DEA-C01 Data Security and Governance Practice Test 10 — 15 Questions

Question 1

A company uses Amazon Redshift for data warehousing. The security team requires that all data be encrypted at rest using a key managed by the company. Which Redshift encryption option should be used?

Accepted Answer

Specify a customer managed KMS key when enabling encryption. Redshift supports encryption at rest using KMS keys. To use a customer-managed key, you need to specify a KMS key ID. Option C is correct. HSM is not directly supported by Redshift.

Answer

Enable encryption using AWS managed key (default)

Answer

Use SSL/TLS encryption

Answer

Use hardware security module (HSM)

Question 2

A company needs to centralize audit logs from multiple AWS accounts into a single S3 bucket. Which service should be used to aggregate these logs?

Accepted Answer

AWS CloudTrail. AWS CloudTrail can be configured to deliver logs from multiple accounts to a single S3 bucket using a trail in the management account. Option B is correct.

Answer

AWS Config

Answer

Amazon Kinesis Data Firehose

Answer

Amazon CloudWatch Logs

Question 3

Which TWO actions are required to enforce encryption in transit for data being loaded into Amazon Redshift from Amazon S3? (Choose two.)

Accepted Answer

Configure Redshift to require SSL connections. To enforce encryption in transit, you must use S3 endpoints that support HTTPS (option A) and configure Redshift to use SSL (option D). Option B is about encryption at rest, not in transit. Option C is about encryption at rest in S3. Option E is about client-side encryption, which is not required for transit encryption.

Answer

Use client-side encryption for data in S3

Answer

Enable encryption at rest on Redshift cluster

Answer

Enable S3 server-side encryption

Question 4

A company wants to monitor and alert on any IAM user creation in their AWS account. Which THREE services should be used together to achieve this? (Choose three.)

Accepted Answer

AWS CloudTrail. AWS CloudTrail captures IAM user creation API calls (option A). Amazon CloudWatch Logs can be the target for CloudTrail logs (option B). Amazon CloudWatch Events (EventBridge) can create a rule to trigger an alert (option C). Option D is for configuration compliance, not API monitoring. Option E is for sending notifications, but the question asks for monitoring and alerting, and EventBridge can directly trigger SNS or Lambda.

Answer

Amazon Simple Notification Service (SNS)

Answer

AWS Config

Question 5

Which TWO AWS services can be used to protect sensitive data stored in Amazon S3 by preventing accidental public access? (Choose two.)

Accepted Answer

AWS Trusted Advisor. Amazon S3 Block Public Access (option C) is a service that blocks public access at the bucket or account level. AWS Trusted Advisor (option D) has a check for S3 bucket permissions that can identify publicly accessible buckets. Option A is for network security, not S3. Option B is for malware protection. Option E is for encryption at rest, not public access prevention.

Answer

AWS WAF

Answer

Amazon GuardDuty

Answer

AWS Key Management Service (KMS)

Question 6

A company uses AWS Glue to process sensitive customer data stored in S3. The security team requires that all data be encrypted at rest using a customer-managed KMS key and that access to the key be auditable. Which solution meets these requirements?

Accepted Answer

Configure the S3 bucket to use SSE-KMS with a customer-managed KMS key and enable CloudTrail for KMS events.. Option D is correct because SSE-KMS with a customer-managed key provides encryption with an auditable CMK. Option A (SSE-S3) uses AWS-managed keys with no audit capability. Option B (client-side encryption) is not at rest encryption within S3. Option C (SSE-C) does not use KMS keys.

Answer

Encrypt the data client-side before uploading to S3.

Answer

Enable default SSE-S3 encryption on the S3 bucket.

Answer

Use SSE-C with a customer-provided key.

Question 7

A data engineer needs to share a dataset from an S3 bucket in Account A with users in Account B. The dataset must remain encrypted at rest with an S3-managed key. What is the MOST secure way to grant cross-account access?

Accepted Answer

Create a bucket policy that grants cross-account access to an IAM role in Account B.. Option B is correct because a bucket policy granting access to the IAM role in Account B is the recommended secure method. Option A is insecure because it grants public access. Option C is incorrect because ACLs are legacy and less secure. Option D is not a valid AWS feature.

Answer

Make the bucket public and use bucket policies to allow only Account B users.

Answer

Use S3 object ACLs to grant access to Account B's root user.

Answer

Use an S3 VPC endpoint to allow Account B users through private IPs.

Question 8

A company uses Redshift for analytics. The security team requires that all queries be logged and that any access to sensitive columns be blocked for non-admin users. Which combination of features should the data engineer implement?

Accepted Answer

Enable Redshift audit logging and create views that expose only non-sensitive columns, granting access to views.. Option C is correct because Redshift audit logging captures queries, and column-level access control can be enforced using views with restricted columns. Option A is wrong because IAM policies do not control column-level access in Redshift. Option B is wrong because row-level security is not yet supported. Option D is wrong because CloudWatch Logs do not control access.

Answer

Use Redshift row-level security and enable CloudTrail logging.

Answer

Enable CloudWatch Logs for Redshift and use IAM conditions to block sensitive columns.

