DEA-C01 Data Security and Governance Practice Test 10 — 15 Questions

Question 1

Refer to the exhibit. A data engineer has attached this KMS key policy to a customer-managed key. The policy is intended to allow the DataEngineer role to decrypt objects in S3 only when the request comes through S3. However, the role is unable to decrypt objects stored in an S3 bucket in the us-west-2 region. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The condition restricts the permission to the us-east-1 region only. The KMS key policy likely includes a condition such as aws:RequestedRegion or kms:ViaService scoped to us-east-1, which prevents the role from using the key for decrypt operations in us-west-2. KMS keys are regional, and a key policy condition restricting the region will block cross-region use even if the role has kms:Decrypt in IAM.

Answer

The key policy does not allow the role to use GenerateDataKey

Answer

The role does not have an IAM policy that allows kms:Decrypt

Answer

The role does not have permission to decrypt from S3

Question 2

Refer to the exhibit. A data engineer runs the above command and sees that the DataLakeAdmin role has the AmazonS3FullAccess and AWSLakeFormationDataAdmin policies attached. The engineer wants to ensure that the role can only access S3 data through Lake Formation. What should the engineer do?

Accepted Answer

Detach the AmazonS3FullAccess policy from the role. To force all S3 access through Lake Formation, the engineer must remove the broad AmazonS3FullAccess policy from the role. Lake Formation permissions only govern access when the principal does not also have direct IAM permissions to S3; if AmazonS3FullAccess remains attached, the role can bypass Lake Formation and access S3 objects directly via the S3 API. Detaching AmazonS3FullAccess ensures that all data access is mediated by Lake Formation's fine-grained permission model.

Answer

Create a new IAM policy that explicitly denies s3:GetObject and attach it to the role

Answer

Detach the AWSLakeFormationDataAdmin policy from the role

Answer

Modify the S3 bucket policy to deny all access except from Lake Formation

Question 3

A company uses AWS KMS to encrypt data at rest in Amazon S3. The security team requires that all encryption keys be automatically rotated every year. Which key type should be used to meet this requirement without manual intervention?

Accepted Answer

Use a customer managed key with automatic rotation enabled.. Customer managed KMS keys support automatic annual rotation, which AWS performs transparently by generating new backing key material while retaining the old material to decrypt previously encrypted data. This satisfies the 'no manual intervention' requirement because rotation is scheduled by KMS itself. AWS managed keys (aws/s3) also rotate automatically every year, but they cannot be customized or controlled by the customer, and the question emphasizes the security team's requirement for managed rotation of their own keys.

Answer

Use an imported key material because it supports automatic rotation.

Answer

Use a KMS key generated by S3 on each object upload.

Answer

Use an AWS managed key (aws/s3).

Question 4

A company is designing a data pipeline that ingests data from an on-premises database to Amazon S3. The data contains personally identifiable information (PII) that must be masked before storage. Which AWS service can be used to mask the data in transit?

Accepted Answer

Amazon Kinesis Data Firehose. Amazon Kinesis Data Firehose supports in-flight data transformation via AWS Lambda, and it can invoke a Lambda function to mask, redact, or tokenize PII before delivering records to Amazon S3. This makes it the correct service for masking data in transit within a streaming ingestion pipeline. Firehose handles buffering, retries, and delivery, so the masking happens before the data lands in S3.

Answer

AWS Database Migration Service (DMS)

Answer

AWS Data Pipeline

Answer

AWS Glue

Question 5

A company wants to ensure that an IAM user can only launch Amazon EC2 instances of a specific instance type. Which THREE IAM policy elements are required to define this permission? (Choose THREE.)

Accepted Answer

Action. Option A (Action) is required because the policy must specify the EC2 API operation being allowed, such as ec2:RunInstances, which is the action that launches instances. Option C (Effect) is required because every IAM policy statement must declare whether the action is allowed or denied, typically "Effect": "Allow" for granting this permission. Option D (Resource) is required because the statement must identify the target of the action, such as "Resource": "*" or specific instance/AMI ARNs, to define what the RunInstances action applies to. Option B (Principal) is not required in an identity-based IAM policy attached to a user, since the principal is implicit as the user itself; Principal is used in resource-based policies or trust policies. Option E (Condition) is not strictly required to define the permission, although it could optionally be used to restrict instance type via a condition key like ec2:InstanceType.

Answer

Principal

Answer

Condition

Question 6

Refer to the exhibit. An IAM policy is attached to an IAM user. The user is trying to download an object from the S3 bucket 'example-bucket' from an IP address 10.1.1.1, but the request is denied. What is the most likely reason?

Accepted Answer

The user's IP address does not match the condition in the policy.. The policy is attached to the user and the request is denied even though the user is attempting a valid s3:GetObject. The most likely reason is that the policy includes an IP condition (e.g., aws:SourceIp) that does not match 10.1.1.1, so the Allow statement does not apply. Since there is no explicit deny mentioned, the implicit deny takes effect.

Answer

The policy does not allow the s3:GetObject action.

Answer

The policy has a syntax error.

