DEA-C01 Practice Test 42 — 15 Questions

Question 1

A data engineer is designing a data pipeline that ingests personally identifiable information (PII) into Amazon Redshift. The engineer needs to ensure that only authorized users can view the data, and that all queries are logged for auditing. Which combination of AWS services should the engineer use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS CloudTrail and Amazon CloudWatch Logs. AWS CloudTrail and Amazon CloudWatch Logs. CloudTrail logs API calls to Redshift for auditing administrative actions, while Amazon Redshift can be configured to send audit logs (including SQL queries) to Amazon CloudWatch Logs. This combination ensures both API activity and data access are logged. Option A is incorrect because Amazon Redshift audit logging is not a separate service; audit logs can be sent to CloudWatch Logs. Option B is incorrect because IAM Access Analyzer does not log queries. Option C is incorrect because S3 access logs only capture access to S3 objects, not Redshift queries.

Answer

AWS CloudTrail and Amazon Redshift audit logging

Answer

AWS IAM Access Analyzer and Amazon Redshift audit logging

Answer

Amazon S3 access logs and AWS CloudTrail

Question 2

A company uses AWS KMS to encrypt data in Amazon S3 and RDS. They need to ensure that encryption keys are automatically rotated every year. Which KMS key type supports automatic annual rotation?

Accepted Answer

AWS managed keys (aws/xxx). AWS managed keys (AWS-managed KMS keys) have automatic rotation enabled by default every year, making option B correct. AWS owned keys are not visible to the customer and cannot be managed. Customer managed keys require explicit enabling of rotation, so they are not automatically rotated. Custom key stores do not support automatic rotation. Therefore, only AWS managed keys provide automatic annual rotation without additional configuration.

Answer

AWS owned keys

Answer

Customer managed keys

Answer

Custom key stores

Question 3

A data engineer needs to ensure that data in transit between an Amazon RDS for PostgreSQL database and an application is encrypted. Which configuration should be used?

Accepted Answer

Enable SSL/TLS for the database connection. Enabling SSL/TLS for the database connection encrypts the data in transit between the application and the RDS PostgreSQL instance, ensuring confidentiality. Option A (VPC peering) provides network connectivity but does not encrypt traffic. Option C (encryption at rest) protects data stored on disk, not in transit. Option D (IAM database authentication) controls access but does not encrypt the connection.

Answer

Use VPC peering to connect the application to the database

Answer

Enable encryption at rest for the RDS instance

Answer

Use IAM database authentication

Question 4

A data engineer is setting up an Amazon EMR cluster to process sensitive data. The data is stored in S3 with SSE-S3. The company policy requires that data in transit between the EMR cluster and S3 be encrypted. Which configuration should be used?

Accepted Answer

Enable S3 encryption in transit using TLS. Enabling S3 encryption in transit using TLS encrypts data between the EMR cluster and S3. Amazon S3 supports HTTPS (TLS) endpoints by default, and this ensures that data is encrypted during transfer. Option B is wrong because disabling encryption is not allowed per policy. Option C is incorrect because EMRFS with SSE-KMS encrypts data at rest, not in transit. Option D is wrong because SSE-C is also an at-rest encryption mechanism, not for transit.

Answer

Disable encryption and use VPC endpoints

Answer

Configure EMRFS to use SSE-KMS

Answer

Use SSE-C for S3 objects

Question 5

A data engineer is troubleshooting an issue where an Amazon Redshift query returns an error: 'ERROR:  permission denied for relation table_name'. The user has been granted SELECT on the table. What is the most likely cause?

Accepted Answer

The user does not have USAGE permission on the schema.. In Amazon Redshift, to access a table, a user must have USAGE permission on the schema containing the table, in addition to SELECT or other table-level permissions. Without USAGE on the schema, the user receives a 'permission denied for relation' error even if SELECT is granted. Option D is correct. Option A (session timeout) would cause a different error or disconnection. Option B (no CONNECT permission) would prevent connecting to the database. Option C (wrong schema) would result in a 'schema not found' error, not a permission denied error.

Answer

The user's session has timed out.

Answer

The user does not have CONNECT permission on the database.

Answer

The table is in a different schema than expected.

Question 6

A company uses Amazon Redshift for data warehousing. The security team requires that all data in transit between the Redshift cluster and clients be encrypted. Which feature should be enabled?

Accepted Answer

SSL/TLS encryption. Amazon Redshift supports SSL/TLS encryption for client connections to ensure data in transit is encrypted. Option A (Client-side VPN) is not a Redshift feature for encrypting client connections. Option C (AWS KMS key) is used for encrypting data at rest, not in transit. Option D (VPC peering) does not provide encryption of data in transit between the cluster and clients.

