DEA-C01 Mock Exam 73 — 25 Questions

Question 1

A data engineer needs to ensure that all data in an S3 bucket is encrypted at rest. The bucket currently contains unencrypted objects from past uploads. Which action will encrypt these existing objects without re-uploading them?

Accepted Answer

Use S3 Batch Operations with an encryption job. Option A is correct because S3 Batch Operations can apply SSE-S3 or SSE-KMS to existing objects. Option B is wrong because default encryption only applies to new objects. Option C is wrong because bucket policies do not retroactively encrypt. Option D is wrong because S3 console does not batch-encrypt existing objects.

Answer

Attach a bucket policy requiring SSE-S3

Answer

Enable default encryption on the bucket

Answer

Use the S3 console to select all objects and apply encryption

Question 2

A company uses AWS KMS to encrypt data in Amazon Redshift. The data engineer needs to rotate the customer-managed KMS key annually. Which TWO actions must be taken to successfully rotate the key without data loss?

Accepted Answer

Create a new KMS key and update the Redshift cluster to use the new key. Option A is correct because the Redshift cluster must be configured to use the new key. Option C is correct because the old key must remain enabled to decrypt existing data. Option B is wrong because automatic rotation is optional. Option D is wrong because CloudTrail logs rotation but is not required. Option E is wrong because Redshift does not use S3 for key storage.

Answer

Use AWS CloudTrail to verify the key rotation was successful

Answer

Store the new key in Amazon S3 for backup

Answer

Enable automatic KMS key rotation on the existing key

Question 3

An organization is using AWS Glue to process sensitive data. The data is stored in S3 with server-side encryption using AWS KMS (SSE-KMS). The Glue job fails with an error indicating that it cannot read the data. The IAM role used by Glue has the following policy. What is missing?

Accepted Answer

The kms:Decrypt permission on the KMS key. Option B is correct because the Glue job needs kms:Decrypt permission to read data encrypted with SSE-KMS. Option A is wrong because s3:GetObject is present. Option C is wrong because kms:GenerateDataKey is for writing, not reading. Option D is wrong because kms:ReEncrypt is not needed.

Answer

The s3:GetObject permission on the bucket

Answer

The kms:GenerateDataKey permission on the KMS key

Answer

The kms:ReEncrypt permission on the KMS key

Question 4

A data engineer needs to ensure that an S3 bucket is encrypted at rest using AWS KMS. The bucket policy must allow only a specific IAM role to access the bucket and enforce encryption in transit. Which combination of bucket policy statements should be used?

Accepted Answer

Use kms:ViaService: s3.*.amazonaws.com and aws:SecureTransport: true. Option C is correct because it uses the kms:EncryptionContext condition to enforce KMS encryption and aws:SecureTransport for TLS. Option A is wrong because it requires SSE-S3, not KMS. Option B is wrong because it allows any KMS key. Option D is wrong because it allows access without encryption in transit.

Answer

Use s3:x-amz-server-side-encryption: AES256 and aws:SecureTransport: true

Answer

Use s3:x-amz-server-side-encryption-aws-kms-key-id and aws:SourceIp

Answer

Use kms:EncryptionContext: service:s3 and aws:SecureTransport: true

Question 5

A company needs to implement a data encryption strategy for data in transit between an Amazon EC2 instance and an Amazon RDS for MySQL database. Which THREE actions should be taken?

Accepted Answer

Configure the RDS instance to require SSL connections. Options A, B, and D are correct. Enforcing SSL/TLS, enabling SSL parameter, and using a JDBC driver with SSL property ensure encryption in transit. Option C is wrong because encryption at rest is separate. Option E is wrong because VPC peering doesn't encrypt data.

Answer

Set up VPC peering between the EC2 and RDS subnets

Answer

Enable encryption at rest using KMS on the RDS instance

Question 6

A company has a requirement to store audit logs for 7 years for compliance. The logs are stored in S3 and must be immutable. Which S3 feature should be used?

Accepted Answer

Enable S3 Object Lock in compliance mode. S3 Object Lock prevents objects from being deleted or overwritten for a specified retention period. Option A is wrong because versioning does not prevent deletion. Option B is wrong because MFA Delete adds an extra step but can be bypassed by root. Option C is wrong because bucket policies do not enforce immutability. Option D is correct.

Answer

Use a bucket policy that denies s3:DeleteObject

Answer

Enable MFA Delete on the bucket

Answer

Enable S3 Versioning and set a lifecycle policy

Question 7

A company wants to encrypt data at rest in Amazon S3 using server-side encryption. They need to manage the encryption keys themselves and rotate them annually. Which S3 encryption option should they use?

