DEA-C01 Mock Exam 81 — 25 Questions

Question 1

A data engineer is configuring an S3 bucket policy to allow cross-account access for a partner account to read objects. The bucket is encrypted with SSE-KMS using a customer-managed key. What additional configuration is needed to allow the partner account to decrypt the objects?

Accepted Answer

Update the KMS key policy to grant the partner account kms:Decrypt permission. For cross-account access with SSE-KMS, the KMS key policy must grant the partner account access to use the key. The bucket policy alone is insufficient. The partner account does not need VPC endpoints, and the bucket policy for decryption is not needed. The partner account does not need access to the S3 bucket's encryption configuration.

Answer

Add a bucket policy that grants the partner account s3:GetObject

Answer

Create a VPC endpoint for S3 and add it to the bucket policy

Answer

Add a bucket policy that grants s3:GetObject and s3:GetEncryptionConfiguration

Question 2

Refer to the exhibit. A data engineer runs the above command and sees that the DataLakeAdmin role has the AmazonS3FullAccess and AWSLakeFormationDataAdmin policies attached. The engineer wants to ensure that the role can only access S3 data through Lake Formation. What should the engineer do?

Accepted Answer

Detach the AmazonS3FullAccess policy from the role. To enforce that access is only through Lake Formation, the engineer should detach the AmazonS3FullAccess policy because it allows direct S3 access, bypassing Lake Formation. The LakeFormationAdmin policy is needed for Lake Formation administration. Changing the S3 bucket policy to deny all access except from Lake Formation is not straightforward because Lake Formation uses the principal's IAM role. Creating a new policy that denies S3 access would be redundant if the full access policy is removed.

Answer

Create a new IAM policy that explicitly denies s3:GetObject and attach it to the role

Answer

Detach the AWSLakeFormationDataAdmin policy from the role

Answer

Modify the S3 bucket policy to deny all access except from Lake Formation

Question 3

A data engineer is troubleshooting an issue where an Amazon Redshift query returns an error: 'ERROR:  permission denied for relation table_name'. The user has been granted SELECT on the table. What is the most likely cause?

Accepted Answer

The user does not have USAGE permission on the schema.. In Redshift, users need usage permission on the schema to access tables within it. Option B is correct. Option A is unrelated. Option C would result in a schema not found error. Option D would be a connection timeout.

Answer

The user's session has timed out.

Answer

The user does not have CONNECT permission on the database.

Answer

The table is in a different schema than expected.

Question 4

A data engineer needs to encrypt data at rest in an Amazon Redshift cluster. The company requires that the encryption key be managed by the customer and rotated annually. Which solution meets these requirements?

Accepted Answer

Use AWS CloudHSM to create and manage the encryption key, and configure Redshift to use it.. Option C is correct because AWS CloudHSM provides dedicated hardware security modules for key management, allowing customer-managed keys with rotation. Option A is incorrect because Redshift cannot use Secrets Manager for encryption keys. Option B is incorrect because AWS KMS with automatic rotation meets the rotation requirement but the key is AWS-managed unless using customer-managed KMS keys; however, CloudHSM is more appropriate for dedicated control. Option D is incorrect because S3 server-side encryption is not applicable to Redshift.

Answer

Use S3 server-side encryption with customer-provided keys (SSE-C).

Answer

Use AWS Secrets Manager to store the encryption key and configure Redshift to reference it.

Answer

Use AWS KMS with automatic key rotation enabled.

Question 5

A company uses AWS KMS to encrypt data in Amazon S3. The security team wants to ensure that the KMS key can only be used from within the company's VPC. Which policy element should be added to the KMS key policy?

Accepted Answer

Add a condition using aws:SourceVpc to allow only requests from the VPC.. Option C is correct because using a condition with aws:SourceVpc restricts key usage to requests originating from a specific VPC. Option A is wrong because the Principal element specifies who can use the key, not where. Option B is wrong because aws:SourceIp is for IP addresses, not VPC. Option D is wrong because kms:ViaService restricts usage to specific AWS services, not network location.

Answer

Set the Principal element to restrict access to the VPC.

Answer

Add a condition using aws:SourceIp to allow only IP addresses from the VPC.

Answer

Add a condition using kms:ViaService to allow only via VPC endpoints.

Question 6

Refer to the exhibit. A data engineer queries AWS CloudTrail to investigate a PutObject event. What does the exhibit reveal about the object sensitive.csv?

Accepted Answer

The object was uploaded with server-side encryption using AWS KMS.. Option D is correct because the CloudTrail event shows x-amz-server-side-encryption: aws:kms, indicating the object was uploaded with SSE-KMS. Option A is wrong because the event does not indicate SSE-S3 (would be AES256). Option B is wrong because the object is encrypted at rest, not in transit. Option C is wrong because the event shows the object was uploaded, not that encryption failed.

Answer

The upload failed due to encryption mismatch.

Answer

The object was not encrypted at rest.

Answer

The object was encrypted with SSE-S3.

