DEA-C01 Mock Exam 86 — 25 Questions

Question 1

A company uses Amazon Redshift for data warehousing. The security team requires that all data stored in Redshift be encrypted at rest using a customer-managed KMS key. How should the data engineer configure this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable encryption using a KMS key when creating the Redshift cluster. Redshift supports encryption at rest using KMS. You enable encryption when launching the cluster by choosing a KMS key. Option B is wrong because Redshift doesn't use S3 SSE-KMS for its own storage. Option C is wrong because you cannot encrypt an existing cluster without restoring from snapshot. Option D is wrong because cluster parameter groups do not control encryption. Option A is correct.

Answer

Configure S3 SSE-KMS on the underlying S3 storage

Answer

Use the AWS KMS console to encrypt the Redshift cluster after creation

Answer

Set a cluster parameter group with encryption enabled

Question 2

A company stores data in Amazon S3 with server-side encryption using AWS KMS (SSE-KMS). The data engineer needs to give a third-party auditor read-only access to the encrypted objects. The auditor has an AWS account. Which strategy should be used?

Accepted Answer

Update the S3 bucket policy to allow access from the auditor's account and update the KMS key policy to allow the auditor's account to decrypt.. Cross-account access to SSE-KMS encrypted objects requires both an S3 bucket policy allowing the auditor's account and a KMS key policy granting the auditor's account decrypt permissions. Option A is wrong because presigned URLs don't solve the cross-account KMS issue. Option B is wrong because simply granting access to the KMS key is insufficient without S3 permissions. Option C is wrong because copying objects with SSE-S3 changes encryption and may not be allowed.

Answer

Generate a presigned URL for each object the auditor needs to access.

Answer

Copy the objects to a new bucket encrypted with SSE-S3 and share that bucket.

Answer

Grant the auditor's IAM role permission to use the KMS key.

Question 3

A data engineer needs to grant an IAM user the ability to view Amazon CloudWatch Logs log groups and stream log events from a specific log group. Which IAM policy action should be used?

Accepted Answer

logs:DescribeLogGroups and logs:GetLogEvents. Logs:DescribeLogGroups and logs:GetLogEvents are the required actions. Option B is wrong because logs:PutLogEvents is for writing. Option C is wrong because logs:CreateLogGroup is for creation. Option D is wrong because logs:DeleteLogGroup is for deletion.

Answer

logs:PutLogEvents

Answer

logs:CreateLogGroup

Answer

logs:DeleteLogGroup

Question 4

Refer to the exhibit. A data engineer creates this KMS key policy. An IAM role in account 123456789012 is granted decrypt access to the key. However, when the DataAnalystRole tries to decrypt an S3 object encrypted with this key, the operation fails. What is the most likely reason?

Accepted Answer

The S3 bucket policy does not allow the role to call s3:GetObject. KMS key policies grant access to principals. However, if the S3 bucket policy does not allow the role to call kms:Decrypt, the combination of policies might still deny. But the key policy itself grants decrypt. A common issue is that the S3 bucket policy might not allow the s3:GetObject action, or the role might not have S3 permissions. Another possibility is that the KMS key is in a different region (us-east-1) but the S3 object is in another region, causing cross-region access which is not allowed by default. However, the most likely reason based on typical exam scenarios is that the S3 bucket policy does not grant the necessary S3 permissions.

Answer

The KMS key is in a different region than the S3 bucket

Answer

The role does not have permission to call kms:DescribeKey

Answer

The KMS key policy does not grant kms:Decrypt permission to the role

Question 5

A company uses AWS KMS to encrypt data in Amazon S3. The security team wants to ensure that the KMS key can only be used from within the company's VPC. Which policy element should be added to the KMS key policy?

Accepted Answer

Add a condition using aws:SourceVpc to allow only requests from the VPC.. Using a condition with aws:SourceVpc restricts key usage to requests originating from a specific VPC. Option A is wrong because the Principal element specifies who can use the key, not where. Option B is wrong because aws:SourceIp is for IP addresses, not VPC. Option D is wrong because kms:ViaService restricts usage to specific AWS services, not network location.

