DEA-C01 Data Security and Governance Practice Test 10 — 15 Questions

Question 1

The IAM policy shown is attached to an IAM role. When a user assumes this role and tries to read an object in example-bucket that has no tags, what will happen?

Accepted Answer

The request will be denied because the Deny statement applies when the tag is missing. The Deny statement denies s3:GetObject if the object does not have the tag 'classification' (i.e., the tag is null). Since the object has no tags, the condition evaluates to true, and the action is denied. The Allow statement only allows if the tag equals 'public', which is not the case. The explicit Deny overrides any Allow, so access is denied.

Answer

The request will be denied because the object does not have the 'public' tag

Answer

The request will be allowed because the Allow statement grants access to all objects

Answer

The request will be allowed because there is no explicit Deny

Question 2

A data engineer uses the AWS CLI to list KMS keys and describe one. The output shows two keys. The described key has KeyState 'Enabled' and Origin 'AWS_KMS'. Which statement is true about this key?

Accepted Answer

The key is a KMS managed key that is enabled and ready for use. The key has KeyState 'Enabled' and Origin 'AWS_KMS', which means it is an AWS KMS managed key that is enabled and ready for use. Option B is incorrect because Origin 'AWS_KMS' indicates the key material is generated by AWS, not imported. Option C is incorrect because a key scheduled for deletion would have KeyState 'PendingDeletion'. Option D is incorrect because KeyState 'Enabled' means the key is not disabled.

Answer

The key material was imported from an external source

Answer

The key is scheduled for deletion

Answer

The key is disabled and cannot be used

Question 3

A data engineer runs the command shown to check the encryption configuration of an S3 bucket. The output shows SSEAlgorithm: AES256. What does this mean?

Accepted Answer

The bucket uses SSE-S3 with Amazon S3-managed keys. AES256 refers to SSE-S3, where Amazon S3 manages the encryption keys using AES-256. Option B (SSE-KMS) would show 'aws:kms'. Option C (SSE-C) would require the customer to provide keys. Option D (no encryption) is incorrect because encryption is enabled.

Answer

The bucket uses SSE-KMS with a customer-managed key

Answer

The bucket uses SSE-C with customer-provided keys

Answer

The bucket does not have encryption enabled

Question 4

A company uses AWS KMS to encrypt data in Amazon S3. The security team requires that all encryption keys be rotated automatically every year. Which key type should the company use?

Accepted Answer

Use a customer managed key with automatic rotation enabled. AWS KMS allows customer managed keys to have automatic rotation enabled, which rotates the key material annually. This satisfies the security team's requirement for automatic yearly rotation while keeping customer control over the key. Option D (manual rotation) does not meet the automatic rotation requirement. AWS managed keys (C) also rotate automatically but are not customer managed, and SSE-S3 (B) is not a KMS key type.

Answer

Use the default S3 managed encryption key (SSE-S3)

Answer

Use an AWS managed key (aws/s3)

Answer

Use a customer managed key with manual rotation

Question 5

A data engineer needs to restrict access to an Amazon S3 bucket so that only objects encrypted with a specific AWS KMS key can be uploaded. Which S3 bucket policy condition should be used?

Accepted Answer

s3:x-amz-server-side-encryption-aws-kms-key-id. The correct condition is s3:x-amz-server-side-encryption-aws-kms-key-id (option A). This condition key allows you to require that objects uploaded to the S3 bucket are encrypted with a specific AWS KMS key by checking the key ID used in the encryption header. Option B (kms:ViaService) restricts KMS key usage to specific AWS services but does not enforce a key ID on S3 objects. Option C (s3:x-amz-server-side-encryption) only checks whether server-side encryption is enabled, not the specific key. Option D (kms:EncryptionContext) is used to enforce encryption context, not the key ID.

Answer

kms:ViaService

Answer

s3:x-amz-server-side-encryption

Answer

kms:EncryptionContext

Question 6

A company wants to audit all changes to IAM policies in their AWS account. Which combination of services should be used to achieve this?

Accepted Answer

AWS CloudTrail and Amazon CloudWatch Logs. AWS CloudTrail records all API calls made in the account, including IAM policy changes (e.g., PutRolePolicy, PutUserPolicy). By sending CloudTrail logs to Amazon CloudWatch Logs, you can monitor and set up alerts for policy modifications. This combination provides a complete audit trail for IAM changes. Option B is correct. AWS Config records resource configuration changes but not all API calls; Amazon SNS alone or with Config does not capture the API events; DynamoDB is not used for CloudTrail log storage or monitoring.

Answer

AWS Config and Amazon SNS

Answer

Amazon CloudWatch Logs and Amazon SNS

Answer

AWS CloudTrail and Amazon DynamoDB

Question 7

A data engineer needs to allow an IAM user to rotate the secret in AWS Secrets Manager for an RDS database. Which IAM action should be included in the policy?

Accepted Answer

secretsmanager:RotateSecret. The secretsmanager:RotateSecret action allows the user to initiate rotation of a secret. Option A is correct. secretsmanager:GetSecretValue only retrieves the secret value, not rotate it.

Answer

secretsmanager:PutSecretValue

Answer

secretsmanager:UpdateSecret

Answer

secretsmanager:GetSecretValue

Question 8

A company stores sensitive data in Amazon S3. The security team requires that all data be encrypted at rest and that the encryption keys be stored in AWS CloudHSM. Which S3 encryption option should be used?

