DEA-C01 Data Security and Governance — 20 Questions

Question 1

A data engineer needs to ensure that an Amazon S3 bucket used for sensitive data is encrypted at rest using a customer-managed AWS KMS key. The bucket policy must enforce encryption for all PUT requests. Which policy statement should be added to the bucket policy?

Accepted Answer

{"Effect":"Deny","Principal":"*","Action":"s3:PutObject","Resource":"arn:aws:s3:::bucket/*","Condition":{"StringNotEquals":{"s3:x-amz-server-side-encryption":"aws:kms"},"Null":{"s3:x-amz-server-side-encryption-aws-kms-key-id":"true"}}}. Option C is correct because it uses a Deny effect with a condition that blocks PUT requests unless the encryption header specifies 'aws:kms' (SSE-KMS) AND the KMS key ID matches the required customer-managed key. The combination of StringNotEquals on the encryption type and Null on the key ID ensures that any request not using the specified KMS key is denied, enforcing both encryption at rest and the use of the customer-managed key.

Answer

{"Effect":"Deny","Principal":"*","Action":"s3:PutObject","Resource":"arn:aws:s3:::bucket/*","Condition":{"Null":{"s3:x-amz-server-side-encryption":"true"}}}

Answer

{"Effect":"Allow","Principal":"*","Action":"s3:PutObject","Resource":"arn:aws:s3:::bucket/*","Condition":{"StringEquals":{"s3:x-amz-server-side-encryption-aws-kms-key-id":"arn:aws:kms:us-east-1:123456789012:key/abc123"}}}

Answer

{"Effect":"Deny","Principal":"*","Action":"s3:PutObject","Resource":"arn:aws:s3:::bucket/*","Condition":{"StringNotEquals":{"s3:x-amz-server-side-encryption-aws-kms-key-id":"arn:aws:kms:us-east-1:123456789012:key/abc123"}}}

Question 2

A company uses AWS Glue to process sensitive data stored in Amazon S3. The security team requires that all data in transit between AWS Glue and S3 be encrypted. Which configuration should be used to meet this requirement?

Accepted Answer

Use an S3 bucket policy that denies requests not using HTTPS.. Option A is correct because requiring HTTPS for all requests to the S3 bucket ensures that data in transit between AWS Glue and S3 is encrypted using TLS. By using an S3 bucket policy with a condition that denies requests where `aws:SecureTransport` is false, the company enforces encryption for all connections, including those from AWS Glue. This meets the security requirement without needing to modify Glue or S3 configurations beyond the bucket policy.

Answer

Use an AWS KMS key to encrypt the data before uploading to S3.

Answer

Configure AWS Glue to use SSL by setting the 'ssl' parameter to 'true'.

Answer

Enable default encryption on the S3 bucket using SSE-S3.

Question 3

A data engineer is troubleshooting an AWS Lake Formation permissions issue. A user is able to query an Amazon Athena table but cannot see the underlying S3 data in the AWS Glue Data Catalog. The user has been granted SELECT permission on the table in Lake Formation. What is the most likely cause?

Accepted Answer

The user does not have DESCRIBE permission on the table in Lake Formation.. In AWS Lake Formation, the ability to query a table via Athena (which requires SELECT permission) is separate from the ability to view the table's metadata in the Glue Data Catalog. To see the underlying S3 data location or table properties in the catalog, a user needs DESCRIBE permission on the table. Without DESCRIBE, the table appears invisible in the Glue console or API, even though SELECT queries succeed.

Answer

The data location is not registered with Lake Formation.

Answer

The S3 bucket policy does not grant the user access.

Answer

The user does not have the aws:SourceArn condition in the IAM policy.

Question 4

A company uses Amazon Redshift to store customer data. The security team requires that all queries are logged for auditing purposes. Which combination of steps should be taken to meet this requirement? (Select TWO.)

Accepted Answer

Use AWS CloudTrail to log Redshift API calls.. Option B is correct because AWS CloudTrail can be configured to log Redshift API calls, such as CreateCluster, DeleteCluster, and ModifyCluster, which provides an audit trail of administrative actions. Option E is correct because Amazon Redshift supports native audit logging, including connection logs, user activity logs, and query logs, which can be exported to an Amazon S3 bucket for long-term retention and analysis.