Answer

Client-side VPN

Answer

AWS KMS key

Answer

VPC peering

Question 7

A data engineering team needs to encrypt data at rest in an Amazon S3 bucket that stores sensitive customer information. The team must use an AWS Key Management Service (AWS KMS) customer managed key with automatic rotation enabled. Which configuration meets these requirements?

Accepted Answer

Use default encryption with SSE-KMS and specify the customer managed key ID.. It enables SSE-KMS with a customer managed key that supports automatic key rotation, meeting the requirement for a customer managed key with automatic rotation. Option B is incorrect because SSE-S3 uses AWS managed keys that are not customer-controlled and do not support automatic rotation. Option C is incorrect because SSE-C requires the customer to provide and manage their own keys, and does not support automatic rotation. Option D is incorrect because leaving the key ID empty defaults to the AWS managed KMS key, which is not a customer managed key and does not support automatic rotation.

Answer

Use default encryption with SSE-S3.

Answer

Use default encryption with SSE-C and provide a customer-provided key.

Answer

Use default encryption with SSE-KMS and leave the key ID empty to use the AWS managed key.

Question 8

A company needs to transform JSON data from an Amazon S3 bucket into Parquet format and load it into an Amazon Redshift cluster. The transformation includes joining with a reference table stored in Amazon RDS. Which AWS service is BEST suited for this task?

Accepted Answer

AWS Glue ETL job. (AWS Glue ETL job) is the best choice because it natively integrates with S3, RDS, and Redshift. Glue can read JSON from S3, connect to RDS via JDBC to join with the reference table, transform the data to Parquet using its built-in converter, and write directly to Redshift. Option A (AWS Data Pipeline) is older and less integrated for this purpose. Option C (Amazon Athena) can query S3 and convert to Parquet but cannot natively join with RDS without additional services. Option D (Amazon EMR with Spark) is possible but requires more setup and maintenance.

Answer

AWS Data Pipeline

Answer

Amazon Athena

Answer

Amazon EMR with Spark

Question 9

A data engineer is tasked with ingesting on-premises database snapshots (full load) into Amazon S3 on a daily basis. The database is PostgreSQL and the snapshot size is 50 GB. The network link is 1 Gbps. Which approach is the MOST time-efficient and cost-effective?

Accepted Answer

Use AWS Database Migration Service (DMS) with S3 as target.. AWS Database Migration Service (DMS) is a managed service that efficiently performs full loads from on-premises PostgreSQL to Amazon S3, handling schema conversion and data transfer automatically. For a 50 GB snapshot over a 1 Gbps link, the transfer takes approximately 7 minutes, making Snowball (Option B) overkill and more expensive. Option C (AWS CLI) would require manual steps and is less efficient for database snapshots. Option D (Lambda + pg_dump) adds unnecessary complexity and potential performance issues. Therefore, DMS is the most time-efficient and cost-effective approach.

Answer

Use AWS Snowball Edge to transfer the snapshot.

Answer

Use AWS CLI to copy the snapshot file directly to S3.

Answer

Write a Lambda function to run pg_dump and upload to S3.

Question 10

Refer to the exhibit. A data engineer runs the AWS CLI command and gets the output shown. The engineer wants to grant a data analyst read-only access to the 'sales_db' database in AWS Glue Data Catalog using IAM. Which IAM policy statement is required?

Accepted Answer

{"Effect": "Allow", "Action": "glue:GetDatabase", "Resource": "arn:aws:glue:us-east-1:123456789012:database/sales_db"}. To grant read-only access to a database in AWS Glue Data Catalog, the required IAM action is glue:GetDatabase. Option B correctly specifies this action and targets the specific database resource. Option A uses glue:GetTable, which is for tables, not databases. Option C uses glue:GetDatabases, which is for listing databases and requires broader permissions. Option D uses s3:GetObject, which is for S3 data access, not Glue catalog operations.

Answer

{"Effect": "Allow", "Action": "glue:GetTable", "Resource": "arn:aws:glue:us-east-1:123456789012:table/sales_db/*"}

Answer

{"Effect": "Allow", "Action": "glue:GetDatabases", "Resource": "*"}

Answer

{"Effect": "Allow", "Action": "s3:GetObject", "Resource": "arn:aws:s3:::data-lake-sales/*"}

Question 11

A company uses AWS CloudTrail to log all API calls. The security team wants to ensure that log files are tamper-proof and cannot be deleted. Which TWO actions should the data engineer take? (Choose TWO.)

