DEA-C01 Practice Test 47 — 15 Questions

Question 1

A data engineer must give an AWS Glue ETL job temporary access to data in an Amazon S3 bucket without creating long-term IAM user access keys. The job runs on a schedule and must retrieve credentials automatically. Which mechanism should the engineer use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Attach an IAM role to the AWS Glue job and let the service assume it to obtain temporary credentials automatically.. AWS Glue jobs are associated with an IAM role that the service assumes to call other AWS services. The Glue runtime and AWS SDK automatically obtain temporary credentials from that role, so the job can read S3 data without any stored access keys. This satisfies the no-long-term-credentials requirement and follows AWS best practice for service-to-service authorization.

Answer

Store an IAM user's access key and secret key in AWS Secrets Manager and have the Glue job retrieve them at runtime.

Answer

Generate a pre-signed URL for each S3 object and pass the URLs as job parameters to the Glue script.

Answer

Create an IAM user with programmatic access and embed the access key in the Glue job script as a hard-coded variable.

Question 2

A data engineer manages an AWS Glue Data Catalog table that contains sensitive customer PII. The table's underlying data is in Amazon S3 and is queried by several AWS analytics services. The security team wants to implement column-level access control so that only authorized principals can view the PII columns, while other principals can still query non-sensitive columns. The solution must integrate with AWS Lake Formation and be enforced consistently across all query engines. Which approach should the data engineer take?

Accepted Answer

Register the S3 bucket as a Lake Formation data location, then grant column-level permissions on the table using Lake Formation.. Lake Formation column-level permissions are designed to provide fine-grained access control on tabular data in the Data Catalog. By registering the S3 location and granting column-level permissions, the data engineer can restrict access to sensitive columns while allowing queries on other columns. This enforcement is consistent across integrated analytics services.

Answer

Implement an S3 bucket policy that allows only certain prefixes and use separate buckets for PII and non-PII data.

Answer

Create an IAM policy that denies access to the PII columns and attach it to the roles used by the analytics services.

Answer

Use AWS Glue Data Catalog resource policies to restrict access to specific columns in the table.

Question 3

A data engineer manages an AWS Glue Data Catalog shared across teams. Analysts in one team must be able to query only the sales database and its tables, while another team owns the marketing database. The engineer wants permissions managed centrally in Lake Formation and wants the analysts to be able to create their own temporary tables but not alter the sales tables. Which combination of Lake Formation grants should the engineer apply?

Accepted Answer

Grant DESCRIBE and SELECT on the sales database and its tables to the analysts, and grant CREATE_TABLE on a separate scratch database for their temporary tables.. Least privilege in Lake Formation separates read permissions from modification and creation rights. DESCRIBE and SELECT on the sales database and tables allow discovery and querying, while withholding ALTER and DROP prevents changes to production tables. CREATE_TABLE on a dedicated scratch database lets analysts build temporary tables safely, keeping marketing data and the sales schema protected and centrally governed.

Answer

Grant ALL on the sales database to the analysts and rely on IAM policies to restrict which tables they can alter.

Answer

Grant SELECT on the sales tables and DESCRIBE on the sales database, and grant ALL on the marketing database to the analysts.

Answer

Grant DESCRIBE and SELECT on the sales database and tables, and grant ALTER on the sales database so analysts can create temporary tables there.

Question 4

A data engineer is using AWS Glue to process data stored in Amazon S3. The security team requires that all data in transit between AWS Glue and Amazon S3 be encrypted using TLS. The engineer has verified that the Glue job uses the AWS Glue Data Catalog and that the S3 bucket policy allows access. What should the engineer do to ensure that the Glue job enforces TLS when reading from and writing to S3?

Accepted Answer

Attach an IAM policy to the Glue job role that denies requests where the aws:SecureTransport condition is false.. To enforce TLS for AWS Glue access to S3, an IAM policy denying requests when aws:SecureTransport is false is the most direct method. This condition key evaluates to true for HTTPS requests and false for HTTP. By denying when false, all non-TLS requests are blocked. This applies to any principal using the role, including AWS Glue, ensuring encryption in transit.