Answer

Enable AWS CloudTrail database audit logging.

Answer

Enable logging on the Redshift security group.

Answer

Enable VPC Flow Logs for the Redshift cluster.

Question 5

A company is designing a data lake on Amazon S3. The security policy requires that all data be encrypted at rest using AWS KMS with automatic key rotation. Which encryption option meets these requirements? (Select THREE.)

Accepted Answer

Enable automatic key rotation on the KMS key.. Option A is correct because AWS KMS customer-managed keys (CMKs) support automatic key rotation, which can be enabled to rotate the key material annually. This satisfies the security policy requirement for automatic key rotation. SSE-KMS with a CMK (Option D) is also required because AWS managed keys (Option B) do not support automatic key rotation, and SSE-C (Option E) does not use KMS at all. Setting default encryption on the S3 bucket to SSE-KMS with the CMK (Option C) ensures all objects are encrypted with that key, meeting the encryption-at-rest requirement.

Answer

Use SSE-KMS with an AWS managed key.

Answer

Use SSE-C with a customer-provided key.

Question 6

Refer to the exhibit. A data engineer is running an AWS Glue job that reads from an S3 bucket encrypted with a customer-managed KMS key. The job fails with the error shown. What is the most likely cause?

Accepted Answer

The IAM role used by the Glue job is missing the kms:Decrypt permission.. The error indicates that the AWS Glue job cannot access the S3 bucket because it lacks the necessary KMS permissions. Since the bucket is encrypted with a customer-managed KMS key, the IAM role assigned to the Glue job must include the kms:Decrypt permission to read the encrypted objects. Without this permission, the job fails when attempting to decrypt the data.

Answer

The S3 bucket policy denies the kms:Decrypt action.

Answer

The Glue job does not have permission to call kms:GenerateDataKey.

Answer

The KMS key policy does not grant the Glue service principal access.

Question 7

Refer to the exhibit. A security analyst is reviewing CloudTrail logs and notices a PutObject event to the 'company-data-lake' bucket. The bucket policy requires all objects to be encrypted with SSE-KMS. What should the analyst conclude?

Accepted Answer

The object was encrypted with SSE-S3, which violates the bucket policy.. The bucket policy requires all objects to be encrypted with SSE-KMS. The CloudTrail log shows a PutObject event, but the encryption context (not shown in the exhibit) would indicate the encryption method used. Since the correct answer states the object was encrypted with SSE-S3, this violates the bucket policy, which mandates SSE-KMS. Therefore, the analyst should conclude that the request succeeded but violated the policy, as SSE-S3 does not meet the requirement.

Answer

The object was uploaded by the bucket owner, bypassing the policy.

Answer

The request succeeded because SSE-S3 is acceptable.

Answer

The object was encrypted with SSE-KMS as required.

Question 8

A company is using Amazon Redshift Spectrum to query data in Amazon S3. The S3 bucket uses SSE-KMS encryption. The Redshift cluster has an IAM role that allows access to S3 and KMS. However, queries fail with an 'Access Denied' error. What is the most likely cause?

Accepted Answer

The external schema does not have the IAM role specified.. When using Redshift Spectrum with SSE-KMS encrypted data in S3, the IAM role must be explicitly associated with the external schema via the `CREATE EXTERNAL SCHEMA` command using the `IAM_ROLE` parameter. Even if the cluster has the IAM role attached, Spectrum queries fail with 'Access Denied' if the role is not specified at the schema level, because Redshift needs to pass that role to S3 and KMS for each query execution. Option B correctly identifies this missing configuration as the most likely cause.

Answer

The Redshift cluster does not have the IAM role attached.

Answer

The IAM role does not have the kms:Decrypt permission.

Answer

The external table is not defined in the schema.

Question 9

A company is using Amazon EMR to process data stored in Amazon S3. The S3 bucket is configured with a bucket policy that denies access unless the request includes a specific tag. The EMR cluster's IAM role has s3:GetObject permission. However, the EMR job fails to read data from S3. What is the most likely cause?

