DEA-C01 Mock Exam 75 — 25 Questions

Question 1

A company uses AWS Lake Formation to manage data lake permissions. A data engineer notices that a user can query tables in Athena even though the user does not have SELECT permission on the table in Lake Formation. What could be the cause?

Accepted Answer

The IAMAllowedPrincipals group has been granted Super permission on the database. By default, Lake Formation uses IAMAllowedPrincipals group which grants full access to IAM users and roles. If this group is present, Lake Formation permissions are bypassed. Option A is wrong because IAM policy granting Athena access is not sufficient without Lake Formation permissions. Option C is wrong because S3 permissions alone do not allow Athena queries. Option D is wrong because Lake Formation is a different service.

Answer

The user is using Redshift Spectrum

Answer

The user has S3 permissions to read the underlying data

Answer

The user has an IAM policy that allows Athena access

Question 2

A data engineer is configuring an S3 bucket for storing sensitive customer data. The bucket must be encrypted at rest using an AWS Key Management Service (KMS) key that is managed by the data engineering team. The team wants to ensure that only users with explicit permission can decrypt the data. Which S3 encryption option should be used?

Accepted Answer

SSE-KMS. Option B is correct because SSE-KMS uses a customer-managed KMS key, allowing the team to control access and permissions for decryption. Option A (SSE-S3) uses Amazon S3-managed keys, which does not provide customer-controlled access. Option C (SSE-C) requires the customer to manage the encryption keys themselves, not using KMS. Option D (client-side encryption) encrypts data before sending to S3, which is not an S3 server-side encryption option.

Answer

Client-side encryption

Answer

SSE-S3

Answer

SSE-C

Question 3

A company must encrypt all data at rest in their Amazon RDS for MySQL instance. Which THREE steps are required to achieve this? (Select THREE.)

Accepted Answer

Use an AWS KMS key to encrypt the instance. Options A, C, and D are correct. Option A (enable encryption at rest) is required. Option C (use KMS key) is needed to manage encryption keys. Option D (ensure backups are encrypted) is necessary because encrypted instances require encrypted backups. Option B (enable SSL) is for encryption in transit, not at rest. Option E (use parameter groups) does not enable encryption.

Answer

Enable SSL/TLS for database connections

Answer

Modify the DB parameter group to require encryption

Question 4

A company wants to ensure that all S3 buckets are encrypted using server-side encryption. Which AWS service can be used to automatically remediate non-compliant buckets?

Accepted Answer

AWS Config. AWS Config can use managed rules like s3-bucket-server-side-encryption-enabled to check compliance and trigger auto-remediation via SSM Automation or Lambda. Option B is correct.

Answer

AWS CloudTrail

Answer

Amazon Inspector

Answer

AWS Trusted Advisor

Question 5

A data engineer is troubleshooting an issue where an AWS Glue ETL job fails when trying to read data from an S3 bucket encrypted with SSE-KMS. The job has an IAM role that includes `kms:Decrypt` permission. What is the most likely reason for the failure?

Accepted Answer

The Glue job is not configured to use the KMS key for decryption. Option B is correct because Glue needs the KMS key to be specified in the job parameters or the connection. Option A is wrong because the Glue role likely has the permission. Option C is wrong because the bucket may be in the same region. Option D is wrong because the key must be specified explicitly.

Answer

The IAM role does not have s3:GetObject permission

Answer

The KMS key policy does not allow the Glue job to use the key

Answer

The S3 bucket is in a different AWS region than the Glue job

Question 6

A company is using AWS Lake Formation to manage access to data in a data lake stored in Amazon S3. A data engineer notices that users with SELECT permissions on a table can still query the underlying S3 data directly using Athena. What is the most likely cause?

Accepted Answer

The users are using a version of Athena that does not support Lake Formation. Option C is correct because Lake Formation integrates with Athena by default when using the Athena engine version 2 or later. Option A is wrong because Lake Formation can be used with Athena. Option B is wrong because the issue is about direct S3 access, not encryption. Option D is wrong because Lake Formation can work with S3 bucket policies.

Answer

The S3 bucket policy allows full access to all principals

Answer

The S3 bucket does not have server-side encryption enabled

Answer

Lake Formation does not support integration with Athena

Question 7

A data engineer is troubleshooting an Amazon Redshift cluster that is unable to access an S3 bucket for COPY operations. The cluster has an IAM role attached. Which of the following could be causing the failure? (Choose TWO.)

Accepted Answer

The S3 bucket policy denies access to the IAM role. Options B and D are correct. The IAM role must have permission to the S3 bucket, and the bucket policy must allow the role. Option A is wrong because VPC security groups control network traffic, not S3 access. Option C is wrong because encryption is not required for COPY. Option E is wrong because Redshift does not need KMS permissions unless using SSE-KMS.

