DEA-C01 Data Security and Governance — 15 Questions

Question 1

A data engineer needs to ensure that all data in an S3 bucket is encrypted at rest. The bucket currently contains unencrypted objects from past uploads. Which action will encrypt these existing objects without re-uploading them?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use S3 Batch Operations with an encryption job. S3 Batch Operations can apply server-side encryption to existing objects in a bucket, including those that are currently unencrypted. Option A is incorrect because a bucket policy can require encryption for new uploads but does not retroactively encrypt existing objects. Option B is incorrect because default encryption only applies to new objects uploaded after the setting is enabled. Option C is incorrect because the S3 console does not provide a built-in feature to batch-encrypt existing objects across a bucket.

Answer

Attach a bucket policy requiring SSE-S3

Answer

Enable default encryption on the bucket

Answer

Use the S3 console to select all objects and apply encryption

Question 2

A company needs to share a dataset stored in an S3 bucket with a partner account. The dataset contains sensitive information, so the company wants to ensure that the partner account can only access the data using a specific VPC endpoint in the partner's account. Which S3 bucket policy condition key should be used?

Accepted Answer

aws:SourceVpce. The aws:SourceVpce condition key restricts access to a specific VPC endpoint, ensuring the partner can only access the data through that endpoint. Option A is wrong because aws:SourceVpc restricts to a VPC, not a VPC endpoint. Option B is wrong because aws:SourceArn restricts to a resource ARN, not a network endpoint. Option C is wrong because aws:SourceIp restricts to an IP address, which does not meet the requirement.

Answer

aws:SourceVpc

Answer

aws:SourceArn

Answer

aws:SourceIp

Question 3

A data engineer needs to share a dataset from an S3 bucket in Account A with another AWS account (Account B). The data must remain encrypted at rest with KMS. Which steps are required?

Accepted Answer

Update the S3 bucket policy and the KMS key policy to allow Account B. The correct steps are to update both the S3 bucket policy to grant Account B access to the objects and the KMS key policy to grant Account B the necessary decrypt permissions. Option A is insufficient because it only updates the KMS key policy; the bucket policy must also be updated to allow Account B's access to the S3 objects. Option B is also insufficient because creating an IAM role alone does not grant KMS decrypt permissions; the KMS key policy must be updated. Option C is correct as it includes both. Option D is insufficient because it only updates the bucket policy, not the KMS key policy.

Answer

Update the KMS key policy to allow Account B's root user

Answer

Create an IAM role in Account A and grant cross-account access

Answer

Update the S3 bucket policy to allow Account B's root user

Question 4

A company has a requirement to store audit logs for 7 years for compliance. The logs are stored in S3 and must be immutable. Which S3 feature should be used?

Accepted Answer

Enable S3 Object Lock in compliance mode. S3 Object Lock in compliance mode prevents objects from being deleted or overwritten for a specified retention period, ensuring immutability for compliance. Option A is wrong because a bucket policy denying s3:DeleteObject does not prevent overwrites or other actions that could modify the object. Option B is wrong because MFA Delete adds a protection layer but can be bypassed by the root user and does not prevent overwrites. Option C is wrong because versioning and lifecycle policies do not inherently prevent deletion or overwrite of all versions; they only manage object versions and transitions. Option D is correct.

Answer

Use a bucket policy that denies s3:DeleteObject

Answer

Enable MFA Delete on the bucket

Answer

Enable S3 Versioning and set a lifecycle policy

Question 5

A company is using AWS Glue to process data stored in an S3 bucket that is encrypted with SSE-KMS. The Glue job fails with an 'Access Denied' error when trying to read the data. The IAM role used by the Glue job has permissions to read from the S3 bucket and to use the KMS key. What is the most likely cause of the failure?

Accepted Answer

The S3 bucket policy denies access to the Glue job. Although the IAM role has permissions to read from the S3 bucket and to use the KMS key, the S3 bucket policy might explicitly deny access to the Glue job. Bucket policies can override IAM permissions. The 'Access Denied' error often occurs when a bucket policy denies access even if the IAM role is authorized. Option A is incorrect because the bucket uses SSE-KMS as stated. Option C is possible but not necessarily the most likely without cross-account context. Option D is incorrect because the premise states the role has permissions to use the KMS key, which includes kms:Decrypt.

Answer

The S3 bucket is using SSE-S3 instead of SSE-KMS

Answer

The KMS key is in a different AWS account

Answer

The IAM role is missing the kms:Decrypt permission

Question 6

A company wants to monitor and alert on any IAM user creation in their AWS account. Which THREE services should be used together to achieve this? (Choose three.)

Accepted Answer

AWS CloudTrail. AWS CloudTrail (option B) captures API calls such as IAM user creation. CloudWatch Logs (option C) stores those logs, enabling monitoring and alerting. Amazon CloudWatch Events (EventBridge) (option D) can create rules to trigger notifications or actions when specific API calls occur. Amazon SNS (option A) is a notification service but does not capture API calls. AWS Config (option E) assesses configuration compliance, not API activity.