Answer

Enable Redshift audit logging and use IAM policies to restrict column access.

Question 9

A data engineer is designing a data lake on S3 with sensitive data. The security policy mandates that data must be encrypted at rest and in transit, and that an inventory of all objects must be maintained for compliance. Which actions should be taken?

Accepted Answer

Enforce HTTPS via bucket policy, enable default SSE-S3 encryption, and enable S3 Inventory.. Option D is correct because enforcing HTTPS (in-transit) and SSE-S3 (at-rest) with S3 Inventory provides compliance. Option A misses in-transit encryption. Option B misses inventory. Option C uses KMS which may not be required and does not include inventory.

Answer

Use SSE-KMS encryption and enable CloudTrail for S3 events.

Answer

Enable S3 default encryption using SSE-S3 and enable S3 Inventory.

Answer

Enforce HTTPS using bucket policy and enable S3 Server Access Logging.

Question 10

A company wants to use AWS Lake Formation to manage permissions on a data lake. What is the primary benefit of using Lake Formation for data security?

Accepted Answer

Centralized fine-grained access control to data in S3, Redshift, and RDS.. Option A is correct because Lake Formation provides centralized fine-grained access control at the table, column, and row level. Option B is wrong because Lake Formation does not replace IAM. Option C is wrong because it does not encrypt data. Option D is wrong because Lake Formation works with S3, not just Redshift.

Answer

Automatically encrypts data at rest and in transit.

Answer

Replaces IAM for all data access policies.

Answer

Provides a unified view of data across all AWS regions.

Question 11

A company has an AWS Glue ETL job that reads from an RDS MySQL instance and writes to S3. The security team requires that the connection to RDS be encrypted and that credentials be rotated automatically. Which configuration should be used?

Accepted Answer

Store the password in AWS Secrets Manager with automatic rotation enabled and configure Glue to use SSL for the connection.. Option C is correct because Secrets Manager provides automatic rotation of RDS credentials, and Glue can use the secret. Option A does not rotate credentials. Option B does not provide encryption for the connection. Option D is not a service for storing credentials.

Answer

Store the database password in an encrypted parameter in Systems Manager Parameter Store and enable SSL for the connection.

Answer

Use IAM database authentication for RDS and store credentials in Glue connection properties.

Answer

Store the password in a text file in an encrypted S3 bucket and use SSL.

Question 12

A data engineer needs to ensure that an S3 bucket can only be accessed from a specific VPC. Which policy element should be used?

Accepted Answer

Use the condition key aws:SourceVpc in the bucket policy.. Option B is correct because the condition key aws:SourceVpc restricts requests to originate from a specific VPC. Option A limits to a VPC endpoint, not the VPC itself. Option C is for specific IPs. Option D is for VPC endpoint IDs.

Answer

Use the condition key aws:VpcSourceIp in the bucket policy.

Answer

Use the condition key aws:SourceIp in the bucket policy.

Answer

Use the condition key aws:SourceVpce in the bucket policy.

Question 13

A company uses Amazon Athena to query data in S3. The security team wants to ensure that users can only query tables they have permissions to in the AWS Glue Data Catalog. Which service should be used to manage these permissions centrally?

Accepted Answer

AWS Lake Formation. Option A is correct because Lake Formation provides centralized permissions management for the Glue Data Catalog. Option B (IAM) is too low-level and does not integrate directly with Data Catalog tables. Option C (S3 bucket policy) does not control table access. Option D (CloudTrail) is for auditing, not access control.

Answer

AWS IAM

Answer

AWS CloudTrail

Answer

S3 bucket policies

Question 14

A company has an S3 bucket with versioning enabled and a bucket policy that denies access if the request does not include encryption. A data engineer notices that some objects are not encrypted. What is the most likely cause?

Accepted Answer

The policy only applies to new uploads; existing objects remain unencrypted.. Option D is correct because bucket policies with deny for unencrypted requests only apply to new uploads, not existing objects. Option A is wrong because bucket policy evaluates all requests. Option B is wrong because versioning does not affect encryption. Option C is wrong because default encryption only applies to new objects.

Answer

The bucket policy does not evaluate requests from the same account.

Answer

Default encryption was not enabled at the bucket level.

Answer

Versioning was enabled after the objects were uploaded.

Question 15

A data engineer is designing a data pipeline that processes PII data using AWS Glue and stores results in S3. Which TWO actions should be taken to protect the data? (Choose 2)

Accepted Answer

Store database credentials in AWS Secrets Manager and reference them in Glue connections.. Options A and D are correct. Option A: Glue can use KMS to encrypt data at rest. Option D: Secrets Manager securely stores database credentials. Option B is wrong because SSE-S3 does not use KMS. Option C is wrong because deleting data after processing is not a security best practice for compliance (may need to retain). Option E is wrong because HTTPS is not a substitute for encryption at rest.

Answer

Use S3 default encryption with SSE-S3 for the output bucket.

Answer

Enable S3 object deletion protection by setting a retention policy.

Answer

Use HTTPS for all data transfer between Glue and S3.