Accepted Answer

SSE-C. SSE-C allows the customer to provide and manage their own encryption keys. SSE-S3 uses AWS-managed keys, and SSE-KMS uses AWS KMS keys but with AWS managing the key material. Option A is wrong because SSE-S3 does not allow customer-managed keys. Option B is wrong because SSE-KMS still involves AWS management of the key material. Option D is wrong because client-side encryption is not server-side.

Answer

SSE-KMS

Answer

SSE-S3

Answer

Client-side encryption

Question 8

A company uses AWS KMS to encrypt data in multiple services. They want to ensure that only specific IAM roles can decrypt data using a particular KMS key. Which THREE steps are necessary?

Accepted Answer

Attach an IAM policy to each role with kms:Decrypt permission. The KMS key policy must grant decrypt permission to the IAM roles. Each role must have an IAM policy allowing kms:Decrypt. Additionally, the key policy should also grant kms:GenerateDataKey for encryption. Option D is wrong because the key policy does not need to enable IAM policies; by default, IAM policies are allowed unless the key policy denies them. Option E is wrong because key rotation is not required for access control.

Answer

Enable IAM policies in the key policy

Answer

Enable automatic key rotation

Question 9

A data engineer needs to ensure that data stored in Amazon S3 is automatically deleted after 30 days. Which S3 feature should be used?

Accepted Answer

S3 Lifecycle policy. Option C is correct because S3 Lifecycle policies can automatically transition objects to different storage classes or expire them after a specified time. Option A (versioning) keeps multiple versions of objects. Option B (object lock) prevents deletion. Option D (MFA delete) requires multi-factor authentication for deletion.

Answer

S3 MFA Delete

Answer

S3 Versioning

Answer

S3 Object Lock

Question 10

A company uses AWS KMS to encrypt data in Amazon S3. The security team requires that all encryption keys be rotated automatically every year. Which key type should the company use?

Accepted Answer

Use a customer managed key with manual rotation. AWS managed keys (AWS-managed KMS keys) are automatically rotated every year. Customer managed keys do not rotate automatically unless configured with a custom rotation period. The correct answer is C because AWS managed keys satisfy the requirement of automatic yearly rotation without additional configuration.

Answer

Use a customer managed key with automatic rotation enabled

Answer

Use the default S3 managed encryption key (SSE-S3)

Answer

Use an AWS managed key (aws/s3)

Question 11

A company uses AWS Glue to process sensitive customer data stored in S3. The data engineer must ensure that the Glue ETL jobs do not write any data to S3 buckets that lack encryption. Which approach meets this requirement?

Accepted Answer

Attach an S3 bucket policy that denies s3:PutObject unless the request includes the x-amz-server-side-encryption header. Option B is correct because an S3 bucket policy with a condition key `s3:x-amz-server-side-encryption` or `s3:x-amz-server-side-encryption-aws-kms-key-id` can deny PutObject if encryption is not specified. Option A is wrong because IAM policies cannot enforce encryption at the bucket level as effectively. Option C is wrong because CloudTrail is for auditing, not prevention. Option D is wrong because encryption at rest does not enforce encryption on writes.

Answer

Use AWS CloudTrail to monitor and alert on unencrypted writes

Answer

Enable S3 default encryption on the bucket

Answer

Configure an IAM role for Glue with a policy that denies s3:PutObject without encryption

Question 12

A data engineer is designing a data lake on Amazon S3 that must comply with GDPR. The engineer needs to ensure that individuals can request deletion of their personal data. Which THREE AWS services can be used together to automate the deletion of specific records?

Accepted Answer

AWS Lambda. Option B (S3 Select) can query specific records, Option C (Lambda) can process deletion, Option E (S3 Batch Operations) can delete objects. Option A (Glue) is for ETL, not for selective deletion. Option D (DynamoDB) is not for S3.

Answer

AWS Glue

Answer

Amazon DynamoDB

Question 13

A data engineer needs to audit all changes to IAM policies in an AWS account. Which AWS service should be used?

Accepted Answer

AWS CloudTrail. Option D is correct because AWS CloudTrail records API calls, including IAM policy changes. Option A is wrong because AWS Config tracks resource configuration changes, not API calls. Option B is wrong because CloudWatch Logs is for log storage. Option C is wrong because AWS Organizations manages multiple accounts.

Answer

AWS Config

Answer

AWS Organizations

Answer

Amazon CloudWatch Logs

Question 14

A company uses AWS Lake Formation to manage permissions on a data lake in S3. A data analyst reports that queries using Amazon Athena return zero rows for a table that the analyst has been granted SELECT permission on. The table is registered in Lake Formation and uses a partition projection. What is the most likely cause?