Answer

Configure the Glue job to use the --enable-tls parameter.

Answer

Enable S3 default encryption on the bucket to enforce TLS.

Answer

Use an S3 VPC endpoint with a policy that allows only TLS connections.

Question 5

A data engineer is configuring an AWS Glue ETL job that reads from and writes to an Amazon S3 bucket. The security team requires that all data in transit between AWS Glue and Amazon S3 be encrypted using TLS, and that the job must fail if TLS is not used. Which two actions should the data engineer take to meet these requirements? (Choose two.)

Accepted Answer

Attach a bucket policy that denies s3:GetObject requests where aws:SecureTransport is false.. To enforce TLS for all data in transit between AWS Glue and Amazon S3, you must deny both read and write requests that do not use TLS. Bucket policies that deny s3:GetObject and s3:PutObject when aws:SecureTransport is false accomplish this. Default encryption, VPC endpoint policies, and Transfer Acceleration do not universally enforce TLS for all Glue-to-S3 traffic or cause the job to fail on insecure connections.

Answer

Enable default encryption on the S3 bucket using SSE-S3.

Answer

Configure the Glue job to use a VPC endpoint for Amazon S3 and set the endpoint policy to require TLS.

Answer

Enable S3 Transfer Acceleration on the bucket.

Question 6

A company needs to protect sensitive data stored in Amazon S3 from unauthorized access. Which TWO actions should the data engineer take? (Choose two.)

Accepted Answer

Configure S3 bucket policies to require MFA for delete operations. Option A is correct because an S3 bucket policy can include a condition such as aws:MultiFactorAuthPresent to deny s3:DeleteObject or s3:DeleteBucket unless the request is authenticated with MFA, adding a strong control against unauthorized or accidental deletion of sensitive data. Option D is correct because enabling S3 Block Public Access at the account level applies the four block-public-access settings to every bucket in the account, preventing bucket policies or ACLs from exposing objects publicly and thus blocking a major unauthorized-access vector. Option B is not correct because cross-region replication is a durability/availability and compliance feature that copies objects to another region; it does not by itself prevent unauthorized access. Option C is not correct because a Lifecycle policy transitioning objects to Glacier is a cost/storage-class management action, not an access-control mechanism. Option E is not correct because S3 Versioning preserves prior object versions for recovery but does not restrict who can read or access the data.

Answer

Enable cross-region replication for all buckets

Answer

Set up an S3 Lifecycle policy to transition objects to Glacier

Answer

Enable S3 Versioning on all buckets

Question 7

A data engineering team is designing a data lake on Amazon S3. They need to store raw data in its original format and transformed data in Parquet. The data is accessed by multiple analytics services, including Amazon Athena and Amazon Redshift Spectrum. Compliance requirements mandate that all data be encrypted at rest with AWS KMS and that the encryption keys be rotated every 90 days. Which S3 bucket configuration meets these requirements?

Accepted Answer

Use SSE-KMS with a customer-managed KMS key that has automatic key rotation enabled.. SSE-KMS with a customer-managed KMS key allows you to implement custom key rotation, such as every 90 days, by creating new keys and updating the bucket policy or key alias. AWS KMS automatic key rotation for customer-managed keys occurs yearly, not every 90 days, but you can achieve a 90-day rotation schedule manually or through automation (e.g., AWS Lambda). SSE-C requires manual key management and does not integrate with AWS services like Amazon Athena. SSE-S3 does not support configurable rotation, and the default encryption option (C) does not meet compliance if rotation is required.

Answer

Use SSE-C with client-managed keys and rotate them manually.

Answer

Use a bucket policy to enforce encryption and rely on default S3 encryption.

Answer

Use SSE-S3 with default encryption enabled.