Answer

Set the Principal element to restrict access to the VPC.

Answer

Add a condition using aws:SourceIp to allow only IP addresses from the VPC.

Answer

Add a condition using kms:ViaService to allow only via VPC endpoints.

Question 6

A company stores sensitive data in Amazon S3. The security team requires that all data be encrypted at rest and that the encryption keys be stored in AWS CloudHSM. Which S3 encryption option should be used?

Accepted Answer

SSE-C. SSE-C allows customers to provide their own encryption keys, which can be stored in CloudHSM. SSE-S3 and SSE-KMS use AWS-managed keys or KMS keys, not CloudHSM. Option D is correct.

Answer

SSE-S3

Answer

SSE-KMS with an AWS managed key

Answer

SSE-KMS with a customer managed key

Question 7

A data engineer is troubleshooting an Amazon Redshift cluster that is unable to access an S3 bucket for COPY operations. The cluster has an IAM role attached. Which of the following could be causing the failure? (Choose TWO.)

Accepted Answer

The S3 bucket policy denies access to the IAM role. Options B and D are correct. The IAM role must have permission to the S3 bucket, and the bucket policy must allow the role. Option A is wrong because VPC security groups control network traffic, not S3 access. Option C is wrong because encryption is not required for COPY. Option E is wrong because Redshift does not need KMS permissions unless using SSE-KMS.

Answer

The VPC security group does not allow outbound HTTPS traffic

Answer

The S3 bucket has default encryption enabled

Answer

The KMS key used for encryption is not shared with Redshift

Question 8

A company uses AWS Glue to process sensitive data. The security team requires that all data in transit between Glue and Amazon S3 be encrypted using TLS 1.2 or higher. Which configuration ensures this requirement is met?

Accepted Answer

Add a bucket policy that denies access unless aws:SecureTransport is true. S3 bucket policies can enforce aws:SecureTransport to require HTTPS. Glue by default uses HTTPS when accessing S3, but to enforce it, the bucket policy must deny requests without SecureTransport. Option A is wrong because VPC endpoints enforce private connectivity but not necessarily TLS version. Option B is wrong because S3 Block Public Access does not affect encryption in transit. Option D is wrong because KMS is for at-rest encryption. Option C is correct.

Answer

Configure a VPC endpoint for S3 and enable private DNS

Answer

Enable S3 Block Public Access at the bucket level

Answer

Use SSE-KMS encryption on the S3 bucket

Question 9

A data engineer notices that an Amazon Athena query on a partitioned table in S3 scans more data than expected. The table is partitioned by year, month, day. The query includes a WHERE clause on a non-partition column but also filters on day='2023-01-01'. What is the most likely cause of the excessive data scan?

Accepted Answer

The partition column data type in the table definition does not match the actual partition folder names. The most likely cause is that the partition column data type in the table definition does not match the actual partition folder names. Athena uses the folder names to determine which partitions to scan (partition pruning). If the data type mismatch causes Athena to be unable to correctly interpret the folder names, partition pruning fails, and Athena scans all partitions, leading to excessive data scan. Option A is incorrect because JSON format does not prevent partition pruning; it may affect compression but not pruning. Option B is incorrect because the WHERE clause filters on a non-partition column, but it also filters on the partition column 'day', so partition pruning should work if the column data type matches. Option D is incorrect because sorting within partitions does not affect scan size; it affects query performance but not the amount of data scanned.

Answer

The data is stored in JSON format instead of Parquet

Answer

The table is not partitioned by the column used in the WHERE clause

Answer

The data is not sorted within partitions

Question 10

A data engineer is setting up an Amazon Redshift cluster. Which TWO measures can be taken to secure the data at rest?