Accepted Answer

The IAM role does not have a condition that matches the required tag.. The bucket policy denies access unless the request includes a specific tag. Even though the EMR cluster's IAM role has s3:GetObject permission, the IAM role does not have a condition key (e.g., aws:RequestTag) that matches the required tag. Therefore, the request is denied by the bucket policy, causing the EMR job to fail.

Answer

The bucket policy is not attached to the EMR role.

Answer

The EMR cluster is not in the same account as the S3 bucket.

Answer

The EMR role does not have s3:GetObject permission.

Question 10

A company uses AWS Lake Formation to manage data lake permissions. The data lake contains sensitive customer data in the 'customer' database. The security team wants to ensure that only users with a specific tag 'access_level=analyst' can query the 'customer' table. Which combination of steps should the data engineer take to enforce this?

Accepted Answer

In Lake Formation, create an LF-tag 'access_level' with values 'analyst' and 'admin'. Grant 'SELECT' permission on the 'customer' table to the tag value 'analyst'. Associate the LF-tag with the 'customer' table.. Option A is correct because Lake Formation LF-tags allow you to define metadata tags (key-value pairs) and grant permissions to those tags. By creating an LF-tag 'access_level' with values 'analyst' and 'admin', granting SELECT on the 'customer' table to the tag value 'analyst', and associating that LF-tag with the table, only principals who have the tag 'access_level=analyst' (or are granted via the tag) can query the table. This enforces tag-based access control at the Lake Formation permission layer, which is the intended mechanism for fine-grained, attribute-based access control in Lake Formation.

Answer

Create an IAM policy that conditionally allows 'glue:GetTable' based on the tag 'access_level=analyst'.

Answer

Apply a bucket policy on the S3 location of the 'customer' table that allows access only if the request carries the tag 'access_level=analyst'.

Answer

Use Lake Formation column-level filters to restrict access to columns based on the tag 'access_level=analyst'.

Question 11

A financial services company uses AWS KMS to encrypt data in Amazon S3. The compliance team requires that all encryption keys be rotated automatically every 365 days. The data engineer needs to implement this requirement without manual intervention. Which solution meets the requirement with the LEAST operational overhead?

Accepted Answer

Use the AWS managed key for Amazon S3 (aws/s3) for server-side encryption.. Option C is correct because the AWS managed key for Amazon S3 (aws/s3) is automatically rotated by AWS every 365 days (or less) with no configuration or maintenance required. This satisfies the compliance requirement with zero operational overhead, as the rotation is handled entirely by the AWS KMS service without any manual intervention or custom automation.

Answer

Create a customer managed key (CMK) in KMS with automatic rotation enabled every 365 days. Use this CMK to encrypt S3 objects.

Answer

Create a customer managed key with imported key material and configure a Lambda function to rotate the key every 365 days.

Answer

Use S3 server-side encryption with S3 managed keys (SSE-S3).

Question 12

A data engineer is configuring AWS Glue jobs to access data stored in Amazon S3. The data is encrypted using server-side encryption with AWS KMS (SSE-KMS). The Glue job needs to read and write data to the S3 bucket. Which IAM policy statement should be added to the Glue job's IAM role to allow it to use the KMS key?

Accepted Answer

{"Effect":"Allow","Action":["kms:Decrypt","kms:GenerateDataKey"],"Resource":"*"}. To read and write data encrypted with SSE-KMS, AWS Glue needs both `kms:Decrypt` (to read existing encrypted data) and `kms:GenerateDataKey` (to create a new data key for writing encrypted data). `kms:GenerateDataKey` is required because S3 uses a data key to encrypt objects, and the caller must generate that key via KMS. Option B correctly includes both actions, allowing the Glue job to perform read and write operations on the SSE-KMS encrypted bucket.