Question 8

A data engineer is using AWS Lake Formation to manage permissions on a data lake in Amazon S3. The engineer grants SELECT permission on a table to an IAM role used by an Amazon Athena user. However, the user reports that queries against the table return an 'Access Denied' error. The engineer verifies that the IAM role has the necessary S3 permissions and that Lake Formation permissions are correctly set. What is the most likely cause of the error?

Accepted Answer

The IAM role lacks the lakeformation:GetDataAccess permission.. When Lake Formation manages access, IAM principals need the lakeformation:GetDataAccess permission to obtain temporary credentials for data access. Without it, Athena cannot read data even if table permissions are granted. This permission is often overlooked because it is not part of standard S3 or Glue permissions.

Answer

The Athena workgroup has a query result location that the IAM role cannot access.

Answer

The AWS Glue Data Catalog is not integrated with Lake Formation.

Answer

The S3 bucket policy does not allow access from the Athena service.

Question 9

A data engineer is configuring an AWS Glue ETL job that reads from an Amazon S3 bucket encrypted with SSE-KMS and writes to another S3 bucket also encrypted with SSE-KMS. The job uses an IAM role. The security team requires that the job have only the minimum necessary permissions to decrypt and encrypt data. Which TWO actions should be included in the IAM policy attached to the Glue job role? (Choose two.)

Accepted Answer

kms:GenerateDataKey on the KMS key used by the destination S3 bucket.. To read SSE-KMS encrypted objects from the source bucket, the Glue job role needs kms:Decrypt on the source key. To write SSE-KMS encrypted objects to the destination bucket, S3 requires the job role to have kms:GenerateDataKey on the destination key. These two permissions are the minimum required for the job to function while adhering to least privilege.

Answer

kms:ReEncryptFrom on the KMS key used by the destination S3 bucket.

Answer

kms:Encrypt on the KMS key used by the source S3 bucket.

Answer

kms:CreateGrant on both KMS keys to allow S3 to use the keys.

Question 10

A data engineer is designing a data ingestion pipeline for real-time clickstream data. Which TWO services can be used to ingest the data into Amazon Kinesis Data Streams?

Accepted Answer

Kinesis Producer Library (KPL). Options B and D are correct. The Kinesis Producer Library (KPL) is a library for producers to send data to Kinesis Data Streams. AWS SDK can also be used directly. Option A is wrong because Amazon S3 is a storage service, not a producer. Option C is wrong because Kinesis Data Firehose is a downstream consumer or delivery service, not a producer. Option E is wrong because AWS Glue is an ETL service, not a producer.

Answer

Amazon S3

Answer

Kinesis Data Firehose

Answer

AWS Glue

Question 11

A data engineer needs to grant an IAM role used by an AWS Lambda function permission to read encrypted data from an Amazon S3 bucket. The data is encrypted with a customer-managed AWS KMS key. The engineer wants to follow the principle of least privilege. Which combination of actions should the engineer include in the IAM policy for the Lambda execution role?

Accepted Answer

s3:GetObject on the bucket and kms:Decrypt on the KMS key.. The Lambda function requires s3:GetObject to retrieve the object and kms:Decrypt to decrypt the data key used by S3 server-side encryption with KMS. These permissions are the minimal set needed to read the encrypted object. Other KMS actions like Encrypt, GenerateDataKey, or CreateGrant do not provide decryption capability and would not allow the function to read the data.

Answer

s3:GetObject on the bucket and kms:GenerateDataKey on the KMS key.

Answer

s3:GetObject on the bucket and kms:CreateGrant on the KMS key.

Answer

s3:GetObject on the bucket and kms:Encrypt on the KMS key.

Question 12

A retail company uses Amazon Redshift for its data warehouse. The security team requires that all data in the cluster be encrypted at rest using a hardware security module (HSM) to manage the encryption keys. The data engineer needs to configure the Redshift cluster accordingly. Which action should the data engineer take?