Accepted Answer

The analyst lacks GetObject and ListBucket permissions on the underlying S3 location. Option B is correct because partition projection requires explicit S3 permissions to list the partition location, which Lake Formation may not automatically grant. Option A is wrong because SELECT permission is granted. Option C is wrong because encryption settings don't cause zero rows. Option D is wrong because the table is registered.

Answer

The table is not registered as a resource in Lake Formation

Answer

The analyst does not have DESCRIBE permission on the table

Answer

The table uses server-side encryption with KMS and the analyst lacks kms:Decrypt permission

Question 15

A data engineer is designing a data lake on S3 with fine-grained access control using AWS Lake Formation. Which THREE permissions can be managed by Lake Formation?

Accepted Answer

SELECT on a table. Options A, B, and D are correct. Lake Formation manages SELECT, INSERT, and DESCRIBE permissions. Option C is wrong because DELETE is not supported for S3 data lakes? Actually Lake Formation supports DELETE on tables? For data lakes, DELETE is not typically managed. Option E is wrong because ALTER TABLE is not managed by Lake Formation.

Answer

ALTER TABLE on a table

Answer

DELETE on a table

Question 16

A data engineer needs to grant an IAM user read-only access to a specific KMS key for decrypting S3 objects. Which policy element should be used?

Accepted Answer

Add a statement to the KMS key policy allowing the IAM user to call kms:Decrypt. A KMS key policy can grant IAM users permissions directly. Option B is wrong because IAM policies can also grant KMS permissions, but the key policy must allow the IAM policy. Option C is wrong because SCPs are for Organizations. Option D is wrong because bucket policies do not grant KMS permissions. Option A is correct, though both A and B are possible; typically key policy is used for cross-account or specific grants.

Answer

Attach an IAM policy to the user allowing kms:Decrypt

Answer

Add a bucket policy that grants kms:Decrypt

Answer

Use an SCP in AWS Organizations to allow kms:Decrypt

Question 17

A data engineer needs to audit all access to an S3 bucket for compliance. They want to capture object-level operations such as GetObject and PutObject, as well as bucket-level operations like ListBucket. Which AWS service should be used?

Accepted Answer

S3 server access logs. S3 server access logs record object-level and bucket-level operations. CloudTrail can also record S3 API calls, but by default it logs bucket-level operations only; object-level logging requires enabling data events. Option A is wrong because CloudTrail management events do not include object-level operations. Option C is wrong because CloudWatch Logs alone does not capture S3 access. Option D is wrong because Config records resource configuration changes, not API calls.

Answer

Amazon CloudWatch Logs

Answer

AWS CloudTrail management events

Answer

AWS Config

Question 18

A data engineer needs to securely store database credentials for an RDS instance. Which TWO AWS services can be used?

Accepted Answer

AWS Secrets Manager. AWS Systems Manager Parameter Store can securely store secrets like database credentials. AWS Secrets Manager is designed specifically for secrets management and automatic rotation. Option C is wrong because CloudFormation is for infrastructure as code. Option D is wrong because KMS is a key management service, not a secret store (though it can encrypt secrets stored elsewhere). Option E is wrong because IAM is for identity management.

Answer

AWS KMS

Answer

AWS IAM

Answer

AWS CloudFormation

Question 19

A company is using AWS Lake Formation to manage access to a data lake in S3. They want to grant a data analyst access to specific columns in a table, but not to the entire table. Which Lake Formation feature should be used?

Accepted Answer

Column-level filtering. Option B is correct because Lake Formation column-level filtering allows granting access to specific columns. Option A (cell-level security) is for row-level security, not columns. Option C (tag-based access control) uses tags to control access, not column-level. Option D (IAM policies) are not column-specific.

Answer

Row-level security (cell-level filtering)

Answer

IAM policies on the S3 bucket

Answer

Tag-based access control (TBAC)

Question 20

A data engineer needs to restrict access to an Amazon S3 bucket so that only objects encrypted with a specific AWS KMS key can be uploaded. Which S3 bucket policy condition should be used?

Accepted Answer

s3:x-amz-server-side-encryption-aws-kms-key-id. The kms:EncryptionContext condition key is used to enforce encryption context, not the key itself. The s3:x-amz-server-side-encryption-aws-kms-key-id condition key is used to require a specific KMS key ID for server-side encryption. Option C is correct.

Answer

kms:ViaService

Answer

s3:x-amz-server-side-encryption

Answer

kms:EncryptionContext