DEA-C01 Mock Exam 78 — 25 Questions

Question 1

A company uses Amazon Redshift for data warehousing. The security team requires that all data stored in Redshift be encrypted at rest. The current cluster is unencrypted. Which approach should the data engineer take to meet this requirement with minimal downtime?

Accepted Answer

Take a snapshot of the existing cluster and restore it to a new encrypted cluster.. Option D is correct because Redshift allows restoring a snapshot to a new encrypted cluster. The engineer can take a snapshot of the existing cluster, restore it to a new cluster with encryption enabled, and then redirect traffic to the new cluster. Option A is wrong because encryption cannot be enabled on an existing cluster. Option B is wrong because COPY command does not encrypt the cluster. Option C is wrong because unloading and reloading data would cause significant downtime.

Answer

Modify the cluster to enable encryption.

Answer

Unload data to S3 and reload into a new encrypted cluster.

Answer

Use the COPY command to load data into a new encrypted table.

Question 2

A company uses Amazon EMR to process data stored in S3 with server-side encryption using AWS KMS. The EMR cluster fails with a "403 Access Denied" error when reading data from S3. The IAM role for the EMR cluster has s3:GetObject and kms:Decrypt permissions. What is the most likely issue?

Accepted Answer

The EC2 instance profile does not have kms:Decrypt permission. Option D is correct. EMR EC2 instance profile must have the necessary permissions. Often the instance profile is missing kms:Decrypt. Option A is wrong because SSE-KMS requires kms:Decrypt. Option B is wrong because S3 bucket policy might allow. Option C is wrong because EMRFS consistent view is not related.

Answer

The S3 bucket policy denies access to the EMR cluster's IAM role

Answer

The EMRFS consistent view is not enabled

Answer

The EMR cluster is using an incorrect KMS key ID

Question 3

A company uses Amazon Athena to query data in S3. The security team wants to ensure that users can only query tables they have permissions to in the AWS Glue Data Catalog. Which service should be used to manage these permissions centrally?

Accepted Answer

AWS Lake Formation. Option A is correct because Lake Formation provides centralized permissions management for the Glue Data Catalog. Option B (IAM) is too low-level and does not integrate directly with Data Catalog tables. Option C (S3 bucket policy) does not control table access. Option D (CloudTrail) is for auditing, not access control.

Answer

AWS IAM

Answer

AWS CloudTrail

Answer

S3 bucket policies

Question 4

A company uses Amazon RDS for MySQL with encryption at rest enabled. The security team requires that all database audit logs be stored in Amazon S3 for at least 7 years. Which AWS service should the data engineer use to collect and store the logs?

Accepted Answer

Amazon CloudWatch Logs with a subscription filter to Amazon S3.. Option A is correct because RDS for MySQL can publish audit logs to CloudWatch Logs, and a subscription filter can forward them to S3 for long-term storage. Option B is wrong because Kinesis Data Firehose is not directly integrated with RDS audit logs. Option C is wrong because S3 is for storage, not collection. Option D is wrong because CloudTrail does not capture RDS audit logs.

Answer

Amazon S3 with S3 Object Lock enabled for write-once-read-many (WORM) protection.

Answer

Amazon Kinesis Data Firehose to stream logs directly to Amazon S3.

Answer

AWS CloudTrail to capture database queries and store in S3.

Question 5

A data engineer needs to restrict access to an S3 bucket so that only users from a specific AWS account can read objects. Which S3 bucket policy element should be used?

Accepted Answer

Principal. Option B is correct. The Principal element specifies the account. Option A is wrong because Resource is the bucket. Option C is wrong because Action is the operation. Option D is wrong because Condition can be used but is not the primary element.

Answer

Action

Answer

Resource

Answer

Condition

Question 6

A data engineer is setting up an Amazon Redshift cluster. Which TWO measures can be taken to secure the data at rest?