Answer

Amazon Simple Notification Service (SNS)

Answer

AWS Config

Question 7

Which TWO AWS services can be used to protect sensitive data stored in Amazon S3 by preventing accidental public access? (Choose two.)

Accepted Answer

AWS Trusted Advisor. Amazon S3 Block Public Access (option D) is a service that blocks public access at the bucket or account level. AWS Trusted Advisor (option C) has a check for S3 bucket permissions that can identify publicly accessible buckets. Option A is for network security, not S3. Option B is for malware protection. Option E is for encryption at rest, not public access prevention.

Answer

AWS WAF

Answer

Amazon GuardDuty

Answer

AWS Key Management Service (KMS)

Question 8

A company runs a data lake on AWS using S3 for storage and AWS Glue for ETL. The security team discovers that a contractor who left the company two months ago still has access to an S3 bucket containing sensitive data. The access was granted via an IAM user that was not deleted. The data engineer is asked to implement a solution to prevent future occurrences. The company uses AWS Organizations and has multiple accounts. The requirement is to automatically detect and remediate IAM users that have not been used for 90 days by disabling their access keys and notifying the security team. The solution must be least privilege and use AWS-native services. Which approach should the data engineer take?

Accepted Answer

Use AWS IAM Access Analyzer to generate findings for unused access and create an AWS Config custom rule with a Lambda function that automatically disables the access keys and sends a notification via SNS.. AWS IAM Access Analyzer can generate findings for unused access, and AWS Config with a custom rule can auto-remediate by invoking a Lambda function to disable keys and notify via SNS. Option A is incorrect because AWS Config managed rules cannot automatically disable access keys; they only evaluate compliance and require manual action or a custom rule with remediation. Option B is incorrect because CloudTrail and CloudWatch alarms do not automatically disable keys; they only notify for manual intervention. Option C is incorrect because Lake Formation is used for fine-grained access control on data lakes, not for managing IAM users or disabling access keys.

Answer

Use AWS IAM Access Analyzer to generate findings for unused access and create an AWS Config managed rule to automatically disable the IAM user's access keys.

Answer

Use AWS CloudTrail to monitor IAM user activity and set up a CloudWatch alarm that triggers an SNS notification to the security team to manually disable the keys.

Answer

Use AWS Lake Formation to revoke the permissions of the IAM user and set up a scheduled Lambda function to check for unused IAM users.

Question 9

A company uses Amazon DynamoDB with encryption at rest using an AWS managed KMS key. The security team requires that the encryption key be rotated every 90 days. What should the data engineer do to meet this requirement?

Accepted Answer

Use a customer managed KMS key and configure automatic rotation. AWS managed keys (used with DynamoDB encryption at rest by default) are automatically rotated every three years, but this rotation schedule cannot be changed. To meet a 90-day rotation requirement, the company must switch to using a customer managed KMS key, which allows them to enable automatic rotation (though automatic rotation is yearly) or manually rotate the key as needed. Option A is incorrect because AWS CloudHSM provides hardware-based key storage but does not directly integrate with DynamoDB's encryption at rest in a way that allows the required rotation schedule. Option B is incorrect because AWS managed keys cannot be rotated on demand via Lambda; the rotation policy is controlled by AWS. Option C is incorrect because DynamoDB does not support custom encryption contexts; encryption contexts are used with KMS to add additional authenticated data, but they do not trigger key rotation.

Answer

Switch to AWS CloudHSM to manage the encryption key

Answer

Create a scheduled AWS Lambda function to rotate the AWS managed key

Answer

Enable a custom encryption context in DynamoDB to trigger rotation

Question 10

A data engineer needs to restrict access to an S3 bucket so that only users from a specific AWS account can read objects. Which S3 bucket policy element should be used?

Accepted Answer

Principal. The Principal element in an S3 bucket policy specifies the AWS account, user, or role that the policy applies to. By setting the Principal to a specific AWS account ID, only users from that account can read objects. Option A is wrong because the Action element specifies the allowed or denied operations (e.g., s3:GetObject), not the account. Option C is wrong because the Resource element identifies the bucket or objects, not the requester. Option D is wrong because the Condition element adds additional constraints (e.g., IP address), but it is not the primary element for specifying the allowed account; Principal is the correct element for that purpose.

Answer

Action

Answer

Resource

Answer

Condition

Question 11

A data engineer is troubleshooting an AWS Glue ETL job that fails with an access denied error when writing to an S3 bucket. The Glue job uses an IAM role that has an S3 bucket policy attached. The bucket policy denies access to any principal that does not use server-side encryption. What is the most likely cause of the failure?

Accepted Answer

The Glue job is not using server-side encryption when writing to S3.. If the Glue job does not set the encryption header (or the role does not have the kms:GenerateDataKey permission for SSE-KMS), the bucket policy will deny the request. Option A is wrong because Glue requires permissions on the S3 bucket and KMS key. Option B is wrong because VPC endpoints do not cause access denied errors for encryption. Option D is wrong because S3 Block Public Access does not deny write access to authorized roles.

