DEA-C01 Practice Test 32 — 15 Questions

Question 1

A data engineer needs to ensure that an Amazon Redshift cluster encrypts all data at rest. Which setting must be enabled when creating the cluster?

Accepted Answer

Enable encryption. Amazon Redshift encryption at rest is enabled during cluster creation by selecting the encryption option. Option A is incorrect because enabling automated snapshots is for backup and recovery, not encryption. Option C is incorrect because SSL/TLS ensures encryption in transit, not at rest. Option D is incorrect because VPC is for network isolation, not encryption.

Answer

Enable automated snapshots

Answer

Enable SSL/TLS

Answer

Enable VPC

Question 2

A data engineer needs to allow an IAM user to rotate the secret in AWS Secrets Manager for an RDS database. Which IAM action should be included in the policy?

Accepted Answer

secretsmanager:RotateSecret. The secretsmanager:RotateSecret action allows the user to initiate rotation of a secret. Option A is correct. secretsmanager:GetSecretValue only retrieves the secret value, not rotate it.

Answer

secretsmanager:PutSecretValue

Answer

secretsmanager:UpdateSecret

Answer

secretsmanager:GetSecretValue

Question 3

A company uses Amazon Redshift for data warehousing. The security team requires that all data be encrypted at rest using a key managed by the company. Which Redshift encryption option should be used?

Accepted Answer

Specify a customer managed KMS key when enabling encryption. Amazon Redshift supports encryption at rest using AWS KMS. To use a key managed by the company (customer managed key), you must specify a customer managed KMS key when enabling encryption. Option D is correct. Option A uses an AWS managed key (default), which is not managed by the company. Option B refers to encryption in transit, not at rest. Option C: HSM is not directly supported for Redshift encryption; KMS is used.

Answer

Enable encryption using AWS managed key (default)

Answer

Use SSL/TLS encryption

Answer

Use hardware security module (HSM)

Question 4

A company is designing a data lake on Amazon S3. The security team requires granular access control based on data classifications. Which TWO AWS services can be used together to implement attribute-based access control (ABAC) for objects in S3?

Accepted Answer

Amazon S3 object tags. IAM policies support ABAC by using condition keys based on resource tags. S3 object tags allow you to attach metadata to objects, and these tags can be referenced in IAM policy conditions to control access. This combination enables granular, attribute-based access control for S3 objects. AWS Lake Formation also supports ABAC, but it is primarily used for managing permissions on a data lake catalog, not directly on S3 objects; the most direct and commonly used services for ABAC on S3 objects are IAM and S3 object tags. AWS Secrets Manager is for managing secrets, KMS is for encryption keys, and neither provides access control based on object attributes.

Answer

AWS Secrets Manager

Answer

AWS Lake Formation

Answer

AWS Key Management Service (KMS)

Question 5

The IAM policy shown is attached to an IAM role. When a user assumes this role and tries to read an object in example-bucket that has no tags, what will happen?

Accepted Answer

The request will be denied because the Deny statement applies when the tag is missing. The Deny statement denies s3:GetObject if the object does not have the tag 'classification' (i.e., the tag is null). Since the object has no tags, the condition evaluates to true, and the action is denied. The Allow statement only allows if the tag equals 'public', which is not the case. The explicit Deny overrides any Allow, so access is denied.

Answer

The request will be denied because the object does not have the 'public' tag

Answer

The request will be allowed because the Allow statement grants access to all objects

Answer

The request will be allowed because there is no explicit Deny

Question 6

A company needs to enforce encryption at rest for all data stored in Amazon S3. The security team wants to ensure that no objects can be uploaded without encryption. Which THREE steps should be taken to meet this requirement?

Accepted Answer

Use AWS Key Management Service (KMS) to manage encryption keys. A bucket policy denying s3:PutObject without the x-amz-server-side-encryption header enforces encryption. Using SSE-S3 or SSE-KMS ensures encryption at rest. SSE-C is not recommended for most cases. Requiring HTTPS ensures encryption in transit, not at rest. CloudTrail is for auditing.

Answer

Require all clients to use AWS CloudTrail for logging

Answer

Enable Amazon S3 Transfer Acceleration

Question 7

A company needs to centralize audit logs from multiple AWS accounts into a single S3 bucket. Which service should be used to aggregate these logs?

Accepted Answer

AWS CloudTrail. AWS CloudTrail can be configured to deliver logs from multiple accounts to a single S3 bucket using a trail in the management account. Option C is correct.

Answer

AWS Config

Answer

Amazon Kinesis Data Firehose

Answer

Amazon CloudWatch Logs

Question 8

A data engineer needs to ensure that an S3 bucket can only be accessed from a specific VPC. Which policy element should be used?

Accepted Answer

Use the condition key aws:SourceVpc in the bucket policy.. The condition key aws:SourceVpc restricts requests to originate from a specific VPC. Option C (aws:SourceVpce) limits access to a VPC endpoint, not the VPC itself. Option B (aws:SourceIp) restricts by IP address, not VPC. Option A (aws:VpcSourceIp) is not a valid condition key.