Answer

The VPC security group does not allow outbound HTTPS traffic

Answer

The S3 bucket has default encryption enabled

Answer

The KMS key used for encryption is not shared with Redshift

Question 8

A data engineer is troubleshooting an Amazon Redshift cluster that is not responding to queries. The engineer suspects that the cluster may have been accidentally deleted. Which AWS service should be used to investigate the deletion?

Accepted Answer

AWS CloudTrail. Option A is correct because AWS CloudTrail records DeleteCluster API calls. Option B is wrong because CloudWatch Logs stores logs but not API calls. Option C is wrong because AWS Config records resource changes, not deletions? Actually Config would show a deletion, but CloudTrail is more direct for API calls. The best answer is CloudTrail. Option D is wrong because AWS Trusted Advisor is for best practices.

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Answer

AWS Trusted Advisor

Question 9

A data engineer is designing a data lake on S3 and needs to ensure that data is encrypted at rest using customer-managed KMS keys. The engineer also needs to audit all access to the KMS keys. Which combination of services should be used?

Accepted Answer

SSE-KMS with AWS CloudTrail. S3 server-side encryption with KMS (SSE-KMS) uses customer-managed KMS keys. CloudTrail logs all KMS API calls, including Decrypt and GenerateDataKey. Option A is wrong because SSE-S3 uses AWS-managed keys, not customer-managed. Option B is wrong because S3 Inventory does not audit KMS access. Option D is wrong because S3 access logs do not capture KMS operations. Option C is correct.

Answer

SSE-C with CloudWatch Logs

Answer

SSE-KMS with S3 Inventory

Answer

SSE-S3 with S3 server access logs

Question 10

A data engineer is setting up a data pipeline using AWS DMS to migrate data from an on-premises database to Amazon RDS for MySQL. The data must be encrypted in transit. Which TWO options can the engineer use? (Choose TWO.)

Accepted Answer

Enable SSL encryption on the DMS endpoint. DMS supports SSL/TLS for encrypting connections. Option A is wrong because VPN creates encrypted tunnel. Option D is wrong because VPC peering does not encrypt. Options B and C are correct (B uses SSL, C uses VPN). Option E is wrong because DMS does not use KMS for transit encryption.

Answer

Use VPC peering between on-premises and AWS

Answer

Use KMS to encrypt the DMS connection

Answer

Use a VPC endpoint for DMS

Question 11

A company needs to monitor and record all changes to IAM policies in their AWS account. Which AWS service should be used?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records API calls, including IAM policy changes. AWS Config records resource configuration changes and can evaluate compliance rules. Option A is wrong because IAM Access Analyzer is for analyzing resource policies for public access, not recording changes. Option C is wrong because GuardDuty is for threat detection. Option D is wrong because CloudWatch Logs does not directly record IAM changes.

Answer

Amazon CloudWatch Logs

Answer

Amazon GuardDuty

Answer

AWS IAM Access Analyzer

Question 12

A company is using AWS Glue to process data stored in an S3 bucket that is encrypted with SSE-KMS. The Glue job fails with an 'Access Denied' error when trying to read the data. The IAM role used by the Glue job has permissions to read from the S3 bucket and to use the KMS key. What is the most likely cause of the failure?

Accepted Answer

The IAM role is missing the kms:Decrypt permission. Option D is correct because AWS Glue jobs need the kms:Decrypt permission on the KMS key to read data encrypted with SSE-KMS. The IAM role may have the S3 read permissions but lack the kms:Decrypt permission. Option A (SSE-S3) is not relevant as the bucket uses SSE-KMS. Option B (bucket policy) could also be a cause, but the most common issue is missing kms:Decrypt. Option C (cross-account access) is less likely if the key is in the same account.

Answer

The S3 bucket is using SSE-S3 instead of SSE-KMS

Answer

The S3 bucket policy denies access to the Glue job

Answer

The KMS key is in a different AWS account

Question 13

Which THREE AWS services can be used to centrally manage and govern data across multiple AWS accounts? (Select THREE.)

Accepted Answer

AWS Control Tower. Options A, C, and E are correct. Option A (AWS Organizations) provides centralized management. Option C (AWS Lake Formation) can manage data lake permissions across accounts. Option E (AWS Control Tower) offers a pre-configured environment for governance. Option B (Amazon S3) is a storage service, not central governance. Option D (Amazon Redshift) is a data warehouse, not a governance service.

Answer

Amazon S3

Answer

Amazon Redshift

Question 14

A data engineer needs to share a dataset stored in Amazon S3 with another AWS account. The bucket policy currently grants access only to the owning account. What is the simplest way to grant cross-account access?

