DEA-C01 Data Security and Governance Practice Test 11 — 15 Questions

Question 1

A company uses Redshift for analytics. The security team requires that all queries be logged and that any access to sensitive columns be blocked for non-admin users. Which combination of features should the data engineer implement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable Redshift audit logging and create views that expose only non-sensitive columns, granting access to views.. Redshift audit logging captures all queries, and creating views that expose only non-sensitive columns with access granted to those views enforces column-level access control for non-admin users. Option B is incorrect because row-level security is not supported in Redshift, and CloudTrail logging alone does not block access. Option C is incorrect because CloudWatch Logs do not control access; they only provide monitoring. Option D is incorrect because IAM policies cannot restrict access to specific columns in Redshift.

Answer

Use Redshift row-level security and enable CloudTrail logging.

Answer

Enable CloudWatch Logs for Redshift and use IAM conditions to block sensitive columns.

Answer

Enable Redshift audit logging and use IAM policies to restrict column access.

Question 2

A data engineer is designing a data lake on S3 with sensitive data. The security policy mandates that data must be encrypted at rest and in transit, and that an inventory of all objects must be maintained for compliance. Which actions should be taken?

Accepted Answer

Enforce HTTPS via bucket policy, enable default SSE-S3 encryption, and enable S3 Inventory.. It covers all requirements: encryption in transit (HTTPS enforcement via bucket policy), encryption at rest (default SSE-S3), and compliance inventory (S3 Inventory). Option B uses SSE-KMS which is not required and lacks inventory. Option C includes at-rest encryption and inventory but misses in-transit encryption. Option D includes in-transit encryption but lacks at-rest encryption and compliance inventory.

Answer

Use SSE-KMS encryption and enable CloudTrail for S3 events.

Answer

Enable S3 default encryption using SSE-S3 and enable S3 Inventory.

Answer

Enforce HTTPS using bucket policy and enable S3 Server Access Logging.

Question 3

A company wants to use AWS Lake Formation to manage permissions on a data lake. What is the primary benefit of using Lake Formation for data security?

Accepted Answer

Centralized fine-grained access control to data in S3, Redshift, and RDS.. AWS Lake Formation centralizes fine-grained access control for data lakes, allowing administrators to define column-level, row-level, and cell-level permissions on data stored in Amazon S3, and also extend those policies to Amazon Redshift and Amazon RDS via integrated resource links. This eliminates the need to manage separate IAM policies for each service, providing a single point of governance for data security across the data lake ecosystem.

Answer

Automatically encrypts data at rest and in transit.

Answer

Replaces IAM for all data access policies.

Answer

Provides a unified view of data across all AWS regions.

Question 4

A company has an AWS Glue ETL job that reads from an RDS MySQL instance and writes to S3. The security team requires that the connection to RDS be encrypted and that credentials be rotated automatically. Which configuration should be used?

Accepted Answer

Store the password in AWS Secrets Manager with automatic rotation enabled and configure Glue to use SSL for the connection.. AWS Secrets Manager provides automatic rotation of RDS credentials, and AWS Glue can be configured to use SSL for an encrypted connection to RDS MySQL. Option A (Systems Manager Parameter Store) stores encrypted parameters but does not natively support automatic rotation of RDS credentials. Option B (IAM database authentication) provides authentication but does not encrypt the connection itself; SSL is still required for encryption. Option C (encrypted S3 bucket) is not a service designed for dynamic credential management and lacks automatic rotation.

Answer

Store the database password in an encrypted parameter in Systems Manager Parameter Store and enable SSL for the connection.

Answer

Use IAM database authentication for RDS and store credentials in Glue connection properties.

Answer

Store the password in a text file in an encrypted S3 bucket and use SSL.

Question 5

A data engineer needs to ensure that an S3 bucket can only be accessed from a specific VPC. Which policy element should be used?

Accepted Answer

Use the condition key aws:SourceVpc in the bucket policy.. The condition key aws:SourceVpc restricts requests to originate from a specific VPC. Option C (aws:SourceVpce) limits access to a VPC endpoint, not the VPC itself. Option B (aws:SourceIp) restricts by IP address, not VPC. Option A (aws:VpcSourceIp) is not a valid condition key.

Answer

Use the condition key aws:VpcSourceIp in the bucket policy.

Answer

Use the condition key aws:SourceIp in the bucket policy.

Answer

Use the condition key aws:SourceVpce in the bucket policy.

Question 6

A company uses Amazon Athena to query data in S3. The security team wants to ensure that users can only query tables they have permissions to in the AWS Glue Data Catalog. Which service should be used to manage these permissions centrally?

