DEA-C01 Mock Exam 76 — 25 Questions

Question 1

A company uses AWS Glue to process sensitive customer data stored in S3. The security team requires that all data be encrypted at rest using a customer-managed KMS key and that access to the key be auditable. Which solution meets these requirements?

Accepted Answer

Configure the S3 bucket to use SSE-KMS with a customer-managed KMS key and enable CloudTrail for KMS events.. Option D is correct because SSE-KMS with a customer-managed key provides encryption with an auditable CMK. Option A (SSE-S3) uses AWS-managed keys with no audit capability. Option B (client-side encryption) is not at rest encryption within S3. Option C (SSE-C) does not use KMS keys.

Answer

Encrypt the data client-side before uploading to S3.

Answer

Enable default SSE-S3 encryption on the S3 bucket.

Answer

Use SSE-C with a customer-provided key.

Question 2

A company uses Amazon Redshift for data warehousing. The security team requires that all queries be logged for audit and that sensitive columns be masked for non-privileged users. Which THREE steps should the data engineer take? (Choose 3)

Accepted Answer

Implement row-level security using Redshift's row-level security feature.. Options A, C, and D are correct. Option A: audit logging captures queries. Option C: column-level access control can be achieved with views. Option D: row-level security filters rows. Option B is wrong because IAM roles do not control column access. Option E is wrong because CloudTrail does not log queries.

Answer

Enable CloudTrail logging for Redshift data events.

Answer

Use IAM roles to restrict access to specific columns.

Question 3

A data engineer needs to encrypt data at rest in Amazon S3 using server-side encryption with a customer-managed KMS key. Which TWO steps are required to ensure that the KMS key can be used for S3 object encryption?

Accepted Answer

Add a statement in the KMS key policy that allows the S3 service to use the key.. Options A and B are correct. The KMS key policy must grant the S3 service principal kms:GenerateDataKey and kms:Decrypt permissions. Option C is not required because S3 does not use KMS via VPC. Option D is not required because S3 does not need to assume a role for SSE-KMS. Option E is not required because SSE-KMS does not use S3 bucket policies.

Answer

Configure a VPC endpoint for KMS to allow S3 to access the key.

Answer

Set the S3 bucket policy to require SSE-KMS for all PutObject requests.

Answer

Create a service-linked role for S3 to access KMS.

Question 4

A company uses Amazon RDS for PostgreSQL with encryption at rest using AWS KMS. The company needs to share a database snapshot with a different AWS account. What must be done to allow the target account to restore the snapshot?

Accepted Answer

Share the snapshot and update the KMS key policy to allow the target account to use the key. Option C is correct. The snapshot must be shared with the target account, and the KMS key policy must grant the target account decrypt permissions. Option A is wrong because copying the snapshot without sharing the key won't help. Option B is wrong because sharing the key policy alone is insufficient. Option D is wrong because changing the encryption to a different key after sharing is not possible.

Answer

Copy the snapshot to the target account's region and share it

Answer

Create an IAM role in the source account that allows cross-account snapshot access

Answer

Disable encryption on the snapshot before sharing

Question 5

A company wants to audit all changes to IAM policies in their AWS account. Which AWS service should be used to record these changes?

Accepted Answer

AWS Config. AWS Config records configuration changes to AWS resources, including IAM policies. CloudTrail records API calls, not configuration snapshots. GuardDuty is for threat detection. Inspector is for vulnerability assessment.

Answer

AWS CloudTrail

Answer

Amazon GuardDuty

Answer

Amazon Inspector

Question 6

A data engineer needs to ensure that data in an S3 bucket is encrypted at rest. The bucket policy includes a condition that denies PutObject requests if the object is not encrypted. Which S3 encryption feature does this enforce?

Accepted Answer

S3 Bucket Policy. Option D is correct because S3 bucket policies can require server-side encryption by denying PutObject without encryption headers. Option A (default encryption) is a bucket-level setting that automatically encrypts objects, but it does not enforce encryption via policy. Option B (object lock) prevents deletion. Option C (MFA delete) requires multi-factor authentication.

Answer

S3 Object Lock

Answer

S3 MFA Delete

Answer

S3 Default Encryption

Question 7

A data engineer needs to allow an IAM user to rotate the secret in AWS Secrets Manager for an RDS database. Which IAM action should be included in the policy?

Accepted Answer

secretsmanager:RotateSecret. The secretmanager:RotateSecret action allows the user to initiate rotation of a secret. Option B is correct. secretmanager:GetSecretValue only retrieves the secret value, not rotate it.

Answer

secretsmanager:PutSecretValue

Answer

secretsmanager:UpdateSecret

Answer

secretsmanager:GetSecretValue

Question 8

A data engineer needs to share a dataset from an S3 bucket in Account A with users in Account B. The dataset must remain encrypted at rest with an S3-managed key. What is the MOST secure way to grant cross-account access?