Accepted Answer

Enable CloudTrail log file validation. To ensure CloudTrail log files are tamper-proof and cannot be deleted, enable CloudTrail log file validation (option A) to verify integrity and detect tampering, and enable S3 Object Lock on the S3 bucket (option B) to prevent deletion or overwrites. Option C (MFA Delete) requires additional setup and is not automatically enforced by CloudTrail; it is not the primary mechanism for preventing deletion. Option D (S3 Versioning) alone does not prevent deletion; it preserves older versions but allows deletion of current versions. Option E (SSE-KMS) encrypts data but does not prevent deletion.

Answer

Enable MFA Delete on the S3 bucket

Answer

Enable S3 Versioning on the S3 bucket

Answer

Enable SSE-KMS encryption on the S3 bucket

Question 12

A data engineer is designing a system to handle sensitive customer data in Amazon RDS for PostgreSQL. The compliance team requires that the data be encrypted at rest and that encryption keys be rotated every 90 days. Which solution meets these requirements?

Accepted Answer

Enable RDS encryption with a customer managed KMS key, enable automatic key rotation, and manually rotate the key every 90 days. Amazon RDS for PostgreSQL encryption at rest uses AWS KMS with customer managed keys. Automatic key rotation in KMS rotates the key annually, but the requirement is every 90 days. Therefore, manual key rotation must be performed every 90 days in addition to enabling automatic key rotation. Option A is incorrect because AWS CloudHSM is not directly integrated with RDS for encryption at rest; RDS encryption uses KMS. Option C is incorrect because Transparent Data Encryption (TDE) is not supported for Amazon RDS PostgreSQL; RDS uses KMS for encryption. Option D is incorrect because KMS automatic key rotation alone rotates keys only once per year, not every 90 days as required.

Answer

Use AWS CloudHSM to store the encryption key and create a custom key rotation Lambda function

Answer

Enable Transparent Data Encryption (TDE) on the RDS instance

Answer

Enable RDS encryption with a customer managed KMS key and enable automatic key rotation

Question 13

A data engineer needs to set up a cross-account access for an S3 bucket so that users in Account B can read objects. The bucket in Account A has a bucket policy that grants access. What additional step is required?

Accepted Answer

Create an IAM role in Account B and attach a policy that allows s3:GetObject for the bucket.. Cross-account S3 access requires both a bucket policy in the source account (Account A) that grants permissions to the target account or role, and an IAM role in the target account (Account B) with a policy allowing the necessary actions (e.g., s3:GetObject). This ensures that users in Account B can assume the role and access the bucket. Option A (enabling ACLs) is unnecessary and not recommended; ACLs are legacy and can be disabled. Option C (disabling Block Public Access) is not required because the bucket policy is not public; it only grants cross-account access to a specific role. Option D (lifecycle policy) is for object lifecycle management and does not provide access control.

Answer

Enable S3 object ACLs on the bucket.

Answer

Disable S3 Block Public Access settings on the bucket.

Answer

Set up an S3 Lifecycle policy to replicate objects to Account B.

Question 14

A company is using AWS Lake Formation to manage permissions on a data lake. They want to grant a data scientist the ability to query tables in the 'analytics' database using Amazon Athena, but prevent them from accessing the underlying S3 data directly. What is the best way to achieve this?

Accepted Answer

Grant SELECT permission on the 'analytics' database tables in Lake Formation.. Lake Formation grants SELECT permission on named database tables, which allows querying via Athena without granting direct S3 access. Option A is incorrect because granting s3:GetObject on the entire bucket would allow the data scientist to bypass Lake Formation and access the data directly. Option C is incorrect because a policy that allows Athena queries only does not grant the necessary permissions to access the database tables. Option D is incorrect because adding the user to a data lake location with read access is too broad and would also grant direct S3 access, which does not meet the requirement of preventing direct S3 access.

Answer

Grant the data scientist an IAM policy with s3:GetObject on the S3 bucket.

Answer

Create an IAM policy that allows Athena queries only.

Answer

Add the data scientist to a Lake Formation data lake location with read access.

Question 15

A company stores PII in an S3 bucket. The security team wants to use Amazon Macie to discover sensitive data. After enabling Macie, they notice that no sensitive data findings are generated. The S3 bucket is in the same account. What is the most likely reason?

Accepted Answer

The S3 bucket is in a different AWS Region than the Macie session.. Macie only scans buckets in the same AWS Region as the Macie session. If the bucket is in a different region, Macie cannot discover sensitive data in it. Option A is incorrect because Macie uses service-linked roles, not the bucket policy, to access buckets in the same account. Option B is incorrect because Macie does not require cross-account access for buckets in the same account. Option D is incorrect because Macie can read objects regardless of ACLs as long as the appropriate IAM permissions are granted.

Answer

The bucket policy blocks access from Macie's service principal.

Answer

Macie is not configured with cross-account access to the bucket.

Answer

The S3 objects have private ACLs that prevent Macie from reading them.