Accepted Answer

Enable encryption on the Redshift cluster using AWS KMS. Redshift supports encryption at rest using KMS or HSM. Cluster encryption can be enabled at launch. Client-side encryption before loading protects data before it reaches Redshift, but not necessarily at rest. VPC security groups control network access. IAM roles control who can access the cluster.

Answer

Encrypt data on the client side before loading into Redshift

Answer

Enable AWS IAM database authentication

Answer

Use VPC security groups to restrict network access

Question 11

A company is using Amazon S3 to store sensitive data. The security team requires that all objects be encrypted using server-side encryption with AWS KMS (SSE-KMS) and that the bucket policy denies any PutObject request that does not include the required encryption header. Which bucket policy condition should be added?

Accepted Answer

s3:x-amz-server-side-encryption-aws-kms-key-id. S3:x-amz-server-side-encryption-aws-kms-key-id can be used to enforce a specific KMS key. Option B is wrong because s3:x-amz-server-side-encryption only enforces SSE-S3 or SSE-KMS, not a specific key. Option C is wrong because kms:EncryptionContext is for KMS, not S3. Option D is wrong because aws:SecureTransport is for in-transit encryption.

Answer

s3:x-amz-server-side-encryption

Answer

kms:EncryptionContext

Answer

aws:SecureTransport

Question 12

A data engineer runs an AWS Glue ETL job that reads from a table in the AWS Glue Data Catalog. The job fails with the error shown. The IAM role used by the Glue job has the following policy attached:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "glue:GetTable",
                "glue:GetDatabase"
            ],
            "Resource": "*"
        }
    ]
}

What should be added to the IAM role's policy to resolve the error?

Accepted Answer

lakeformation:GetDataAccess on the table resource. Lake Formation requires lakeformation:GetDataAccess permission on the table. Option A is wrong because the error is about Lake Formation, not S3. Option B is wrong because the role already has glue:GetTable. Option D is wrong because kms:Decrypt is not indicated.

Answer

s3:GetObject on the underlying S3 bucket

Answer

glue:GetTable on the specific table resource

Answer

kms:Decrypt on the KMS key

Question 13

A financial services company uses a multi-account AWS Organization with hundreds of accounts. The data engineering team needs to enable cross-account access to an encrypted S3 bucket in the data lake account (account ID 111111111111) for a Glue ETL job running in the analytics account (account ID 222222222222). The S3 bucket uses AWS KMS customer managed key (CMK) for server-side encryption (SSE-KMS). The Glue job fails with an AccessDenied error when trying to read data from the bucket. The IAM roles in both accounts have the necessary S3 permissions and the bucket policy allows access from the analytics account. What is the most likely cause of the failure?

Accepted Answer

The KMS key policy does not grant the analytics account's IAM role permission to use the key for decryption.. The Glue job fails because the KMS key policy does not grant the analytics account's IAM role permission to use the key for decryption. S3 permissions alone are insufficient when SSE-KMS is used; the key policy must explicitly allow the decrypt action for the cross-account principal.

Answer

The S3 bucket is in a different region than the Glue job.

Answer

The Glue job does not have an IAM role assigned.

Answer

The S3 bucket policy does not allow the s3:GetObject action for the analytics account's IAM role.

Question 14

A data engineer is setting up an Amazon RDS for MySQL database. The compliance team requires that all data at rest be encrypted. What must the engineer do to enable encryption for this database?

Accepted Answer

Specify an AWS KMS key when launching the DB instance. Encryption at rest for Amazon RDS can only be enabled at launch time. After creation, you cannot enable encryption; you must create a new encrypted instance and migrate data.

Answer

Enable encryption after the DB instance is created by modifying the DB instance

Answer

Use AWS Secrets Manager to store the encryption key and attach it to the DB instance

Answer

Encrypt the underlying EBS volumes after the instance is created

Question 15

A company uses Amazon S3 to store log files. The security team notices that some objects are being accessed from an unexpected AWS account. The data engineer needs to identify which specific IAM user or role is accessing the objects. Which AWS service should be used to get this information?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records API calls including S3 object-level operations. It logs who made the call, from which account, and other details. S3 server access logs provide similar info but are log files themselves, not a queryable service. Config is for resource configuration tracking. Trusted Advisor gives best practice checks.