Answer

Use the condition key aws:VpcSourceIp in the bucket policy.

Answer

Use the condition key aws:SourceIp in the bucket policy.

Answer

Use the condition key aws:SourceVpce in the bucket policy.

Question 9

A data engineer needs to audit all AWS KMS key usage events for the past 90 days to verify compliance. Which AWS service should be used?

Accepted Answer

AWS CloudTrail. (AWS CloudTrail). AWS CloudTrail logs all API calls made to AWS KMS, including key usage events, and retains event history for the past 90 days by default, making it suitable for auditing. Option A (VPC Flow Logs) captures network traffic, not API calls. Option C (AWS Config) tracks resource configuration changes, not API calls. Option D (Amazon Inspector) performs vulnerability assessments, not API logging.

Answer

VPC Flow Logs

Answer

AWS Config

Answer

Amazon Inspector

Question 10

A company uses Amazon Athena to query data in S3. The security team wants to ensure that users can only query tables they have permissions to in the AWS Glue Data Catalog. Which service should be used to manage these permissions centrally?

Accepted Answer

AWS Lake Formation. Lake Formation provides centralized permissions management for the Glue Data Catalog. Option B (IAM) is too low-level and does not integrate directly with Data Catalog tables. Option C (S3 bucket policy) does not control table access. Option D (CloudTrail) is for auditing, not access control.

Answer

AWS IAM

Answer

AWS CloudTrail

Answer

S3 bucket policies

Question 11

Refer to the exhibit. A data engineer runs this AWS CLI command to execute an Athena query. What is the purpose of the EncryptionConfiguration parameter?

Accepted Answer

It encrypts the query results stored in Amazon S3 at rest. The EncryptionConfiguration parameter in Athena specifies how the query results stored in S3 are encrypted at rest. SSE_S3 means server-side encryption with S3-managed keys. It does not encrypt the query itself, data in transit, or the source data.

Answer

It encrypts the query string in transit

Answer

It encrypts the data in the source table

Answer

It enables client-side encryption for the query output

Question 12

Refer to the exhibit. An IAM policy is attached to a user. What is the security implication of this policy?

Accepted Answer

The policy grants excessive permissions, violating least privilege.. The policy, which grants full S3 access to all resources, violates the principle of least privilege by providing excessive permissions. Option A is incorrect because the policy does not only allow read access; it allows all actions. Option B is incorrect because the use of asterisks is valid syntax in IAM policies. Option C is incorrect because the policy is overly permissive, not restrictive.

Answer

The policy only allows read access.

Answer

The policy is invalid because it uses asterisks.

Answer

The policy is too restrictive.

Question 13

A data engineer is designing a data lake on Amazon S3. The data is ingested from multiple sources in Parquet format, partitioned by date. The engineer needs to ensure that queries using Amazon Athena are cost-effective and perform well. Which approach should the engineer take?

Accepted Answer

Use Parquet format with Snappy compression and partition by year, month, day.. Parquet is a columnar storage format that reduces the amount of data scanned by Athena, and Snappy compression provides a good balance between compression ratio and decompression speed. Partitioning by year, month, and day allows Athena to use partition pruning to skip irrelevant data, minimizing scanned bytes and reducing query cost.

Answer

Store data in uncompressed CSV format and partition by year, month, day, hour.

Answer

Use JSON format with Snappy compression and partition by date only.

Answer

Use Gzip-compressed CSV files with no partitioning.

Question 14

A data engineer is designing a data pipeline that ingests JSON files from an S3 bucket, transforms them using AWS Glue, and loads into Amazon Redshift. The data is updated daily, and the pipeline must handle late-arriving data from the previous day. Which approach minimizes reprocessing?

Accepted Answer

Use AWS Glue job bookmarks to process only new files based on S3 event notifications.. AWS Glue job bookmarks track previously processed files and process only new or changed files, which handles late-arriving data without reprocessing all data. Option B uses Amazon Kinesis Data Firehose to stream data to Redshift; this is designed for real-time streaming, not a batch pipeline with daily updates, and does not inherently handle late-arriving data without custom logic. Option C (S3 versioning) can manage multiple versions but does not provide incremental processing for late-arriving data; it would require custom logic to determine which version to process. Option D (scheduling a full reload) would reprocess all data daily, which is inefficient and does not handle late-arriving data efficiently.

Answer

Stream data using Amazon Kinesis Data Firehose to Redshift.

Answer

Enable S3 versioning and process only the latest version of each object.

Answer

Schedule a full reload of all data from S3 to Redshift each day.

Question 15

A company wants to audit all changes to IAM policies in their AWS account. Which AWS service should be used to record these changes for compliance purposes?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records API calls, including IAM policy changes. AWS Config records resource configurations but not all API calls. CloudWatch Logs can store logs but does not record API calls itself. S3 is the destination for logs, not the recording service.

Answer

Amazon CloudWatch Logs

Answer

AWS Config

Answer

Amazon S3