Accepted Answer

SSE-C. SSE-C allows customers to provide their own encryption keys, which can be stored in CloudHSM. SSE-S3 and SSE-KMS use AWS-managed keys or KMS keys, not CloudHSM. Option D is correct.

Answer

SSE-S3

Answer

SSE-KMS with an AWS managed key

Answer

SSE-KMS with a customer managed key

Question 9

A company wants to ensure that all S3 buckets are encrypted using server-side encryption. Which AWS service can be used to automatically remediate non-compliant buckets?

Accepted Answer

AWS Config. AWS Config can use managed rules like s3-bucket-server-side-encryption-enabled to check compliance and trigger auto-remediation via SSM Automation or Lambda. Option D is correct.

Answer

AWS CloudTrail

Answer

Amazon Inspector

Answer

AWS Trusted Advisor

Question 10

A data engineer needs to grant cross-account access to an S3 bucket. The engineer wants to use a role in the source account and assume that role from the target account. Which permissions are required?

Accepted Answer

Role in source account with trust policy allowing target account, and bucket policy granting access to the role. Cross-account access via role assumption requires the source account to have an IAM role with a trust policy that explicitly allows the target account's AWS account ID to assume it. The bucket policy must then grant the necessary S3 actions (e.g., s3:GetObject) to that role's ARN, enabling the target account's assumed role session to access the bucket. This two-step mechanism—trust policy for authentication and bucket policy for authorization—is the standard AWS pattern for secure cross-account S3 access.

Answer

Bucket policy in source account allowing the target account's root user

Answer

Role in target account with trust policy allowing source account

Answer

IAM policy in target account allowing s3:GetObject on the bucket

Question 11

A company uses Amazon Redshift for data warehousing. The security team requires that all data be encrypted at rest using a key managed by the company. Which Redshift encryption option should be used?

Accepted Answer

Specify a customer managed KMS key when enabling encryption. Amazon Redshift supports encryption at rest using AWS KMS. To use a key managed by the company (customer managed key), you must specify a customer managed KMS key when enabling encryption. Option D is correct. Option A uses an AWS managed key (default), which is not managed by the company. Option B refers to encryption in transit, not at rest. Option C: HSM is not directly supported for Redshift encryption; KMS is used.

Answer

Enable encryption using AWS managed key (default)

Answer

Use SSL/TLS encryption

Answer

Use hardware security module (HSM)

Question 12

A company needs to centralize audit logs from multiple AWS accounts into a single S3 bucket. Which service should be used to aggregate these logs?

Accepted Answer

AWS CloudTrail. AWS CloudTrail can be configured to deliver logs from multiple accounts to a single S3 bucket using a trail in the management account. Option C is correct.

Answer

AWS Config

Answer

Amazon Kinesis Data Firehose

Answer

Amazon CloudWatch Logs

Question 13

Which TWO actions are required to enforce encryption in transit for data being loaded into Amazon Redshift from Amazon S3? (Choose two.)

Accepted Answer

Configure Redshift to require SSL connections. To enforce encryption in transit for data loaded from S3 into Redshift, you need SSL connections on Redshift (option A) to encrypt the connection between the client and Redshift, and S3 VPC endpoints with HTTPS (option E) to encrypt data transfer from S3 to Redshift via the VPC endpoint. Option B is client-side encryption, which encrypts data before it reaches S3 and is not required for transit. Option C enables encryption at rest on the Redshift cluster, not in transit. Option D is about server-side encryption at rest in S3, not transit.

Answer

Use client-side encryption for data in S3

Answer

Enable encryption at rest on Redshift cluster

Answer

Enable S3 server-side encryption

Question 14

A company uses AWS Glue to process sensitive customer data stored in S3. The security team requires that all data be encrypted at rest using a customer-managed KMS key and that access to the key be auditable. Which solution meets these requirements?

Accepted Answer

Configure the S3 bucket to use SSE-KMS with a customer-managed KMS key and enable CloudTrail for KMS events.. SSE-KMS with a customer-managed KMS key provides encryption at rest and, when combined with CloudTrail logging for KMS events, offers full auditability of key usage. Option A (client-side encryption) does not encrypt data at rest within S3; it encrypts before upload. Option C (SSE-S3) uses AWS-managed keys, which do not allow customer audit of key access. Option D (SSE-C) relies on customer-provided keys that are not managed by KMS and cannot be audited via CloudTrail.

Answer

Encrypt the data client-side before uploading to S3.

Answer

Enable default SSE-S3 encryption on the S3 bucket.

Answer

Use SSE-C with a customer-provided key.

Question 15

A data engineer needs to share a dataset from an S3 bucket in Account A with users in Account B. The dataset must remain encrypted at rest with an S3-managed key. What is the MOST secure way to grant cross-account access?

Accepted Answer

Create a bucket policy that grants cross-account access to an IAM role in Account B.. A bucket policy granting access to the IAM role in Account B is the recommended secure method for cross-account access to S3 objects encrypted with S3-managed keys. Option A is insecure because it grants public access. Option C is incorrect because ACLs are legacy and less secure for cross-account scenarios. Option D is incorrect because while S3 VPC endpoints are a valid AWS feature that provides private connectivity to S3, they do not grant cross-account access; bucket policies are still required to authorize access.

Answer

Make the bucket public and use bucket policies to allow only Account B users.

Answer

Use S3 object ACLs to grant access to Account B's root user.

Answer

Use an S3 VPC endpoint to allow Account B users through private IPs.