DEA-C01 Practice Test 44 — 15 Questions

Question 1

Refer to the exhibit. An IAM policy allows kms:Decrypt and kms:GenerateDataKey on a specific KMS key. A data engineer is unable to upload an object to an S3 bucket that uses SSE-KMS with that key. What is the MOST likely missing permission?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

s3:PutObject permission on the bucket.. The user is unable to upload an object to an S3 bucket that uses SSE-KMS. The IAM policy currently allows kms:Decrypt and kms:GenerateDataKey on the KMS key. However, to upload an object to an S3 bucket, the user also needs the s3:PutObject permission on the bucket. Therefore, the missing permission is s3:PutObject. Option A is incorrect because kms:Decrypt is already allowed. Option C is incorrect because kms:Encrypt is not required; GenerateDataKey is sufficient. Option D is incorrect because kms:CreateGrant is not required for uploading.

Answer

kms:Decrypt permission on the key.

Answer

kms:Encrypt permission on the key.

Answer

kms:CreateGrant permission on the key.

Question 2

A company needs to ensure that data stored in Amazon RDS is encrypted at rest. Which action should the data engineer take?

Accepted Answer

Create a new RDS instance with encryption enabled using AWS KMS.. Amazon RDS encryption at rest must be enabled when the DB instance is created, using AWS KMS. It cannot be added later. Option A is incorrect because encryption cannot be enabled on an existing RDS instance; you must create a new one with encryption enabled. Option B is incorrect because encrypting the underlying EBS volumes does not encrypt the RDS database; RDS encryption at rest is separate and must be configured at the instance level. Option D is incorrect because SSL/TLS secures data in transit, not at rest.

Answer

Enable encryption at rest by modifying the existing RDS instance.

Answer

Encrypt the underlying EBS volumes using AWS KMS.

Answer

Enable SSL/TLS for connections to the RDS instance.

Question 3

A company needs to enforce encryption in transit for all data moving between its Amazon S3 bucket and a fleet of Amazon EC2 instances. The data is accessed via S3 API calls over the internet. Which configuration ensures encryption in transit?

Accepted Answer

Configure the bucket policy to deny requests that do not use HTTPS.. Configuring the bucket policy to deny requests that do not use HTTPS ensures encryption in transit for S3 API calls. Option A is wrong because SSE-S3 encrypts data at rest, not in transit. Option B is wrong because S3 Transfer Acceleration uses a global network but does not enforce encryption; HTTPS must still be used. Option C is wrong because a VPC endpoint for S3 uses AWS network but does not enforce encryption; the bucket policy must explicitly require HTTPS.

Answer

Enable SSE-S3 on the bucket.

Answer

Enable S3 Transfer Acceleration.

Answer

Use a VPC endpoint for S3.

Question 4

A data engineer needs to grant an IAM user read-only access to an S3 bucket named 'data-lake'. Which IAM policy statement should be used?

Accepted Answer

{"Effect":"Allow","Action":["s3:ListBucket","s3:GetObject"],"Resource":["arn:aws:s3:::data-lake","arn:aws:s3:::data-lake/*"]}. It allows ListBucket on the bucket and GetObject on objects, enabling read-only access. Option A is wrong because it grants write actions (PutObject, DeleteObject). Option B is wrong because it allows all S3 actions (s3:*). Option D is wrong because it only allows ListBucket, not GetObject.

Answer

{"Effect":"Allow","Action":["s3:PutObject","s3:DeleteObject"],"Resource":"arn:aws:s3:::data-lake/*"}

Answer

{"Effect":"Allow","Action":"s3:*","Resource":"*"}

Answer

{"Effect":"Allow","Action":"s3:ListBucket","Resource":"arn:aws:s3:::data-lake"}

Question 5

A data engineer receives an alert that an AWS KMS key has been scheduled for deletion by mistake. What is the immediate action to prevent the key from being deleted?

Accepted Answer

Cancel the key deletion from the KMS console or API.. When a KMS key is scheduled for deletion, the deletion can be canceled from the AWS KMS console or via the CancelKeyDeletion API during the pending deletion period. This immediate action restores the key to its previous state and prevents it from being deleted. Option B is incorrect because creating a new key does not cancel the deletion of the existing key. Option C is incorrect because deleted KMS keys cannot be restored; the default waiting period of 7–30 days exists specifically to allow cancellation. Option D is incorrect because disabling the key does not affect the deletion schedule.

Answer

Create a new KMS key and re-encrypt the data.

Answer

Wait for the key to be deleted and restore it from backup.

Answer

Disable the key immediately to stop usage.

Question 6

Refer to the exhibit. A data engineer runs the AWS CLI command shown to encrypt a file using AWS KMS. The command succeeds. Later, the engineer tries to decrypt the file using the same key but without providing an encryption context. The decryption fails. What is the most likely reason?

Accepted Answer

The encryption context must be provided during decryption.. When encrypting data with AWS KMS, an encryption context can be provided as additional authenticated data (AAD). This context must be supplied during decryption; otherwise, decryption fails. The command succeeded during encryption, so the key is not disabled (B is wrong) and the key policy is not the issue (A is wrong). File corruption would cause a different error (C is wrong).