Answer

{"Effect":"Allow","Action":["kms:Decrypt"],"Resource":"*"}

Answer

{"Effect":"Allow","Action":["kms:Decrypt","kms:ReEncrypt"],"Resource":"*"}

Answer

{"Effect":"Allow","Action":["kms:Decrypt","kms:Encrypt"],"Resource":"*"}

Question 13

Refer to the exhibit. A data engineer is troubleshooting a permissions issue. The IAM role 'DataEngineerRole' is used by an AWS Glue job that needs to read data from an S3 bucket encrypted with a customer managed KMS key. The above key policy is attached to the KMS key. The Glue job fails with an AccessDenied error when trying to read the data. What is the MOST likely cause?

Accepted Answer

The key policy condition 'kms:ViaService' restricts KMS actions to only when they are made through S3, but AWS Glue calls KMS directly, not via S3.. The key policy includes a condition `kms:ViaService` that restricts KMS actions to only when they are made through the S3 service. However, AWS Glue does not call KMS via S3; it calls KMS directly to decrypt the S3 object's data key. Because the Glue job's KMS request does not originate from the S3 service, the condition fails, resulting in an AccessDenied error.

Answer

The key policy requires requests to originate from a VPC endpoint, but the Glue job is not using one.

Answer

The key policy denies requests that are not using HTTPS, but the Glue job is using HTTPS.

Answer

The Glue job is running in a different AWS region than the S3 bucket.

Question 14

A company is building a data pipeline that ingests sensitive customer data from an on-premises database into Amazon S3 using AWS DMS. The data must be encrypted at rest in S3 and in transit. The security team requires that the encryption keys be managed by the company (not AWS). Which TWO actions should the data engineer take to meet these requirements? (Choose TWO.)

Accepted Answer

Configure the S3 bucket to use server-side encryption with AWS KMS (SSE-KMS) using a customer managed key.. Option B is correct because SSE-KMS with a customer managed key allows the company to control the encryption keys used for S3 server-side encryption, meeting the requirement that keys be managed by the company, not AWS. Option D is correct because enabling SSL/TLS on both the DMS source and target endpoints ensures data is encrypted in transit between the on-premises database and AWS DMS, and between DMS and S3, satisfying the in-transit encryption requirement.

Answer

Enable encryption at rest using the default DMS encryption settings.

Answer

Configure the S3 bucket to use server-side encryption with S3 managed keys (SSE-S3).

Answer

Create an AWS KMS key and use it in the DMS endpoint to encrypt data in transit.

Question 15

A data engineer is designing a data lake on Amazon S3 with AWS Lake Formation. The data lake contains personally identifiable information (PII). The company has a policy that only users who have completed data privacy training can access the PII data. The training status is stored in an external identity provider (IdP) as an attribute. The data engineer needs to enforce this policy using Lake Formation. Which THREE steps should the data engineer take? (Choose THREE.)

Accepted Answer

Create an LF-tag called 'trainingCompleted' with values 'true' and 'false'. Grant 'SELECT' permission on the LF-tag 'trainingCompleted=true' to the federated users.. Option A is correct because LF-tags allow Lake Formation to manage access based on metadata attributes. By creating an LF-tag 'trainingCompleted' with values 'true' and 'false', and granting SELECT permission on the tag value 'true' to federated users, the data engineer can enforce that only users with the training attribute can access the tagged resources. This approach decouples access control from IAM roles and leverages tag-based authorization, which is the recommended method for attribute-based access control (ABAC) in Lake Formation.

Answer

Create a column-level filter on the PII columns that limits access based on the user's training attribute.

Answer

Create an IAM role for each user and attach a policy that allows 'lakeformation:GetDataAccess' only if the user has the training attribute.

Question 16

A healthcare company uses AWS Glue to process patient data stored in Amazon S3. The data is encrypted at rest using SSE-KMS with a customer managed key. The Glue ETL job runs on a schedule and reads from an S3 bucket, transforms the data, and writes to another S3 bucket also encrypted with the same KMS key. Recently, the security team rotated the KMS key. After the rotation, the Glue job started failing with 'AccessDenied' errors when trying to read from the source bucket. The Glue job's IAM role has permissions to use the KMS key (kms:Decrypt, kms:GenerateDataKey). The S3 bucket policies allow the role to read/write. What is the MOST likely cause of the failure?