Accepted Answer

Enable encryption on the Redshift cluster using AWS KMS. Redshift supports encryption at rest using KMS or HSM. Cluster encryption can be enabled at launch. Client-side encryption before loading protects data before it reaches Redshift, but not necessarily at rest. VPC security groups control network access. IAM roles control who can access the cluster.

Answer

Encrypt data on the client side before loading into Redshift

Answer

Enable AWS IAM database authentication

Answer

Use VPC security groups to restrict network access

Question 7

A company uses AWS Glue DataBrew to clean and normalize data. The data contains sensitive columns that must be masked before being written to the output. Which DataBrew action should be applied?

Accepted Answer

Apply a Mask transform to the sensitive columns.. Option C is correct because DataBrew has a built-in 'Mask' transform that can obfuscate sensitive data. Option A is wrong because 'Hash' is for hashing, not masking. Option B is wrong because 'Delete' removes the column entirely. Option D is wrong because 'Encrypt' is not a DataBrew transform; encryption is handled at the storage layer.

Answer

Apply a Hash transform to the sensitive columns.

Answer

Apply an Encrypt transform to the sensitive columns.

Answer

Apply a Delete transform to remove the sensitive columns.

Question 8

A company uses AWS KMS to encrypt sensitive data in S3. The security team requires that the KMS key must be rotated automatically every year. Which key type should be used?

Accepted Answer

AWS managed key (aws/s3). Option A is correct because AWS managed keys (with automatic rotation) rotate annually by default. Option B is wrong because customer managed keys (with rotation enabled) rotate annually, but the key material is not rotated automatically unless imported key material is used. Option C is wrong because AWS managed keys rotate automatically, but custom key stores are for CloudHSM. Option D is wrong because asymmetric keys are not automatically rotated.

Answer

Asymmetric customer managed key

Answer

Custom key store backed by CloudHSM

Answer

Customer managed key with automatic rotation enabled

Question 9

A data engineer needs to audit all AWS KMS key usage events for the past 90 days to verify compliance. Which AWS service should be used?

Accepted Answer

AWS CloudTrail. Option C is correct because AWS CloudTrail logs all KMS API calls and can be queried for the past 90 days. Option A is wrong because AWS Config tracks resource configurations, not API calls. Option B is wrong because Amazon Inspector is for vulnerability assessments. Option D is wrong because VPC Flow Logs capture network traffic, not API calls.

Answer

VPC Flow Logs

Answer

AWS Config

Answer

Amazon Inspector

Question 10

Refer to the exhibit. An S3 bucket policy is shown. A data engineer using the DataEngineerRole tries to upload an object to s3://example-bucket/data/report.csv with SSE-S3 encryption. The upload fails. What is the most likely cause?

Accepted Answer

The condition requires SSE-S3 encryption header, but the upload did not include it.. Option D is correct because the condition s3:x-amz-server-side-encryption: AES256 requires SSE-S3, but the policy also requires that encryption header be present. Option A is wrong because the role has GetObject and PutObject permissions. Option B is wrong because the resource is data/*, which should match. Option C is wrong because the policy allows the role.

Answer

The resource ARN does not match the object.

Answer

The role does not have s3:PutObject permission.

Answer

The principal is not authorized.

Question 11

A company uses Amazon Redshift for its data warehouse and needs to enforce column-level security on sensitive columns. Which TWO approaches can achieve this?

Accepted Answer

Create views that expose only non-sensitive columns and grant access to the views.. Options A and D are correct. Redshift column-level security allows defining access controls at the column level. Views can also restrict column access. Option B is wrong because row-level security does not restrict columns. Option C is wrong because S3 bucket policies are unrelated. Option E is wrong because Redshift Spectrum queries external data, not column-level control.

Answer

Apply an S3 bucket policy to the underlying data files.

Answer

Use Redshift Spectrum to query external tables and restrict columns via the external schema.

Answer

Use Redshift row-level security policies to restrict column access.