Answer

The KMS key policy does not allow decryption.

Answer

The KMS key has been disabled.

Answer

The plaintext file was corrupted.

Question 7

A data engineering team uses AWS Glue ETL jobs to process data from an S3 data lake and load it into an Amazon Redshift cluster. The security policy mandates that all data in transit between AWS Glue and Redshift must be encrypted using TLS. The team uses a JDBC connection. Currently, the connection is failing with an SSL-related error. Which configuration change should the team make to ensure encrypted connectivity?

Accepted Answer

Update the JDBC connection string to include ssl=true and sslmode=require.. To enforce TLS encryption for JDBC connections to Amazon Redshift, the connection string must include ssl=true and often sslmode=require. This is a client-side configuration that tells the JDBC driver to use SSL. Option A is incorrect because security groups control network access, not encryption. Option C is incorrect because server-side encryption on S3 secures data at rest, not data in transit. Option D is incorrect because setting require_ssl=ON in the cluster parameter group enforces SSL on the server side, but the client (Glue) must still specify ssl=true in the JDBC URL to establish an encrypted connection. Therefore, the correct change is option B.

Answer

Modify the Redshift security group to allow inbound traffic on port 5439 from the Glue subnet.

Answer

Enable server-side encryption on the S3 bucket using AWS KMS.

Answer

Set the Redshift cluster parameter group to require_ssl=ON.

Question 8

A data engineer needs to audit all access to an S3 bucket containing sensitive data. The engineer must capture who accessed the bucket, from which IP address, and what actions were performed. Which AWS services should be used together to meet this requirement? (Choose THREE.)

Accepted Answer

Amazon CloudWatch Logs. Amazon CloudWatch Logs (A) can ingest and analyze log data from various sources. Amazon S3 server access logs (C) provide detailed records of requests made to the S3 bucket, including the requester, IP address, and actions. AWS CloudTrail (D) records API calls with identity and source IP, enabling auditing of who accessed the bucket. AWS Config (B) tracks resource configuration changes, not access logs. VPC Flow Logs (E) capture network traffic, not S3 API details.

Answer

AWS Config

Answer

VPC Flow Logs

Question 9

A healthcare company stores patient records in an S3 bucket encrypted with SSE-S3. The data engineering team uses AWS Glue ETL jobs to process this data and load it into an Amazon Redshift cluster for analytics. Recently, the security team mandated that all sensitive data must be encrypted at rest using customer-managed keys (CMK) in AWS KMS, and that the keys must be rotated automatically every year. The team updated the S3 bucket to use SSE-KMS with a CMK and enabled automatic key rotation. However, after the change, the Glue ETL jobs that read from the S3 bucket started failing with 'Access Denied' errors. The Glue job uses an IAM role named 'GlueETLRole' that has the following permissions: s3:GetObject on the bucket, kms:Decrypt and kms:GenerateDataKey on the CMK, and all necessary Glue permissions. The Redshift cluster is also encrypted with a different CMK, and the Glue role has kms:Decrypt on that key as well. What is the most likely cause of the failure?

Accepted Answer

The KMS key policy for the CMK used for S3 encryption does not grant 'GlueETLRole' permission to use the key.. The issue is that while the IAM role 'GlueETLRole' has the necessary KMS permissions (kms:Decrypt and kms:GenerateDataKey) via IAM policies, the key policy for the CMK used for S3 encryption must also explicitly grant the role (or the principal) permission to use the key. Without this key policy grant, the role's IAM permissions are insufficient, resulting in 'Access Denied' errors. Option A correctly identifies this as the most likely cause.

Answer

The IAM role 'GlueETLRole' does not have kms:Decrypt permission on the CMK used for S3 encryption.

Answer

The Glue job requires kms:Encrypt permission to read encrypted data from S3.

Answer

The S3 VPC endpoint policy does not allow the Glue job to access the KMS key.

Question 10

A data engineer is troubleshooting an ETL job that reads from an S3 bucket encrypted with SSE-KMS. The job is failing with an error indicating that the IAM role does not have permission to decrypt the data. What is the most likely missing permission?

Accepted Answer

kms:Decrypt. Kms:Decrypt. When an S3 object is encrypted with SSE-KMS, the IAM role must have the kms:Decrypt permission to decrypt the object before reading it. Option A (kms:GenerateDataKey) is used for encryption, not decryption, so it is incorrect. Option B (s3:ListBucket) only allows listing objects in the bucket, not reading or decrypting them. Option D (s3:GetObject) allows reading the object, but without kms:Decrypt, the encrypted object cannot be decrypted, so the read fails.

Answer

kms:GenerateDataKey

Answer

s3:ListBucket

Answer

s3:GetObject

Question 11

A data engineer is designing a data lake on Amazon S3. The compliance team requires that objects be automatically deleted after 7 years. Additionally, objects must be transitioned to Amazon S3 Glacier Instant Retrieval after 30 days to reduce costs. Which S3 lifecycle policy configuration meets these requirements?