Answer

The VPC endpoint policy for S3 is too restrictive.

Answer

The IAM role does not have s3:PutObject permission.

Answer

The S3 bucket uses S3 Block Public Access which denies all writes.

Question 12

A data engineer is designing a data lake on S3 that must be encrypted at rest using customer-managed keys in AWS KMS. The security team requires that the key be used only for S3 operations and that the key be rotated every 180 days. Which solution meets these requirements?

Accepted Answer

Create a customer managed key with a key policy that grants usage only to S3, and enable automatic rotation with a 180-day period.. Customer managed keys (CMKs) in AWS KMS allow you to set a key policy that restricts the key's usage to S3 operations, and you can enable automatic key rotation with a custom period of 180 days (the minimum is 90 days, but 180 is supported as a custom rotation period using AWS KMS automatic rotation or by creating a custom rotation schedule). Option B is incorrect because AWS managed keys (aws/s3) rotate automatically every year (365 days), not 180 days, and you cannot customize the rotation period. Option C is incorrect because S3 bucket policies can enforce SSE-KMS, but CloudHSM keys are not directly integrated with S3; CloudHSM is used with custom key stores, but those do not support automatic rotation. Option D is incorrect because custom key stores backed by CloudHSM do not support automatic key rotation, and manual rotation does not meet the requirement for automatic rotation every 180 days.

Answer

Use an AWS managed key (aws/s3) and enable automatic rotation.

Answer

Use an S3 bucket policy to enforce SSE-KMS with a CloudHSM key.

Answer

Use a custom key store backed by CloudHSM and rotate the key manually.

Question 13

A company uses AWS Glue to process sensitive data stored in S3. The security team requires that all data be encrypted at rest using customer-managed KMS keys. The data engineers are encountering 'Access Denied' errors when running Glue ETL jobs. What is the most likely cause?

Accepted Answer

The Glue service role does not have kms:Decrypt and kms:Encrypt permissions for the KMS key.. Glue service role must have kms:Decrypt and kms:Encrypt permissions for the KMS key to read/write encrypted data from S3. Option B is incorrect because S3 bucket policies can restrict access but the error is likely due to missing KMS permissions. Option C is incorrect because KMS key policies or IAM policies can grant access to Glue role. Option D is incorrect because the issue is not about cross-account access.

Answer

The KMS key policy does not allow the AWS Glue service to use the key.

Answer

The Glue Data Catalog is encrypted with a different KMS key.

Answer

The S3 bucket policy denies access to the Glue service role.

Question 14

A company has an AWS Glue ETL job that reads data from an S3 bucket, transforms it, and writes to another S3 bucket. The security team requires that data in transit between the Glue job and S3 be encrypted using TLS. The Glue job runs in a VPC with a VPC endpoint for S3. Which configuration ensures TLS encryption for all data transfer?

Accepted Answer

Use an S3 Gateway Endpoint and ensure the Glue job uses HTTPS.. An S3 Gateway Endpoint uses HTTPS by default, ensuring TLS encryption for data in transit between the Glue job and S3. Option A is wrong because using HTTP would transmit data unencrypted. Option B is wrong because disabling TLS removes encryption in transit. Option D is wrong because SSE-KMS encrypts data at rest in S3, not in transit.

Answer

Use an S3 Gateway Endpoint and ensure the Glue job uses HTTP instead of HTTPS.

Answer

Use an S3 Interface Endpoint and disable TLS.

Answer

Enable SSE-KMS encryption on both source and destination S3 buckets.

Question 15

A data engineering team uses AWS Lambda functions to process streaming data from Amazon Kinesis Data Streams and write the results to an S3 bucket. The S3 bucket is encrypted with SSE-KMS using a customer-managed key (CMK). The Lambda function's IAM role has permissions for kms:Decrypt and kms:GenerateDataKey on the CMK. However, the Lambda function fails with an 'Access Denied' error when writing to S3. The S3 bucket policy allows s3:PutObject from the Lambda function's IAM role. What is the most likely cause?

Accepted Answer

The S3 bucket policy denies s3:PutObject from the Lambda function.. The most likely cause is that the S3 bucket policy denies s3:PutObject from the Lambda function's IAM role. Even though the stem states the policy allows, there could be an explicit deny statement that overrides, resulting in an 'Access Denied' error. The Lambda function's IAM role has the necessary KMS permissions (kms:GenerateDataKey and kms:Decrypt) for SSE-KMS writes, so missing kms:Encrypt is not the issue. Option A is incorrect because invocation permissions are unrelated. Option B is incorrect because kms:Encrypt is not required for SSE-KMS writes. Option D is incorrect because Kinesis stream encryption is unrelated.

Answer

The Lambda function's execution role does not have permission to invoke the function.

Answer

The Lambda function's IAM role is missing the kms:Encrypt permission on the CMK.

Answer

The Kinesis data stream is not encrypted, causing the Lambda function to fail.