DEA-C01 Data Security and Governance — 10 Questions

Question 1

A data engineer needs to ensure that an Amazon S3 bucket used for sensitive data is encrypted at rest using a customer-managed AWS KMS key. The bucket policy must enforce encryption for all PUT requests. Which policy statement should be added to the bucket policy?

Accepted Answer

{"Effect":"Deny","Principal":"*","Action":"s3:PutObject","Resource":"arn:aws:s3:::bucket/*","Condition":{"StringNotEquals":{"s3:x-amz-server-side-encryption":"aws:kms"},"Null":{"s3:x-amz-server-side-encryption-aws-kms-key-id":"true"}}}. Option C is correct because it uses a Deny effect with a condition that blocks PUT requests unless the encryption header specifies 'aws:kms' (SSE-KMS) AND the KMS key ID matches the required customer-managed key. The combination of StringNotEquals on the encryption type and Null on the key ID ensures that any request not using the specified KMS key is denied, enforcing both encryption at rest and the use of the customer-managed key.

Answer

{"Effect":"Deny","Principal":"*","Action":"s3:PutObject","Resource":"arn:aws:s3:::bucket/*","Condition":{"Null":{"s3:x-amz-server-side-encryption":"true"}}}

Answer

{"Effect":"Allow","Principal":"*","Action":"s3:PutObject","Resource":"arn:aws:s3:::bucket/*","Condition":{"StringEquals":{"s3:x-amz-server-side-encryption-aws-kms-key-id":"arn:aws:kms:us-east-1:123456789012:key/abc123"}}}

Answer

{"Effect":"Deny","Principal":"*","Action":"s3:PutObject","Resource":"arn:aws:s3:::bucket/*","Condition":{"StringNotEquals":{"s3:x-amz-server-side-encryption-aws-kms-key-id":"arn:aws:kms:us-east-1:123456789012:key/abc123"}}}

Question 2

A company uses AWS Glue to process sensitive data stored in Amazon S3. The security team requires that all data in transit between AWS Glue and S3 be encrypted. Which configuration should be used to meet this requirement?

Accepted Answer

Use an S3 bucket policy that denies requests not using HTTPS.. Option A is correct because requiring HTTPS for all requests to the S3 bucket ensures that data in transit between AWS Glue and S3 is encrypted using TLS. By using an S3 bucket policy with a condition that denies requests where `aws:SecureTransport` is false, the company enforces encryption for all connections, including those from AWS Glue. This meets the security requirement without needing to modify Glue or S3 configurations beyond the bucket policy.

Answer

Use an AWS KMS key to encrypt the data before uploading to S3.

Answer

Configure AWS Glue to use SSL by setting the 'ssl' parameter to 'true'.

Answer

Enable default encryption on the S3 bucket using SSE-S3.

Question 3

A data engineer is troubleshooting an AWS Lake Formation permissions issue. A user is able to query an Amazon Athena table but cannot see the underlying S3 data in the AWS Glue Data Catalog. The user has been granted SELECT permission on the table in Lake Formation. What is the most likely cause?

Accepted Answer

The user does not have DESCRIBE permission on the table in Lake Formation.. In AWS Lake Formation, the ability to query a table via Athena (which requires SELECT permission) is separate from the ability to view the table's metadata in the Glue Data Catalog. To see the underlying S3 data location or table properties in the catalog, a user needs DESCRIBE permission on the table. Without DESCRIBE, the table appears invisible in the Glue console or API, even though SELECT queries succeed.

Answer

The data location is not registered with Lake Formation.

Answer

The S3 bucket policy does not grant the user access.

Answer

The user does not have the aws:SourceArn condition in the IAM policy.

Question 4

A company uses Amazon Redshift to store customer data. The security team requires that all queries are logged for auditing purposes. Which combination of steps should be taken to meet this requirement? (Select TWO.)

Accepted Answer

Use AWS CloudTrail to log Redshift API calls.. Option B is correct because AWS CloudTrail can be configured to log Redshift API calls, such as CreateCluster, DeleteCluster, and ModifyCluster, which provides an audit trail of administrative actions. Option E is correct because Amazon Redshift supports native audit logging, including connection logs, user activity logs, and query logs, which can be exported to an Amazon S3 bucket for long-term retention and analysis.

Answer

Enable AWS CloudTrail database audit logging.

Answer

Enable logging on the Redshift security group.

Answer

Enable VPC Flow Logs for the Redshift cluster.

Question 5

A company is designing a data lake on Amazon S3. The security policy requires that all data be encrypted at rest using AWS KMS with automatic key rotation. Which encryption option meets these requirements? (Select THREE.)

Accepted Answer

Enable automatic key rotation on the KMS key.. Option A is correct because AWS KMS customer-managed keys (CMKs) support automatic key rotation, which can be enabled to rotate the key material annually. This satisfies the security policy requirement for automatic key rotation. SSE-KMS with a CMK (Option D) is also required because AWS managed keys (Option B) do not support automatic key rotation, and SSE-C (Option E) does not use KMS at all. Setting default encryption on the S3 bucket to SSE-KMS with the CMK (Option C) ensures all objects are encrypted with that key, meeting the encryption-at-rest requirement.