Accepted Answer

Transition to Glacier Instant Retrieval after 30 days, then expire after 2555 days.. It transitions objects to S3 Glacier Instant Retrieval after 30 days and then expires (permanently deletes) them after 2555 days, which is approximately 7 years (365 * 7 = 2555). This meets both the cost-saving and deletion requirements. Option A is incorrect because it expires after 90 days, not 7 years. Option C is incorrect because it uses Glacier Deep Archive instead of Glacier Instant Retrieval. Option D is incorrect because it uses S3 Standard-IA instead of Glacier Instant Retrieval.

Answer

Transition to Glacier Instant Retrieval after 30 days, then expire after 90 days.

Answer

Transition to Glacier Deep Archive after 30 days, then expire after 7 years.

Answer

Transition to S3 Standard-IA after 30 days, then expire after 7 years.

Question 12

A company is designing a data pipeline using Amazon Kinesis Data Streams. The data includes personally identifiable information (PII). The security team requires that data be encrypted at rest using a customer-managed KMS key. How should the data engineer configure the Kinesis stream?

Accepted Answer

Enable server-side encryption on the Kinesis stream and specify the customer-managed KMS key.. Kinesis Data Streams supports server-side encryption (SSE) using AWS KMS. By enabling SSE and specifying a customer-managed KMS key, the data is encrypted at rest. Option A is incorrect because CloudHSM is not used for Kinesis encryption. Option C is incorrect because storing encrypted data in S3 and streaming keys is not a direct encryption method for the Kinesis stream. Option D is incorrect because client-side encryption is an alternative, but the question specifically requires encryption at rest using a customer-managed KMS key, which is achieved via server-side encryption on the stream itself.

Answer

Configure the Kinesis stream to use AWS CloudHSM for encryption.

Answer

Store the encrypted data in S3 and use Kinesis to stream the S3 object keys.

Answer

Use client-side encryption in the producer application to encrypt data before sending to Kinesis.

Question 13

A company wants to ensure that only encrypted connections are used when data is transferred to S3. Which policy condition should be used in an S3 bucket policy?

Accepted Answer

Condition: { Bool: { aws:SecureTransport: false } }. The condition `aws:SecureTransport: false` is used to deny requests that are not sent over SSL/TLS, ensuring encrypted connections for data transfer to S3. Option A (`s3:x-amz-server-side-encryption`) controls encryption at rest, not in transit. Option B (`s3:signatureversion`) checks the signature version used for request authentication, not encryption. Option C (`aws:SourceIp`) filters by source IP address, which is unrelated to encryption.

Answer

Condition: { Null: { s3:x-amz-server-side-encryption: true } }

Answer

Condition: { StringEquals: { s3:signatureversion: ["AWS4-HMAC-SHA256"] } }

Answer

Condition: { StringNotEquals: { aws:SourceIp: ["0.0.0.0/0"] } }

Question 14

A data engineer attempts to suspend versioning on an S3 bucket but receives the error shown. The engineer needs to suspend versioning to reduce storage costs. What should the engineer do FIRST?

Accepted Answer

Disable MFA Delete by using the AWS CLI with the --mfa parameter and then suspend versioning.. To suspend versioning on an S3 bucket with MFA Delete enabled, you must first disable MFA Delete using the root account (or an account with appropriate permissions). The AWS CLI with the --mfa parameter is used to authenticate with MFA when performing sensitive operations, but disabling MFA Delete requires the root account. After disabling MFA Delete, versioning can be suspended. Option B is incorrect because the AWS Management Console does not bypass MFA Delete; you still need to disable MFA Delete first. Option C is incorrect because deleting and recreating the bucket is unnecessarily disruptive and versioning can be suspended directly after disabling MFA Delete. Option D is incorrect because the error is due to MFA Delete being enabled, not a bucket policy issue.

Answer

Use the AWS Management Console to suspend versioning, as it bypasses MFA Delete.

Answer

Delete the bucket and recreate it without versioning.

Answer

Add a bucket policy to allow versioning suspension.

Question 15

A company uses AWS DMS to migrate data from an on-premises Oracle database to Amazon Aurora MySQL. The migration is successful, but the ongoing replication task is experiencing high latency. Which configuration change is most likely to reduce latency?

Accepted Answer

Increase the size of the DMS replication instance.. Increasing the size of the DMS replication instance provides more CPU and memory, which can process and apply changes faster, thereby reducing latency in ongoing replication. Option B is incorrect because decreasing the batch size and batch apply timeout would likely increase latency by reducing the efficiency of batch writes. Option C is incorrect because changing the target endpoint to Amazon S3 is not relevant; the target is Aurora MySQL, and migrating to S3 would not resolve latency issues for the current setup. Option D is incorrect because enabling CDC from binary logs is not applicable; the source is Oracle, which uses redo logs, not binary logs. Additionally, CDC is already used in ongoing replication from Oracle.

Answer

Decrease the task's batch size and batch apply timeout.

Answer

Change the target endpoint to Amazon S3.

Answer

Enable Change Data Capture (CDC) from binary logs.