Question 7

A data engineering team needs to encrypt data at rest in an Amazon S3 bucket that stores sensitive customer information. The team must use an AWS Key Management Service (AWS KMS) customer managed key with automatic rotation enabled. Which configuration meets these requirements?

Accepted Answer

Use default encryption with SSE-KMS and specify the customer managed key ID.. Option B is correct because it enables SSE-KMS with a customer managed key that has automatic key rotation. Option A is wrong because SSE-S3 uses AWS managed keys without customer control. Option C is wrong because SSE-C requires the customer to manage the key and does not support automatic rotation. Option D is wrong because SSE-KMS with an AWS managed key does not allow customer control.

Answer

Use default encryption with SSE-S3.

Answer

Use default encryption with SSE-C and provide a customer-provided key.

Answer

Use default encryption with SSE-KMS and leave the key ID empty to use the AWS managed key.

Question 8

A data engineer needs to ensure that an S3 bucket policy follows the principle of least privilege. Which of the following are valid conditions to restrict access based on the requester's identity? (Choose THREE.)

Accepted Answer

aws:PrincipalOrgID. Options A, C, and D are correct. aws:SourceIp restricts based on IP address. aws:PrincipalOrgID restricts to a specific AWS Organization. aws:userId restricts to a specific IAM user ID. Option B is wrong because aws:Referer is for HTTP referrer, not identity. Option E is wrong because s3:x-amz-server-side-encryption is for encryption, not identity.

Answer

s3:x-amz-server-side-encryption

Answer

aws:Referer

Question 9

A company wants to securely store database credentials used by a Lambda function. Which AWS service should be used to store and rotate the credentials automatically?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is designed for storing secrets and provides automatic rotation. Systems Manager Parameter Store can store secrets but does not natively support automatic rotation for database credentials. KMS is for encryption keys, not storing secrets. CloudHSM is for hardware security modules.

Answer

AWS CloudHSM

Answer

AWS Key Management Service (KMS)

Answer

AWS Systems Manager Parameter Store

Question 10

A company uses AWS KMS to encrypt data at rest in Amazon S3. The security team requires that all encryption keys be automatically rotated every year. Which key type should be used to meet this requirement without manual intervention?

Accepted Answer

Use an AWS managed key (aws/s3).. AWS managed keys (AWS_KMS) are automatically rotated annually. Customer managed keys (CMK) support automatic rotation but require manual enablement; however, the question specifies 'without manual intervention'. AWS managed keys are rotated automatically every year. Option A is wrong because customer managed keys require manual enablement of rotation. Option B is wrong because imported key material cannot be rotated. Option C is correct as described. Option D is wrong because KMS does not generate keys on demand for S3; S3 uses a bucket key or CMK.

Answer

Use a customer managed key with automatic rotation enabled.

Answer

Use an imported key material because it supports automatic rotation.

Answer

Use a KMS key generated by S3 on each object upload.

Question 11

A company is designing a data pipeline that ingests data from an on-premises database to Amazon S3. The data contains personally identifiable information (PII) that must be masked before storage. Which AWS service can be used to mask the data in transit?

Accepted Answer

AWS Glue. AWS Glue can transform and mask data during ETL jobs. Option C is correct. Kinesis is for streaming data. Data Pipeline orchestrates but does not have native masking. DMS is for migration, not masking.

Answer

AWS Database Migration Service (DMS)

Answer

AWS Data Pipeline

Answer

Amazon Kinesis Data Firehose

Question 12

A company is using Amazon EMR with Kerberos authentication. They want to ensure that data in transit between EMR cluster nodes is encrypted. Which configuration should be applied?

Accepted Answer

Configure the EMR cluster to use in-transit encryption.. Option D is correct because enabling in-transit encryption in Amazon EMR uses TLS to encrypt data between nodes. Option A is incorrect because S3 SSE encrypts data at rest. Option B is incorrect because EBS encryption encrypts data at rest. Option C is incorrect because VPC peering does not provide encryption; it is a network connectivity feature.

Answer

Use VPC peering to connect the cluster nodes.

Answer

Enable S3 server-side encryption for the cluster's output data.

Answer

Enable EBS encryption on the cluster instances.

Question 13

A data engineer is designing a data lake on Amazon S3. The compliance team requires that objects be automatically deleted after 7 years. Additionally, objects must be transitioned to Amazon S3 Glacier Instant Retrieval after 30 days to reduce costs. Which S3 lifecycle policy configuration meets these requirements?

Accepted Answer

Transition to Glacier Instant Retrieval after 30 days, then expire after 2555 days.. Option D is correct because it transitions objects to Glacier Instant Retrieval after 30 days and then permanently deletes them after 7 years (2555 days). Option A is wrong because Glacier Deep Archive is not Glacier Instant Retrieval. Option B is wrong because it transitions to S3 Standard-IA, not Glacier Instant Retrieval. Option C is wrong because it deletes after 90 days, not 7 years.

Answer

Transition to Glacier Instant Retrieval after 30 days, then expire after 90 days.

