DEA-C01 Practice Test 31 — 15 Questions

Question 1

A company is using AWS Lake Formation to manage access to a data lake in S3. They want to grant a data analyst access to specific columns in a table, but not to the entire table. Which Lake Formation feature should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Column-level filtering. Lake Formation column-level filtering allows granting access to specific columns in a table without granting access to the entire table. Option A (row-level security) controls access to rows, not columns. Option B (IAM policies on the S3 bucket) would grant access to the entire dataset or bucket, not specific columns. Option D (tag-based access control) uses tags to manage permissions but does not provide column-level granularity.

Answer

Row-level security (cell-level filtering)

Answer

IAM policies on the S3 bucket

Answer

Tag-based access control (TBAC)

Question 2

A data engineer needs to audit all AWS KMS key usage in the account. Which AWS service should be used to record KMS API calls?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records API calls for KMS. Option B (AWS Config) is wrong because it records resource changes, not API calls. Option C (Amazon CloudWatch Logs) is wrong because it stores logs but does not record API calls. Option D (Amazon GuardDuty) is wrong because it is for threat detection.

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Answer

Amazon GuardDuty

Question 3

A company uses Amazon RDS for MySQL with Multi-AZ deployment. The database experiences high write latency during peak hours. The application uses InnoDB tables. Which action would reduce write latency without changing the application code?

Accepted Answer

Increase the DB instance class size. Increasing the DB instance class size (Option D) provides more CPU and memory resources, which directly improves the database's ability to handle high write loads by reducing contention and speeding up InnoDB transaction processing. This action requires no application code changes and is the most direct way to address write latency caused by resource constraints.

Answer

Enable storage autoscaling on the DB instance

Answer

Add a read replica to offload writes

Answer

Enable Multi-AZ on the DB instance

Question 4

A data engineer is troubleshooting an issue where an IAM role used by AWS Glue cannot read data from an S3 bucket encrypted with SSE-KMS. The bucket policy allows the role to perform s3:GetObject. What additional permission is needed?

Accepted Answer

kms:Decrypt on the KMS key. For SSE-KMS, the IAM role needs kms:Decrypt permission on the KMS key to read encrypted objects. Option A (s3:GetObjectVersion) is not required because the bucket policy already allows s3:GetObject; versioning is not relevant here. Option C (s3:GetObjectAcl) is for access control lists, not encryption. Option D (kms:GenerateDataKey) is used for encrypting new objects, not reading existing ones. Therefore, the correct answer is B.

Answer

s3:GetObjectVersion

Answer

s3:GetObjectAcl

Answer

kms:GenerateDataKey on the KMS key

Question 5

A data engineer needs to enforce that all data in an Amazon S3 bucket is encrypted at rest. Which of the following can be used to achieve this? (Choose TWO.)

Accepted Answer

Configure a bucket policy to deny PutObject if encryption headers are missing. Options C and D are correct. Configuring a bucket policy to deny PutObject requests that lack encryption headers (C) enforces encryption at upload time. Enabling default encryption on the S3 bucket using SSE-S3 (D) automatically encrypts objects at rest, even if uploaded without encryption headers. Together, these ensure all data at rest is encrypted. Option A is incorrect because CloudTrail only logs API calls and does not enforce encryption. Option B is incorrect because VPC endpoints provide network isolation, not encryption. Option E is incorrect because KMS generating keys alone does not enforce encryption on S3; the bucket must be configured to use those keys.

Answer

Use AWS CloudTrail to monitor for unencrypted objects

Answer

Use VPC endpoints to restrict access

Answer

Use AWS KMS to generate encryption keys for the bucket

Question 6

A company wants to ensure that all S3 buckets are encrypted using server-side encryption. Which AWS service can be used to automatically remediate non-compliant buckets?

Accepted Answer

AWS Config. AWS Config can use managed rules like s3-bucket-server-side-encryption-enabled to check compliance and trigger auto-remediation via SSM Automation or Lambda. Option D is correct.

Answer

AWS CloudTrail

Answer

Amazon Inspector

Answer

AWS Trusted Advisor

Question 7

A data engineer is designing a data lake on S3 and needs to ensure that data is encrypted at rest using customer-managed KMS keys. The engineer also needs to audit all access to the KMS keys. Which combination of services should be used?

Accepted Answer

SSE-KMS with AWS CloudTrail. SSE-KMS allows customer-managed KMS keys, and AWS CloudTrail logs all KMS API calls (e.g., Decrypt, GenerateDataKey), enabling auditing. Option B is incorrect because SSE-C uses customer-provided encryption keys, not KMS, and CloudWatch Logs is for application logs, not KMS access. Option C is incorrect because S3 Inventory provides object metadata but does not audit KMS access. Option D is incorrect because SSE-S3 uses AWS-managed keys, not customer-managed, and S3 server access logs do not capture KMS API calls.

Answer

SSE-C with CloudWatch Logs

Answer

SSE-KMS with S3 Inventory

Answer

SSE-S3 with S3 server access logs

Question 8

Which THREE AWS services can be used to centrally manage and govern data across multiple AWS accounts? (Select THREE.)

Accepted Answer

AWS Control Tower. The correct answers are AWS Control Tower, AWS Organizations, and AWS Lake Formation. AWS Control Tower provides a pre-configured environment for governance and compliance across accounts. AWS Organizations enables centralized management of multiple accounts. AWS Lake Formation helps manage and govern data lake permissions across accounts. Amazon S3 (Option A) is a storage service, not a central governance service. Amazon Redshift (Option D) is a data warehouse, not a governance service.