Accepted Answer

Add a bucket policy that grants access to the other account's IAM role. Option C is correct because a bucket policy with a principal ARN of the other account's IAM role is the standard way to grant cross-account access. Option A is wrong because that would make the object public, which is not recommended. Option B is wrong because a bucket policy can directly grant cross-account access without needing an IAM role in the other account. Option D is wrong because an ACL grants basic permissions but is less flexible.

Answer

Set the object ACL to public-read

Answer

Use an S3 access control list (ACL) to grant access to the other account

Answer

Create an IAM role in the other account and attach a policy to it

Question 15

A data engineer receives the error shown in the exhibit when trying to upload a file to my-bucket. The engineer uses the AWS CLI with the following command: aws s3 cp file.txt s3://my-bucket/. What is the most likely cause of the error?

Accepted Answer

The object is not encrypted with SSE-KMS. Option B is correct because the bucket policy denies PutObject if the encryption header is not set to aws:kms (SSE-KMS). The CLI command does not specify encryption, so the condition StringNotEquals matches and denies the request. Option A is wrong because the bucket policy explicitly denies non-KMS encrypted uploads. Option C is wrong because the error is not a network issue. Option D is wrong because the policy does not require KMS key ID, just the header value.

Answer

The KMS key specified in the command is incorrect

Answer

The VPC endpoint policy is blocking the request

Answer

The bucket does not have a default encryption configuration

Question 16

A company uses S3 to store sensitive data. Which TWO S3 features can be used to protect data at rest?

Accepted Answer

Server-Side Encryption with S3 Managed Keys (SSE-S3). Options A and D are correct. SSE-S3 and SSE-KMS both encrypt data at rest. Option B is wrong because S3 Transfer Acceleration accelerates transfers, not encryption. Option C is wrong because S3 Versioning protects against deletion, not encryption. Option E is wrong because S3 Object Lock prevents deletion/overwrite, not encryption.

Answer

S3 Versioning

Answer

S3 Transfer Acceleration

Answer

S3 Object Lock

Question 17

A company uses AWS Lake Formation to manage permissions on a data lake stored in S3. A data engineer notices that a new IAM user can query data via Athena but cannot see the tables in the Lake Formation console. What is the most likely cause?

Accepted Answer

The user has not been granted DESCRIBE or SELECT permissions on the tables in Lake Formation. Lake Formation permissions are separate from IAM permissions. Even if IAM allows Athena, Lake Formation must grant the user permissions on the tables. Option A is wrong because IAM policies are not sufficient for Lake Formation. Option B is irrelevant. Option D is wrong because the Glue Data Catalog may be accessible but Lake Formation can restrict visibility. Option C is correct.

Answer

The Athena workgroup is not encrypted

Answer

The Glue Data Catalog is not enabled for the account

Answer

The IAM user lacks s3:GetObject permissions

Question 18

Refer to the exhibit. A data engineer creates an IAM policy for a service role used by AWS Glue. What does the condition in the policy enforce?

Accepted Answer

The role can only use the KMS key when the request comes from S3. The condition restricts KMS actions to requests that come from S3 via the kms:ViaService condition key. Option B is wrong because it says Glue, but the condition is for S3. Option C is wrong because it's not for any service. Option D is wrong because it restricts to S3, not any KMS key. Option A is correct.

Answer

The role can use the KMS key from any AWS service

Answer

The role can only use the KMS key when the request comes from Glue

Answer

The role can only use the KMS key for decrypting data

Question 19

A data engineer needs to protect sensitive data in an S3 bucket. Which TWO AWS services can be used to detect and prevent accidental public access?

Accepted Answer

AWS Trusted Advisor. AWS Trusted Advisor checks for S3 buckets with public access. S3 Block Public Access can be enabled on the account or bucket level to prevent public access. Option C is wrong because CloudTrail records API calls but does not prevent public access. Option D is wrong because Macie discovers sensitive data, not public access. Option E is wrong because Config can evaluate rules but Trusted Advisor and Block Public Access are more direct.

Answer

AWS Config

Answer

AWS CloudTrail

Answer

Amazon Macie

Question 20

A company has multiple AWS accounts and wants to centrally manage permissions and access to data lakes. They have enabled AWS Organizations and want to use a single set of policies that apply to all accounts. Which policy type should be used at the organization level?

Accepted Answer

Service control policies (SCPs). Option D is correct because Service Control Policies (SCPs) are used in AWS Organizations to centrally manage permissions across accounts. Option A (IAM policies) are attached to IAM users/roles within an account, not across accounts. Option B (bucket policies) are specific to S3 buckets. Option C (KMS key policies) control access to KMS keys.

Answer

IAM policies

Answer

KMS key policies

Answer

S3 bucket policies