Answer

AWS Trusted Advisor

Answer

Amazon S3 server access logs

Answer

AWS Config

Question 16

A company uses AWS Glue to process data. The security team requires that all data in transit between AWS Glue and Amazon S3 be encrypted using TLS. Which configuration should be used?

Accepted Answer

Enable S3 server-side encryption and use HTTPS endpoints. AWS Glue uses TLS for data in transit by default. Option B is wrong because S3 default encryption is for at-rest. Option C is wrong because VPC endpoints use AWS PrivateLink but don't enforce encryption. Option D is wrong because it's not required for TLS.

Answer

Configure a bucket policy to require aws:SecureTransport

Answer

Enable default encryption on the S3 bucket using SSE-KMS

Answer

Use an S3 VPC endpoint

Question 17

A data engineer needs to ensure that an Amazon S3 bucket containing sensitive customer data is encrypted at rest. Which AWS service can be used to manage the encryption keys?

Accepted Answer

AWS Key Management Service (KMS). AWS KMS is the service for managing encryption keys. S3 SSE-S3 uses S3-managed keys, while SSE-C uses customer-provided keys. CloudHSM is a hardware security module but not directly used for S3 encryption key management.

Answer

AWS Certificate Manager

Answer

AWS Secrets Manager

Answer

AWS CloudHSM

Question 18

A data engineer needs to encrypt data in transit between an Amazon RDS for MySQL instance and an application. Which solution should be used?

Accepted Answer

Use SSL/TLS to connect to the RDS instance. SSL/TLS is used to encrypt data in transit between clients and RDS. Option A is wrong because KMS encrypts data at rest, not in transit. Option C is wrong because S3 is not involved in this scenario. Option D is wrong because CloudHSM provides hardware security modules for key storage, not encryption in transit.

Answer

Enable encryption at rest using AWS KMS

Answer

Store the data in Amazon S3 with server-side encryption

Answer

Use AWS CloudHSM to generate and store encryption keys

Question 19

A company has an S3 bucket that stores logs for compliance. The compliance team requires that objects are retained for 7 years and cannot be deleted or overwritten. Which S3 feature should be used?

Accepted Answer

Enable S3 Object Lock with retention mode COMPLIANCE and a retention period of 7 years. S3 Object Lock with retention mode COMPLIANCE prevents objects from being deleted or overwritten for the specified retention period. Versioning alone does not prevent deletion. MFA Delete prevents accidental deletion but not overwrite. Lifecycle policies can expire objects but do not prevent deletion.

Answer

Enable MFA Delete on the bucket

Answer

Configure an S3 bucket policy that denies delete and overwrite actions

Answer

Enable S3 Versioning and configure a lifecycle policy to expire objects after 7 years

Question 20

A data engineer runs a weekly AWS Glue ETL job that processes data from Amazon DynamoDB to Amazon S3. The job reads the entire table every time, which is slow and expensive. The job needs to process only items that changed since the last run. Which solution should the engineer implement?

Accepted Answer

Enable DynamoDB Streams and process change events with AWS Lambda to write to S3. DynamoDB Streams captures item-level changes (inserts, updates, deletes) in near real-time. An AWS Lambda function can process these change events and write only the incremental data to Amazon S3, eliminating the need to scan the entire DynamoDB table. This approach is both cost-effective and efficient for incremental data ingestion.

Answer

Use DynamoDB Scan with a LastEvaluatedKey to paginate and store the last scanned key to resume next time

Answer

Add a Global Secondary Index (GSI) on a timestamp attribute and query only new records

Answer

Use AWS Database Migration Service (DMS) with ongoing replication from DynamoDB to S3