Answer

Amazon S3

Answer

Amazon Redshift

Question 9

A data engineer runs the command shown to check the encryption configuration of an S3 bucket. The output shows SSEAlgorithm: AES256. What does this mean?

Accepted Answer

The bucket uses SSE-S3 with Amazon S3-managed keys. AES256 refers to SSE-S3, where Amazon S3 manages the encryption keys using AES-256. Option B (SSE-KMS) would show 'aws:kms'. Option C (SSE-C) would require the customer to provide keys. Option D (no encryption) is incorrect because encryption is enabled.

Answer

The bucket uses SSE-KMS with a customer-managed key

Answer

The bucket uses SSE-C with customer-provided keys

Answer

The bucket does not have encryption enabled

Question 10

A data engineer needs to protect sensitive data in an S3 bucket. Which TWO AWS services can be used to detect and prevent accidental public access?

Accepted Answer

AWS Trusted Advisor. AWS Trusted Advisor checks for S3 buckets with public access, helping to detect accidental public access. S3 Block Public Access can be enabled at the account or bucket level to prevent public access. AWS Config can evaluate rules but does not directly detect or prevent public access. AWS CloudTrail records API calls but does not prevent public access. Amazon Macie discovers sensitive data, not public access.

Answer

AWS Config

Answer

AWS CloudTrail

Answer

Amazon Macie

Question 11

A company uses S3 to store sensitive data. Which TWO S3 features can be used to protect data at rest?

Accepted Answer

Server-Side Encryption with S3 Managed Keys (SSE-S3). Server-Side Encryption with S3 Managed Keys (SSE-S3) and Server-Side Encryption with AWS KMS (SSE-KMS) both encrypt data at rest. Option A (S3 Versioning) protects against accidental deletion or overwrite, not encryption. Option D (S3 Transfer Acceleration) speeds up data transfers, not encryption. Option E (S3 Object Lock) prevents deletion or overwrite for compliance, not encryption.

Answer

S3 Versioning

Answer

S3 Transfer Acceleration

Answer

S3 Object Lock

Question 12

A company uses AWS Glue to process sensitive customer data stored in S3. The security team requires that all data be encrypted at rest using a customer-managed KMS key and that access to the key be auditable. Which solution meets these requirements?

Accepted Answer

Configure the S3 bucket to use SSE-KMS with a customer-managed KMS key and enable CloudTrail for KMS events.. SSE-KMS with a customer-managed KMS key provides encryption at rest and, when combined with CloudTrail logging for KMS events, offers full auditability of key usage. Option A (client-side encryption) does not encrypt data at rest within S3; it encrypts before upload. Option C (SSE-S3) uses AWS-managed keys, which do not allow customer audit of key access. Option D (SSE-C) relies on customer-provided keys that are not managed by KMS and cannot be audited via CloudTrail.

Answer

Encrypt the data client-side before uploading to S3.

Answer

Enable default SSE-S3 encryption on the S3 bucket.

Answer

Use SSE-C with a customer-provided key.

Question 13

A company wants to audit all changes to IAM policies in their AWS account. Which AWS service should be used to record these changes?

Accepted Answer

AWS Config. AWS Config records configuration changes to AWS resources, including IAM policies. CloudTrail records API calls, not configuration snapshots. GuardDuty is for threat detection. Inspector is for vulnerability assessment.

Answer

AWS CloudTrail

Answer

Amazon GuardDuty

Answer

Amazon Inspector

Question 14

A data engineer needs to grant an IAM user read-only access to a specific prefix (folder) in an S3 bucket. The bucket contains sensitive data. Which S3 bucket policy statement achieves this?

Accepted Answer

{"Effect":"Allow","Principal":{"AWS":"arn:aws:iam::123456789012:user/DataEng"},"Action":"s3:GetObject","Resource":"arn:aws:s3:::mybucket/sensitive/*"}. It grants s3:GetObject for the specific prefix and denies access to other prefixes implicitly. Option A is wrong because it grants access to all objects. Option C is wrong because it uses a condition that does not restrict prefix. Option D is wrong because it grants access to all objects in the bucket.

Answer

{"Effect":"Allow","Principal":{"AWS":"arn:aws:iam::123456789012:user/DataEng"},"Action":"s3:GetObject","Resource":"arn:aws:s3:::mybucket"}

Answer

{"Effect":"Allow","Principal":{"AWS":"arn:aws:iam::123456789012:user/DataEng"},"Action":"s3:GetObject","Resource":"arn:aws:s3:::mybucket/*","Condition":{"StringLike":{"s3:prefix":"sensitive/"}}}

Answer

{"Effect":"Allow","Principal":{"AWS":"arn:aws:iam::123456789012:user/DataEng"},"Action":"s3:GetObject","Resource":"arn:aws:s3:::mybucket/*"}

Question 15

A company needs to audit all API calls made in their AWS account, including actions performed by the root user. Which AWS service should be used?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records all API calls made in an AWS account, including root user actions, for auditing and compliance. Option A is incorrect because VPC Flow Logs capture network traffic metadata, not API calls. Option C is incorrect because Amazon CloudWatch Logs stores log data but does not natively capture API calls; it can ingest logs from other sources. Option D is incorrect because AWS Config tracks configuration changes to AWS resources, not API calls.

Answer

VPC Flow Logs

Answer

Amazon CloudWatch Logs

Answer

AWS Config