Answer

There is an explicit deny statement elsewhere that overrides the allow.

Question 7

Refer to the exhibit. A data engineer runs a CLI command to decrypt a file and receives an access denied error. The IAM user 'DataEngineer' has the following policy attached:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "kms:Decrypt",
      "Resource": "*"
    }
  ]
}

What is the most likely cause of the error?

Accepted Answer

The key policy does not grant the IAM user permission to decrypt.. Even though the IAM policy grants kms:Decrypt on all resources, the key policy is a separate access control mechanism. The error indicates that the key policy does not include the IAM user as a principal allowed to decrypt. Therefore, option B is correct. Option A is incorrect because missing the --encryption-context parameter would cause a different error, not an access denied. Option C is incorrect because AWS managed keys can be used for decryption if the key policy grants permission; the key type is not the issue. Option D is incorrect because the IAM policy does allow kms:Decrypt on all keys; the problem is the key policy, not the IAM policy.

Answer

The CLI command is missing the --encryption-context parameter.

Answer

The key is an AWS managed key and cannot be used for decryption.

Answer

The IAM policy does not allow kms:Decrypt on the specific key.

Question 8

Refer to the exhibit. A data engineer creates an external table in AWS Glue Data Catalog pointing to an S3 bucket that contains encrypted objects (SSE-S3). The CREATE TABLE statement fails with an error. What change should be made to fix the error?

Accepted Answer

Set 'has_encrypted_data' to 'true'.. When creating an external table in AWS Glue Data Catalog that points to S3 objects encrypted with SSE-S3, the table property 'has_encrypted_data' must be set to 'true' so that the crawler and Athena/Glue ETL jobs know the data is encrypted and can handle it appropriately. Without this property, the CREATE TABLE or crawler may fail because it cannot read the encrypted objects. This is a specific requirement for SSE-S3 encrypted data in Glue.

Answer

Change the SERDE to 'org.apache.hadoop.hive.serde2.lazy.LazySimpleSerDe'.

Answer

Add 'aws_iam_role' as a table property.

Answer

Include the KMS key ARN in the LOCATION.

Question 9

A company stores PII in an S3 bucket. The security team wants to use Amazon Macie to discover sensitive data. After enabling Macie, they notice that no sensitive data findings are generated. The S3 bucket is in the same account. What is the most likely reason?

Accepted Answer

The S3 bucket is in a different AWS Region than the Macie session.. Macie only scans buckets in the same AWS Region as the Macie session. If the bucket is in a different region, Macie cannot discover sensitive data in it. Option A is incorrect because Macie uses service-linked roles, not the bucket policy, to access buckets in the same account. Option B is incorrect because Macie does not require cross-account access for buckets in the same account. Option D is incorrect because Macie can read objects regardless of ACLs as long as the appropriate IAM permissions are granted.

Answer

The bucket policy blocks access from Macie's service principal.

Answer

Macie is not configured with cross-account access to the bucket.

Answer

The S3 objects have private ACLs that prevent Macie from reading them.

Question 10

A data engineer needs to encrypt data at rest in an Amazon Redshift cluster. The company requires that the encryption key be managed by the customer and rotated annually. Which solution meets these requirements?

Accepted Answer

Use AWS KMS with automatic key rotation enabled.. AWS KMS with automatic key rotation enabled meets the requirements because it allows customer-managed keys (CMKs) that can be rotated annually. Redshift supports KMS encryption for data at rest, and automatic rotation can be set to yearly. Other options either don't use KMS-managed keys or are not directly integrated with Redshift for encryption at rest.

Answer

Use S3 server-side encryption with customer-provided keys (SSE-C).

Answer

Use AWS Secrets Manager to store the encryption key and configure Redshift to reference it.

Answer

Use AWS CloudHSM to create and manage the encryption key, and configure Redshift to use it.

Question 11

A company wants to use AWS CloudTrail to monitor data events for an S3 bucket. Which TWO configurations are required to capture object-level API operations?

Accepted Answer

Configure the CloudTrail trail to log data events for the S3 bucket.. Option A is correct because CloudTrail does not log S3 object-level API operations (data events) by default; you must explicitly configure the trail to log data events for the specific S3 bucket (or use advanced event selectors) to capture actions like GetObject, PutObject, and DeleteObject. Option D is correct because a CloudTrail trail logs events for the AWS Region in which it is created, so to capture data events for an S3 bucket, the trail must exist in the same Region as that bucket (or you must create a multi-Region trail that includes that Region). Option B is incorrect because management events cover control-plane operations such as CreateBucket or PutBucketPolicy, not object-level data events. Option C is incorrect because S3 server access logs are a separate S3-native logging feature, not a CloudTrail data event configuration. Option E is incorrect because CloudWatch Events (EventBridge) rules react to events but do not themselves enable CloudTrail data event logging for S3 object operations.

Answer

Enable management events in the CloudTrail trail.

Answer

Enable S3 server access logs on the bucket.

Answer

Set up an Amazon CloudWatch Events rule to capture S3 events.