Accepted Answer

Create a bucket policy that grants cross-account access to an IAM role in Account B.. Option B is correct because a bucket policy granting access to the IAM role in Account B is the recommended secure method. Option A is insecure because it grants public access. Option C is incorrect because ACLs are legacy and less secure. Option D is not a valid AWS feature.

Answer

Make the bucket public and use bucket policies to allow only Account B users.

Answer

Use S3 object ACLs to grant access to Account B's root user.

Answer

Use an S3 VPC endpoint to allow Account B users through private IPs.

Question 9

A company wants to enforce encryption in transit for data moving between an EC2 instance and an S3 bucket. Which TWO methods can achieve this? (Choose 2)

Accepted Answer

Add a bucket policy that denies requests without the aws:SecureTransport condition.. Options A and C are correct. Option A: HTTPS ensures encryption in transit. Option C: S3 bucket policy enforcing aws:SecureTransport ensures HTTPS. Option B is wrong because SSE-S3 is for at-rest encryption. Option D is wrong because VPC endpoints do not automatically enforce encryption. Option E is wrong because CloudTrail is for logging.

Answer

Use a VPC endpoint for S3.

Answer

Enable default SSE-S3 encryption on the bucket.

Answer

Enable CloudTrail to monitor for non-encrypted requests.

Question 10

A company is using AWS Lake Formation to manage a data lake. The data engineer needs to set up fine-grained access control so that users can only see specific columns in a table based on their IAM role. Which THREE steps should the data engineer take?

Accepted Answer

Ensure that the users query the table through a service integrated with Lake Formation, such as Athena.. Options A, B, and D are correct. Lake Formation column-level access requires defining the policy in Lake Formation, granting permissions to the IAM role, and the user must use Lake Formation-enabled services. Option C is wrong because S3 bucket policies are not used for column-level control. Option E is wrong because the table must be registered with Lake Formation.

Answer

Create a view in the Data Catalog that exposes only the required columns.

Answer

Attach an S3 bucket policy to restrict access to the underlying data.

Question 11

A data engineer needs to ensure that an Amazon Redshift cluster encrypts all data at rest. Which setting must be enabled when creating the cluster?

Accepted Answer

Enable encryption. Option B is correct. Redshift cluster encryption is enabled at creation. Option A is wrong because SSL is for in-transit. Option C is wrong because VPC is network isolation. Option D is wrong because automated snapshots are for backup.

Answer

Enable automated snapshots

Answer

Enable SSL/TLS

Answer

Enable VPC

Question 12

A data engineer needs to share a dataset stored in an Amazon S3 bucket with another AWS account. The dataset must remain encrypted at rest using AWS KMS. The data engineer creates a bucket policy that grants the other account access to the bucket. However, the other account reports that objects appear encrypted and they cannot decrypt them. What is the most likely cause?

Accepted Answer

The KMS key policy does not grant the other account the kms:Decrypt permission. When using SSE-KMS, the bucket policy alone is not enough; the KMS key policy must also grant the consuming account permission to use the key (kms:Decrypt). The bucket policy controls access to the S3 objects, but KMS key policy controls who can decrypt.

Answer

The bucket policy does not grant the s3:GetObject permission

Answer

The other account must use the same KMS key to upload objects

Answer

The objects are encrypted with SSE-S3, which is not supported for cross-account access

Question 13

A company needs to audit all API calls made in their AWS account, including actions performed by the root user. Which AWS service should be used?

Accepted Answer

AWS CloudTrail. Option B is correct because AWS CloudTrail records all API calls for auditing. Option A is incorrect because CloudWatch Logs stores logs but does not capture API calls natively. Option C is incorrect because AWS Config tracks resource configuration changes, not API calls. Option D is incorrect because VPC Flow Logs capture network traffic, not API calls.

Answer

VPC Flow Logs

Answer

Amazon CloudWatch Logs

Answer

AWS Config

Question 14

A company stores sensitive customer data in an Amazon S3 bucket. The security team requires that all data be encrypted at rest using server-side encryption with AWS KMS managed keys (SSE-KMS). Additionally, they want to ensure that the encryption context is enforced for all PutObject requests. Which THREE steps should be taken to meet these requirements?

Accepted Answer

Set the default encryption on the bucket to SSE-KMS with the desired KMS key.. Options A, C, and E are correct. To enforce encryption context, you must use a bucket policy with a condition for kms:EncryptionContext (A). You must also set the default encryption on the bucket to SSE-KMS (C). The IAM role used by applications must have permission to use the KMS key (E). Option B is incorrect because the bucket policy can enforce encryption context without SSE-C. Option D is incorrect because SSE-S3 is not allowed.

Answer

Configure the bucket to use SSE-C and provide the encryption key.

Answer

Enable S3 Versioning on the bucket.