Answer

Use SSE-KMS with an AWS managed key.

Answer

Use SSE-C with a customer-provided key.

Question 6

Refer to the exhibit. A data engineer is running an AWS Glue job that reads from an S3 bucket encrypted with a customer-managed KMS key. The job fails with the error shown. What is the most likely cause?

Accepted Answer

The IAM role used by the Glue job is missing the kms:Decrypt permission.. The error indicates that the AWS Glue job cannot access the S3 bucket because it lacks the necessary KMS permissions. Since the bucket is encrypted with a customer-managed KMS key, the IAM role assigned to the Glue job must include the kms:Decrypt permission to read the encrypted objects. Without this permission, the job fails when attempting to decrypt the data.

Answer

The S3 bucket policy denies the kms:Decrypt action.

Answer

The Glue job does not have permission to call kms:GenerateDataKey.

Answer

The KMS key policy does not grant the Glue service principal access.

Question 7

Refer to the exhibit. A security analyst is reviewing CloudTrail logs and notices a PutObject event to the 'company-data-lake' bucket. The bucket policy requires all objects to be encrypted with SSE-KMS. What should the analyst conclude?

Accepted Answer

The object was encrypted with SSE-S3, which violates the bucket policy.. The bucket policy requires all objects to be encrypted with SSE-KMS. The CloudTrail log shows a PutObject event, but the encryption context (not shown in the exhibit) would indicate the encryption method used. Since the correct answer states the object was encrypted with SSE-S3, this violates the bucket policy, which mandates SSE-KMS. Therefore, the analyst should conclude that the request succeeded but violated the policy, as SSE-S3 does not meet the requirement.

Answer

The object was uploaded by the bucket owner, bypassing the policy.

Answer

The request succeeded because SSE-S3 is acceptable.

Answer

The object was encrypted with SSE-KMS as required.

Question 8

A company is using Amazon Redshift Spectrum to query data in Amazon S3. The S3 bucket uses SSE-KMS encryption. The Redshift cluster has an IAM role that allows access to S3 and KMS. However, queries fail with an 'Access Denied' error. What is the most likely cause?

Accepted Answer

The external schema does not have the IAM role specified.. When using Redshift Spectrum with SSE-KMS encrypted data in S3, the IAM role must be explicitly associated with the external schema via the `CREATE EXTERNAL SCHEMA` command using the `IAM_ROLE` parameter. Even if the cluster has the IAM role attached, Spectrum queries fail with 'Access Denied' if the role is not specified at the schema level, because Redshift needs to pass that role to S3 and KMS for each query execution. Option B correctly identifies this missing configuration as the most likely cause.

Answer

The Redshift cluster does not have the IAM role attached.

Answer

The IAM role does not have the kms:Decrypt permission.

Answer

The external table is not defined in the schema.

Question 9

A company is using Amazon EMR to process data stored in Amazon S3. The S3 bucket is configured with a bucket policy that denies access unless the request includes a specific tag. The EMR cluster's IAM role has s3:GetObject permission. However, the EMR job fails to read data from S3. What is the most likely cause?

Accepted Answer

The IAM role does not have a condition that matches the required tag.. The bucket policy denies access unless the request includes a specific tag. Even though the EMR cluster's IAM role has s3:GetObject permission, the IAM role does not have a condition key (e.g., aws:RequestTag) that matches the required tag. Therefore, the request is denied by the bucket policy, causing the EMR job to fail.

Answer

The bucket policy is not attached to the EMR role.

Answer

The EMR cluster is not in the same account as the S3 bucket.

Answer

The EMR role does not have s3:GetObject permission.

Question 10

A company uses AWS Lake Formation to manage data lake permissions. The data lake contains sensitive customer data in the 'customer' database. The security team wants to ensure that only users with a specific tag 'access_level=analyst' can query the 'customer' table. Which combination of steps should the data engineer take to enforce this?

Accepted Answer

In Lake Formation, create an LF-tag 'access_level' with values 'analyst' and 'admin'. Grant 'SELECT' permission on the 'customer' table to the tag value 'analyst'. Associate the LF-tag with the 'customer' table.. Option A is correct because Lake Formation LF-tags allow you to define metadata tags (key-value pairs) and grant permissions to those tags. By creating an LF-tag 'access_level' with values 'analyst' and 'admin', granting SELECT on the 'customer' table to the tag value 'analyst', and associating that LF-tag with the table, only principals who have the tag 'access_level=analyst' (or are granted via the tag) can query the table. This enforces tag-based access control at the Lake Formation permission layer, which is the intended mechanism for fine-grained, attribute-based access control in Lake Formation.

Answer

Create an IAM policy that conditionally allows 'glue:GetTable' based on the tag 'access_level=analyst'.

Answer

Apply a bucket policy on the S3 location of the 'customer' table that allows access only if the request carries the tag 'access_level=analyst'.

Answer

Use Lake Formation column-level filters to restrict access to columns based on the tag 'access_level=analyst'.