Question 12

A company is using AWS KMS with customer-managed keys to encrypt data in Amazon RDS. The security team wants to ensure that the key can be rotated automatically every year. Which THREE steps are required to achieve automatic key rotation?

Accepted Answer

Enable automatic key rotation in the KMS key configuration.. Option B is correct because automatic key rotation in AWS KMS is enabled as a property of the customer-managed KMS key itself, via the KMS key configuration (EnableKeyRotation / aws kms enable-key-rotation), which rotates the backing key material annually. Option C is correct because automatic key rotation is supported only for symmetric encryption KMS keys with AWS-generated key material; asymmetric, HMAC, and imported key material keys cannot be automatically rotated. Option D is correct because the RDS instance (or its encrypted resources such as storage, snapshots, and read replicas) must be configured to use that KMS key as the encryption key, so the rotated key material actually protects the database data. Option A does not belong because AWS CloudHSM is a separate dedicated HSM service and migrating a KMS key to CloudHSM is neither possible nor required for KMS automatic rotation. Option E does not belong because creating a new KMS key and repointing RDS to it is a manual re-encryption approach, not the automatic annual rotation mechanism.

Answer

Migrate the key to AWS CloudHSM.

Answer

Create a new KMS key and configure RDS to use it.

Question 13

A data engineer needs to monitor and log changes to IAM policies in an AWS account. Which TWO AWS services can be used together to achieve this?

Accepted Answer

AWS CloudTrail. AWS CloudTrail (option D) is correct because it records every IAM API call, including CreatePolicy, PutRolePolicy, AttachRolePolicy, and DeletePolicy events, capturing who made the change, when, and from where. Amazon CloudWatch Logs (option E) is correct because CloudTrail can deliver its event logs to a CloudWatch Logs log group, where you can monitor, filter, and alarm on IAM policy change events using metric filters and CloudWatch alarms. Together they provide the audit trail plus real-time monitoring and alerting the engineer needs. Amazon GuardDuty (A) is a threat-detection service that analyzes findings rather than logging IAM policy changes, VPC Flow Logs (C) capture IP traffic metadata for network interfaces and have nothing to do with IAM API activity, and AWS Config (B) records resource configuration history and compliance but is not the primary service for logging IAM API calls or delivering them to CloudWatch Logs for monitoring.

Answer

Amazon GuardDuty

Answer

AWS Config

Answer

VPC Flow Logs

Question 14

A company stores sensitive customer data in an Amazon S3 bucket. The security team requires that all data be encrypted at rest using server-side encryption with AWS KMS managed keys (SSE-KMS). Additionally, they want to ensure that the encryption context is enforced for all PutObject requests. Which THREE steps should be taken to meet these requirements?

Accepted Answer

Set the default encryption on the bucket to SSE-KMS with the desired KMS key.. Option A is correct because setting the bucket's default encryption to SSE-KMS with the desired KMS key ensures that every new object is automatically encrypted at rest with AWS KMS managed keys, satisfying the baseline encryption requirement. Option B is correct because a bucket policy can enforce that PutObject requests include the SSE-KMS key header via s3:x-amz-server-side-encryption-aws-kms-key-id and require a specific kms:EncryptionContext value, thereby rejecting requests that omit or mismatch the encryption context. Option E is correct because the caller must have kms:GenerateDataKey to obtain the data key for encryption and kms:Decrypt to read the object, so an IAM role with these permissions on the KMS key is necessary for SSE-KMS operations to succeed. Option C is not correct because SSE-C uses customer-provided keys, not AWS KMS managed keys, and does not enforce KMS encryption context. Option D is not correct because S3 Versioning protects against overwrites and deletions but does not provide or enforce SSE-KMS encryption or encryption context.

Answer

Configure the bucket to use SSE-C and provide the encryption key.

Answer

Enable S3 Versioning on the bucket.

Question 15

A company runs a data lake on Amazon S3 with AWS Glue and Amazon Athena. The security team recently ran a report using Amazon Macie and found that multiple S3 objects containing PII are publicly accessible. The data engineer is tasked with remediating this issue immediately. The S3 bucket is configured with a bucket policy that grants public read access to all objects. The data engineer needs to ensure that no objects are publicly accessible while maintaining the ability for authorized IAM users and roles to access the data via Athena. The bucket must also remain accessible to the Glue crawler. What is the MOST effective course of action?

Accepted Answer

Remove the bucket policy granting public access and attach an IAM policy to the Glue and Athena roles to allow access to the bucket.. Removing the bucket policy that grants public access and instead attaching an IAM policy to the Glue and Athena roles is the most effective action. This eliminates public access while allowing authorized IAM principals to access the data. It also maintains access for the Glue crawler by granting permissions through the IAM role.

Answer

Use Amazon Macie to automatically remediate the public access by updating the object ACLs.

Answer

Set the bucket ACL to private and add a bucket policy that allows access to the Glue crawler and Athena.

Answer

Enable S3 Block Public Access on the bucket and use a bucket policy to allow access from the Glue and Athena service principals.