Question 12

A data engineer needs to audit all access to an S3 bucket containing sensitive customer data. The engineer must record the requester, timestamp, action, and whether the access was denied. Which AWS solution meets these requirements?

Accepted Answer

Enable S3 server access logs for the bucket, storing them in a different bucket.. Option C is correct because S3 server access logs capture detailed records of requests made to a bucket, including requester, timestamp, action, and response status. Option A is wrong because CloudTrail logs object-level events only if Data Events are enabled, but server access logs are specifically designed for this purpose and are more granular. Option B is wrong because VPC Flow Logs capture network traffic metadata but not application-level S3 operations. Option D is wrong because AWS Config tracks resource configuration changes, not access requests.

Answer

Use AWS Config to record S3 bucket-level configuration changes.

Answer

Enable VPC Flow Logs for the VPC where the bucket resides.

Answer

Enable AWS CloudTrail Data Events for the S3 bucket.

Question 13

A company uses AWS Lake Formation to manage access to data in a data lake. A new data engineer has been granted SELECT permission on a table but receives an 'AccessDeniedException' when querying via Amazon Athena. The table is registered in Lake Formation and the data is encrypted with SSE-KMS. Which of the following is the MOST likely cause?

Accepted Answer

The IAM role used by Athena does not have kms:Decrypt permission on the KMS key.. Option B is correct because Lake Formation integrates with AWS KMS for encrypted data; the IAM role used by Athena must have kms:Decrypt permission on the KMS key. Option A is wrong because Lake Formation permissions are not passed via the resource-based policy on the table. Option C is wrong because the AWS Glue Data Catalog does not enforce data access by default. Option D is wrong because S3 bucket policies can block access, but the primary issue with encrypted data is KMS permissions.

Answer

The table's resource-based policy does not include the engineer's IAM role.

Answer

The S3 bucket policy denies access to the engineer's IAM role.

Answer

The AWS Glue Data Catalog has not been granted permission to the engineer's role.

Question 14

A data engineer needs to securely store database credentials used by a Lambda function. The solution must automatically rotate the credentials every 90 days. Which AWS service should the engineer use?

Accepted Answer

AWS Secrets Manager. Option D is correct because AWS Secrets Manager supports automatic rotation of secrets. Option A is wrong because Parameter Store does not natively rotate secrets. Option B is wrong because CloudHSM is a hardware security module, not a secret store with rotation. Option C is wrong because IAM Roles are for access to AWS services, not for storing database credentials.

Answer

AWS CloudHSM

Answer

AWS Systems Manager Parameter Store

Answer

IAM Roles for Lambda

Question 15

A data engineer needs to grant an IAM user read-only access to an S3 bucket named 'data-lake'. Which IAM policy statement should be used?

Accepted Answer

{"Effect":"Allow","Action":["s3:ListBucket","s3:GetObject"],"Resource":["arn:aws:s3:::data-lake","arn:aws:s3:::data-lake/*"]}. Option B is correct because it allows ListBucket on the bucket and GetObject on objects. Option A is wrong because it allows all actions. Option C is wrong because it allows write actions. Option D is wrong because it only allows ListBucket, not GetObject.

Answer

{"Effect":"Allow","Action":["s3:PutObject","s3:DeleteObject"],"Resource":"arn:aws:s3:::data-lake/*"}

Answer

{"Effect":"Allow","Action":"s3:*","Resource":"*"}

Answer

{"Effect":"Allow","Action":"s3:ListBucket","Resource":"arn:aws:s3:::data-lake"}

Question 16

A company has an S3 bucket policy that allows access to a specific IAM role. However, an administrator notices that requests from that role are being denied. The bucket is encrypted with AES-256. What is the MOST likely reason for the denial?

Accepted Answer

The bucket policy allows access, but the VPC endpoint policy denies the action.. Option B is correct because even if the bucket policy allows access, if the bucket is not publicly accessible and the VPC endpoint policy does not allow the action, access will be denied. Option A is wrong because AES-256 encryption does not require additional permissions. Option C is wrong because an explicit deny in the bucket policy would override an allow. Option D is wrong because S3 Block Public Access settings affect only public access, not IAM role access.