Accepted Answer

The KMS key rotation created a new backing key, but the Glue job's IAM role does not have permission to decrypt with the old backing key.. When you rotate a customer managed KMS key, AWS KMS retains the old backing key to allow decryption of data encrypted before the rotation. However, the Glue job's IAM role must have permission to use the old backing key via the kms:Decrypt action. If the key policy or IAM policy does not explicitly allow decryption with the old backing key (or if the key policy was inadvertently updated to remove access to the old key material), the Glue job will fail with AccessDenied when reading SSE-KMS encrypted objects that were encrypted with the previous key version.

Answer

The Glue job's IAM role is missing the kms:Encrypt permission on the KMS key.

Answer

The Glue job is using the wrong encryption context when calling KMS.

Answer

The S3 bucket policy has a condition that requires the request to use the latest version of the KMS key.

Question 17

A data engineer is configuring a data lake on Amazon S3 that contains sensitive customer information. The company requires that all access to this data be logged and monitored, and that any data shared with external partners must be anonymized before leaving the S3 bucket. Which combination of AWS services should the engineer use to meet these requirements? (Choose THREE.)

Accepted Answer

AWS Lake Formation. AWS Lake Formation (B) is correct because it provides fine-grained access control and data anonymization capabilities for data lakes on Amazon S3. It allows you to define column-level and row-level security policies, and can automatically anonymize sensitive data (e.g., via masking or tokenization) before it is shared with external partners, ensuring compliance with data governance requirements.

Answer

AWS WAF

Answer

AWS Direct Connect

Question 18

Refer to the exhibit. A data engineer applies this bucket policy to an S3 bucket named my-data-bucket. The bucket contains sensitive data. The company's security team reports that data was accessed from an IP address outside the allowed range. What is the MOST likely reason that the policy failed to block the unauthorized access?

Accepted Answer

The Deny statement does not restrict access based on IP address; it only denies non-HTTPS requests.. Option C is correct because the Deny statement in the policy only denies requests that are not using HTTPS (SecureTransport: false). It does not include any condition to restrict access based on IP address. Therefore, a request made from an IP outside the allowed range but using HTTPS would not be denied by this policy, allowing unauthorized access to the sensitive data.

Answer

The Deny statement's condition on SecureTransport overrides the IP condition.

Answer

The policy has a syntax error in the Condition element.

Answer

The bucket policy does not apply to requests made from within the same AWS account.

Question 19

A financial services company uses AWS Glue ETL jobs to process credit card transaction data stored in Amazon S3. The data includes PII such as names and credit card numbers. The security team requires that all PII be masked before the data is written to the curated zone of the data lake. The data engineer has implemented a Glue job that reads from the raw zone, applies a custom transform to mask credit card numbers using a regular expression, and writes to the curated zone. However, during a recent audit, the security team discovered that some masked data still contained partial credit card numbers (e.g., showing the last four digits) when viewed by analysts who should only see masked data. The company's policy is that credit card numbers must be completely masked, showing only asterisks or a fixed string like "XXXX-XXXX-XXXX-XXXX". The Glue job uses a DynamicFrame and applies a Map transform with a Python function that replaces digits with 'X'. The data is stored in Parquet format. What should the data engineer do to ensure complete masking of credit card numbers?

Accepted Answer

Replace the custom Python Map transform with a built-in Glue Transform for data masking, such as the Mask transform available in Glue Studio.. Option C is correct because AWS Glue provides a built-in Mask transform that can be applied directly in Glue Studio or via the AWS Glue API. This transform is designed to reliably obfuscate sensitive data like credit card numbers by replacing them with a fixed string (e.g., 'XXXX-XXXX-XXXX-XXXX') or asterisks, ensuring complete masking regardless of input format. The custom Python Map transform in the current implementation is error-prone because it relies on a regular expression that may not catch all patterns or partial digits, whereas the Mask transform uses predefined logic to guarantee full masking.

Answer

Use an AWS Glue crawler to classify the data and apply a masking rule based on the classification.

Answer

Enable server-side encryption with AWS KMS on the curated S3 bucket.

Answer

Change the output format from Parquet to CSV and use a different write mode.

Question 20

Order the steps to migrate an on-premises database to Amazon RDS using AWS DMS.