parameter group.

AWS states: *"By default, cluster databases accept a connection whether it uses SSL or not. To configure your cluster to require an SSL connection, set the require_SSL parameter to true in the parameter group that is associated with the cluster."* Clients that try to connect with SSL disabled are then refused (option B).

- A is wrong because KMS encryption protects data at rest. It does not force client connections to use SSL. - C is wrong because audit logging records connection and query activity. It reports non-SSL connections after the fact and does not block them. - D is wrong because limiting source networks controls who can reach the cluster, not whether the connection is encrypted.

Reference: Configuring security options for connections

Practice Test 7 ›

Study guides for DEA-C01

AWS Developer Associate exam guide: DVA-C02 to DVA-C03AWS Developer Associate exam: DVA-C02 ends 30 November 2026 and DVA-C03 starts 1 December. What changes, which to sit, format, price and study plan.
How AWS Certification Exams Work: Scoring and RenewalHow AWS certification exams work: levels, booking, question types, unscored questions, scaled scores, pass marks, validity and how recertification works.
What Is Amazon RDS? Multi-AZ, Read Replicas and BackupsWhat is Amazon RDS? Engines, Multi-AZ, read replicas, backups, RDS Proxy, Aurora and pricing explained, with the traps that AWS exams set around each one.
Microsoft Fabric certification: DP-700 vs DP-600Microsoft Fabric certification means two exams, DP-600 and DP-700. Their roles, skills, format, cost in India, and which one to take first.
Databricks Data Engineer Associate vs AWS DEA-C01Databricks Data Engineer Associate vs AWS Certified Data Engineer – Associate - format, cost, topics and which one to take for your job, as of 2026.
Which AWS certification should you get? 2026 roadmapWhich AWS certification to get first, by role and experience, with each exam's status in October 2026, what is changing, and prices in USD and INR.
What Is AWS Glue? Data Catalog, Crawlers and ETL JobsWhat is AWS Glue? The Data Catalog, crawlers, ETL jobs and DPUs, workflows, streaming, job bookmarks, Flex and Data Quality, plus the traps AWS exams set.