Answer

The IAM role does not have s3:Decrypt permission on the bucket.

Answer

The bucket policy has an explicit deny statement that overrides the allow.

Answer

The S3 Block Public Access settings are blocking the request.

Question 17

A data engineer is designing a data pipeline that processes sensitive financial data. The data must be encrypted at rest and in transit. The pipeline uses Amazon Kinesis Data Streams to ingest data and AWS Lambda to process it. Which combination of actions ensures the data is encrypted in transit? (Select TWO.)

Accepted Answer

Enable TLS for Kinesis Data Streams.. Option A is correct because enabling TLS for Kinesis Data Streams encrypts data in transit between producers and the stream. Option D is correct because enabling Encryption in Transit for Lambda's VPC configuration ensures TLS is used for Lambda's network connections. Option B is wrong because SSE-S3 encrypts data at rest in S3. Option C is wrong because SSE-KMS encrypts data at rest in Kinesis. Option E is wrong because CloudWatch Logs encryption is at rest.

Answer

Enable Server-Side Encryption (SSE-S3) on the S3 bucket used for data storage.

Answer

Use AWS KMS to encrypt data at rest in Kinesis Data Streams.

Answer

Encrypt the Lambda function's CloudWatch Logs using KMS.

Question 18

A data engineer is troubleshooting an Amazon Redshift cluster that is not allowing connections from a specific IP range. The engineer verified that the cluster's security group allows inbound traffic from the IP range. What is the next step to resolve the issue?

Accepted Answer

Check the network ACL (NACL) associated with the Redshift cluster's subnet.. Option C is correct because Redshift also uses a VPC network ACL (NACL) that can block traffic at the subnet level, independent of security groups. Option A is wrong because the security group already allows traffic. Option B is wrong because IAM roles do not control network-level access. Option D is wrong because the cluster parameter group does not control network access.

Answer

Modify the Redshift cluster parameter group to enable public accessibility.

Answer

Verify that the cluster's security group is attached to the Redshift cluster.

Answer

Check the IAM role associated with the Redshift cluster.

Question 19

A company uses AWS Glue to run ETL jobs on data stored in S3. The data is encrypted with SSE-KMS. The Glue job fails with an 'AccessDenied' error when trying to read the data. What is the MOST likely cause?

Accepted Answer

The IAM role used by Glue does not have kms:Decrypt permission on the KMS key.. Option B is correct because Glue jobs need kms:Decrypt permission on the KMS key to read encrypted data. Option A is wrong because the S3 bucket policy may allow access but KMS permission is separate. Option C is wrong because Glue Data Catalog permissions are for the catalog, not data access. Option D is wrong because Glue connection permissions are for JDBC connections, not S3.

Answer

The S3 bucket policy denies access to the Glue service role.

Answer

The AWS Glue Data Catalog does not have permission to the table.

Answer

The Glue job's connection does not have the necessary permissions.

Question 20

Refer to the exhibit. An IAM policy allows kms:Decrypt and kms:GenerateDataKey on a specific KMS key. A data engineer is unable to upload an object to an S3 bucket that uses SSE-KMS with that key. What is the MOST likely missing permission?

Accepted Answer

s3:PutObject permission on the bucket.. Option A is correct because to upload an object with SSE-KMS, the user needs kms:GenerateDataKey, which is already allowed, but also s3:PutObject permission on the bucket. Option B is wrong because kms:Decrypt is already allowed. Option C is wrong because kms:CreateGrant is not required for uploading. Option D is wrong because kms:Encrypt is not required; GenerateDataKey is sufficient.

Answer

kms:Decrypt permission on the key.

Answer

kms:Encrypt permission on the key.

Answer

kms:CreateGrant permission on the key.