Question 15

A data engineer needs to grant an IAM user read-only access to a specific prefix (folder) in an S3 bucket. The bucket contains sensitive data. Which S3 bucket policy statement achieves this?

Accepted Answer

{"Effect":"Allow","Principal":{"AWS":"arn:aws:iam::123456789012:user/DataEng"},"Action":"s3:GetObject","Resource":"arn:aws:s3:::mybucket/sensitive/*"}. Option B is correct because it grants s3:GetObject for the specific prefix and denies access to other prefixes implicitly. Option A is wrong because it grants access to all objects. Option C is wrong because it uses a condition that does not restrict prefix. Option D is wrong because it grants access to all objects in the bucket.

Answer

{"Effect":"Allow","Principal":{"AWS":"arn:aws:iam::123456789012:user/DataEng"},"Action":"s3:GetObject","Resource":"arn:aws:s3:::mybucket"}

Answer

{"Effect":"Allow","Principal":{"AWS":"arn:aws:iam::123456789012:user/DataEng"},"Action":"s3:GetObject","Resource":"arn:aws:s3:::mybucket/*","Condition":{"StringLike":{"s3:prefix":"sensitive/"}}}

Answer

{"Effect":"Allow","Principal":{"AWS":"arn:aws:iam::123456789012:user/DataEng"},"Action":"s3:GetObject","Resource":"arn:aws:s3:::mybucket/*"}

Question 16

Which TWO actions should a data engineer take to protect sensitive data in an Amazon S3 bucket from being accessed by unauthorized users? (Select TWO.)

Accepted Answer

Add a bucket policy with a Deny effect for unauthorized principals. Options A and C are correct. Option A (S3 Block Public Access) prevents public access to the bucket. Option C (bucket policy with Deny effect) explicitly denies access to unauthorized users. Option B (S3 server access logs) is for auditing, not prevention. Option D (CloudTrail) is for logging, not prevention. Option E (VPC endpoint) is for network connectivity, not access control.

Answer

Create a VPC endpoint for S3

Answer

Enable S3 server access logging

Answer

Enable AWS CloudTrail for the bucket

Question 17

A company stores sensitive data in Amazon S3. The security team requires that all data be encrypted at rest and that the encryption keys be stored in AWS CloudHSM. Which S3 encryption option should be used?

Accepted Answer

SSE-C. SSE-C allows customers to provide their own encryption keys, which can be stored in CloudHSM. SSE-S3 and SSE-KMS use AWS-managed keys or KMS keys, not CloudHSM. Option D is correct.

Answer

SSE-S3

Answer

SSE-KMS with an AWS managed key

Answer

SSE-KMS with a customer managed key

Question 18

A company uses Redshift for analytics. The security team requires that all queries be logged and that any access to sensitive columns be blocked for non-admin users. Which combination of features should the data engineer implement?

Accepted Answer

Enable Redshift audit logging and create views that expose only non-sensitive columns, granting access to views.. Option C is correct because Redshift audit logging captures queries, and column-level access control can be enforced using views with restricted columns. Option A is wrong because IAM policies do not control column-level access in Redshift. Option B is wrong because row-level security is not yet supported. Option D is wrong because CloudWatch Logs do not control access.

Answer

Use Redshift row-level security and enable CloudTrail logging.

Answer

Enable CloudWatch Logs for Redshift and use IAM conditions to block sensitive columns.

Answer

Enable Redshift audit logging and use IAM policies to restrict column access.

Question 19

A company wants to audit all API calls made to Amazon S3 and Amazon RDS resources. Which TWO AWS services can be used together to achieve this?

Accepted Answer

AWS CloudTrail. Options A and B are correct. CloudTrail records API calls to S3 and RDS, and CloudWatch Logs can store the logs for monitoring. Option C is wrong because Config records resource configuration changes, not API calls. Option D is wrong because GuardDuty is a threat detection service. Option E is wrong because Macie is for data classification.

Answer

AWS Config

Answer

Amazon GuardDuty

Answer

Amazon Macie

Question 20

Refer to the exhibit.

Exhibit:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::123456789012:role/DataEngineer"
      },
      "Action": [
        "kms:Decrypt",
        "kms:ReEncrypt*"
      ],
      "Resource": "*"
    }
  ]
}

A data engineer tries to encrypt data using the KMS key associated with this key policy and receives an access denied error. What is the cause?

Accepted Answer

The policy does not include kms:Encrypt action. Option B is correct. The key policy grants Decrypt and ReEncrypt, but not Encrypt. Option A is wrong because the resource is "*" which means all keys. Option C is wrong because the principal is correct. Option D is wrong because there is no explicit deny.

Answer

The principal is an IAM role, which is not allowed

Answer

There is an explicit deny in the policy

Answer

The Resource element is set to "*", which is invalid for KMS key policies