Accepted Answer

Configure the Redshift cluster to use an HSM for encryption at rest by specifying the HSM connection details and enabling encryption when creating the cluster.. Amazon Redshift supports encryption at rest using an HSM. When creating a cluster, you can choose HSM encryption and provide the HSM connection details. This allows the cluster to use keys stored in a hardware security module, satisfying the security team's requirement. Other options either use KMS or do not encrypt the cluster itself.

Answer

Use Redshift Spectrum to query data in Amazon S3 that is encrypted with an HSM, and enable encryption for the Redshift cluster with AWS KMS.

Answer

Enable Redshift encryption at rest with an AWS owned key and use AWS CloudHSM to store the key.

Answer

Enable Redshift encryption at rest using AWS KMS with a customer managed key, and configure the cluster to use an HSM for key storage.

Question 13

A company uses AWS Glue to process data stored in Amazon S3. The security team mandates that all data in transit between AWS Glue and Amazon S3 must be encrypted with TLS. The Glue job connects to S3 using the AWS SDK. Which configuration should the data engineer implement to enforce TLS encryption for the Glue job's S3 connections?

Accepted Answer

Attach an S3 bucket policy that denies requests where aws:SecureTransport is false.. To enforce TLS for all connections to an S3 bucket, including from AWS Glue, an S3 bucket policy that denies requests when aws:SecureTransport is false is the correct approach. This condition evaluates the transport protocol and blocks non-TLS requests. It is a best practice recommended by AWS for ensuring data in transit encryption.

Answer

Configure the Glue job to use a VPC endpoint for S3 and enable AWS PrivateLink.

Answer

Set the Glue job parameter --encryption-mode to TLS.

Answer

Enable default encryption on the S3 bucket with SSE-KMS.

Question 14

A data engineer manages an Amazon Redshift cluster that contains a table with credit card numbers. The security team requires that the credit card column be stored in encrypted form and that only users with a specific IAM role can see the full values. Other users should see a partially masked value when they query the table. Which Redshift feature should the data engineer use?

Accepted Answer

Redshift dynamic data masking with a masking policy attached to the credit card column.. Redshift dynamic data masking attaches a masking policy to a column and evaluates the querying user's role at query time. Authorized roles see the original value, while others see a masked form such as the last four digits. Column-level encryption, Spectrum, and row-level security address different concerns and cannot produce role-based partial masking of a column value.

Answer

Redshift row-level security with a policy that filters rows containing credit card numbers.

Answer

Redshift column-level encryption with a customer managed key in AWS KMS.

Answer

Redshift Spectrum with an external table that uses a SerDe to mask the credit card column.

Question 15

A company stores application logs in Amazon S3 and wants to analyze them using Amazon Athena. The logs are in JSON format and are compressed with gzip. The data engineer needs to create an Athena table that can query these logs efficiently. The logs are stored in an S3 bucket with the prefix logs/year=2023/month=10/day=15/. The engineer wants to minimize query costs and improve performance. Which action should the engineer take?

Accepted Answer

Create an external table with the JSON SerDe, specifying the S3 location as s3://bucket/logs/ and defining partitions for year, month, and day.. To query JSON logs efficiently in Athena, the table must use the JSON SerDe to parse the data correctly. Defining partitions on year, month, and day allows Athena to prune partitions based on query filters, reducing the amount of data scanned and lowering costs. The table location should point to the root prefix so that all partitions are included. This combination provides accurate parsing and cost-effective queries.

Answer

Create an external table with the JSON SerDe, specifying the S3 location as s3://bucket/logs/ and using the OpenCSVSerDe for better performance.

Answer

Create an external table with the CSV SerDe, specifying the S3 location as s3://bucket/logs/ and defining partitions for year, month, and day.

Answer

Create an external table with the JSON SerDe, specifying the S3 location as s3://bucket/logs/year=2023/month=10/day=15/ and no partitions.