Answer

Transition to Glacier Deep Archive after 30 days, then expire after 7 years.

Answer

Transition to S3 Standard-IA after 30 days, then expire after 7 years.

Question 14

A data engineer needs to ensure that all data in an S3 bucket is encrypted at rest. The bucket contains objects uploaded by various applications. What is the simplest method to enforce encryption for all new objects?

Accepted Answer

Configure an S3 bucket policy that denies PutObject requests without the x-amz-server-side-encryption header.. Option B is correct because S3 Bucket Policies can enforce encryption by denying PutObject requests that do not include the x-amz-server-side-encryption header. Option A is wrong because default encryption applies only if the upload request does not specify encryption headers; it does not enforce encryption for requests that specify 'None'. Option C is wrong because enabling S3 Block Public Access does not enforce encryption. Option D is wrong because S3 Object Lock prevents deletion but does not enforce encryption.

Answer

Enable S3 Block Public Access to block public access to the bucket.

Answer

Enable default encryption on the S3 bucket using S3-Managed Keys (SSE-S3).

Answer

Enable S3 Object Lock on the bucket.

Question 15

A company is using AWS Glue to process data stored in Amazon S3. The data includes personally identifiable information (PII) that must be masked before being written to a separate output bucket. Which AWS service or feature can be used to automatically detect and mask sensitive data in the Glue ETL job?

Accepted Answer

Use Amazon Macie to identify sensitive data and apply masking logic in the Glue job.. Option D is correct because Amazon Macie can be integrated with AWS Glue to detect and mask sensitive data. Option A is wrong because IAM policies control access, not data masking. Option B is wrong because S3 Object Lock prevents object deletion or modification, not masking. Option C is wrong because CloudWatch Logs do not mask data.

Answer

Configure CloudWatch Logs to filter and mask PII.

Answer

Use an IAM policy to restrict access to the PII columns.

Answer

Enable S3 Object Lock on the output bucket.

Question 16

A company must comply with a regulation that requires logging all access to sensitive data stored in Amazon S3. Which AWS services can be used to capture and store access logs? (Choose TWO.)

Accepted Answer

AWS CloudTrail. Options B and D are correct. AWS CloudTrail logs API calls to S3. Amazon S3 server access logs provide detailed records of requests. Option A is wrong because Amazon CloudWatch Logs can receive logs but doesn't generate S3 access logs directly. Option C is wrong because AWS Config tracks configuration changes, not access. Option E is wrong because VPC Flow Logs capture network traffic, not S3 access.

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Answer

VPC Flow Logs

Question 17

A company is using Amazon Redshift for analytics and needs to ensure that all data is encrypted at rest. The current cluster does not have encryption enabled. What is the most efficient way to enable encryption?

Accepted Answer

Create a snapshot of the cluster and restore it to a new cluster with encryption enabled. Redshift does not support enabling encryption on an existing cluster; a new encrypted cluster must be created and data migrated. Modifying the cluster configuration or parameter groups does not enable encryption. Creating a snapshot and restoring it to a new cluster with encryption enabled is the standard approach.

Answer

Change the cluster parameter group to enable encryption

Answer

Modify the cluster configuration to enable encryption

Answer

Use AWS DMS to migrate data to a new encrypted cluster

Question 18

A data engineer needs to grant an IAM role read-only access to Amazon DynamoDB tables in a specific AWS account. Which IAM policy element should be used to restrict access to only the 'GetItem' and 'Query' actions?

Accepted Answer

Action. The 'Action' element specifies the allowed API actions. 'Effect' is 'Allow' or 'Deny'. 'Resource' specifies the ARN. 'Condition' adds conditions. So Action is correct.

Answer

Resource

Answer

Effect

Answer

Condition

Question 19

A data engineer needs to store sensitive data in Amazon S3 and automatically classify the data using a managed service. The data is uploaded via an S3 bucket. Which AWS service can automatically detect and classify sensitive data?

Accepted Answer

Amazon Macie. Option C is correct because Amazon Macie uses machine learning to discover and classify sensitive data in S3. Option A is incorrect because AWS Shield is for DDoS protection. Option B is incorrect because Amazon Inspector is for vulnerability assessment on EC2. Option D is incorrect because AWS WAF is a web application firewall.

Answer

AWS WAF

Answer

Amazon Inspector

Answer

AWS Shield

Question 20

A company is using AWS Glue to catalog data in S3. The security team wants to ensure that only authorized users can access the Glue Data Catalog and that data lineage is tracked. Which AWS services can be used together to meet these requirements? (Choose TWO.)

Accepted Answer

AWS Glue DataBrew. Options A and D are correct. AWS Lake Formation provides fine-grained access control for the Data Catalog. AWS Glue DataBrew provides data lineage visualization. Option B is wrong because Athena is a query service, not for access control or lineage. Option C is wrong because CloudTrail logs API calls but does not manage permissions. Option E is wrong because Kinesis is for streaming.

Answer

AWS CloudTrail

Answer

Amazon Athena

Answer

Amazon Kinesis