Accepted Answer

AWS Lake Formation. Lake Formation provides centralized permissions management for the Glue Data Catalog. Option B (IAM) is too low-level and does not integrate directly with Data Catalog tables. Option C (S3 bucket policy) does not control table access. Option D (CloudTrail) is for auditing, not access control.

Answer

AWS IAM

Answer

AWS CloudTrail

Answer

S3 bucket policies

Question 7

A company has an S3 bucket with versioning enabled and a bucket policy that denies access if the request does not include encryption. A data engineer notices that some objects are not encrypted. What is the most likely cause?

Accepted Answer

The policy only applies to new uploads; existing objects remain unencrypted.. A bucket policy that denies unencrypted requests only applies to new uploads made after the policy is effective. Objects already in the bucket remain unencrypted. Option A is wrong because bucket policies apply to all requests, including those from the same account. Option C is wrong because default encryption would only apply to new objects, not existing ones. Option D is wrong because versioning does not retroactively encrypt existing objects.

Answer

The bucket policy does not evaluate requests from the same account.

Answer

Default encryption was not enabled at the bucket level.

Answer

Versioning was enabled after the objects were uploaded.

Question 8

A data engineer is designing a data pipeline that processes PII data using AWS Glue and stores results in S3. Which TWO actions should be taken to protect the data? (Choose 2)

Accepted Answer

Store database credentials in AWS Secrets Manager and reference them in Glue connections.. Options B and D are correct. Option B: Storing database credentials in AWS Secrets Manager and referencing them in AWS Glue connections ensures that sensitive credentials are not hard-coded or exposed in plaintext, following security best practices for PII data. Option D: Configuring AWS Glue to use a KMS key for encrypting data written to S3 ensures that data at rest in S3 is encrypted with customer-managed keys, providing additional control over encryption. Option A is incorrect because S3 default encryption with SSE-S3 uses Amazon-managed keys and does not provide the same level of control as KMS; more importantly, the question asks for actions to protect PII, and using SSE-S3 alone is not sufficient for compliance with many regulations that require encryption with customer-managed keys. Option C is incorrect because enabling S3 object deletion protection with a retention policy is about preventing accidental deletion, not directly about protecting data from unauthorized access or encryption. Option E is incorrect because HTTPS encrypts data in transit, but the question also requires encryption at rest; HTTPS alone does not protect data at rest in S3.

Answer

Use S3 default encryption with SSE-S3 for the output bucket.

Answer

Enable S3 object deletion protection by setting a retention policy.

Answer

Use HTTPS for all data transfer between Glue and S3.

Question 9

A company uses Amazon Redshift for data warehousing. The security team requires that all queries be logged for audit and that sensitive columns be masked for non-privileged users. Which THREE steps should the data engineer take? (Choose 3)

Accepted Answer

Implement row-level security using Redshift's row-level security feature.. The correct answers are A, B, and E. Option A: Redshift supports row-level security, which restricts access to rows based on user authorization, meeting the requirement to mask sensitive data for non-privileged users. Option B: Enabling audit logging on the Redshift cluster captures all queries for audit purposes, satisfying the logging requirement. Option E: Creating views that expose only non-sensitive columns and granting access to those views is a common method to implement column-level masking in Redshift. Option C is incorrect because AWS CloudTrail logs API calls to Redshift (e.g., cluster operations) but does not log SQL queries; for query logging, audit logging must be enabled. Option D is incorrect because IAM roles control access to the Redshift database itself but cannot restrict access to specific columns; column-level control is achieved through views or column-level security.

Answer

Enable CloudTrail logging for Redshift data events.

Answer

Use IAM roles to restrict access to specific columns.

Question 10

A company wants to enforce encryption in transit for data moving between an EC2 instance and an S3 bucket. Which TWO methods can achieve this? (Choose 2)

Accepted Answer

Add a bucket policy that denies requests without the aws:SecureTransport condition.. Options A and D are correct. Option A: Adding a bucket policy with the aws:SecureTransport condition denies any requests that are not using HTTPS, thus enforcing encryption in transit. Option D: By using the HTTPS endpoint for S3 API calls, data is encrypted in transit via TLS. Option B is incorrect because a VPC endpoint for S3 does not automatically enforce encryption; it only keeps traffic within the AWS network. Option C is incorrect because SSE-S3 is for server-side encryption at rest, not in transit. Option E is incorrect because CloudTrail is a logging service and does not enforce encryption.

Answer

Use a VPC endpoint for S3.

Answer

Enable default SSE-S3 encryption on the bucket.

Answer

Enable CloudTrail to monitor for non-encrypted requests.

Question 11

A financial services company uses Amazon Redshift for its data warehouse. The compliance team requires that all access to the database be logged, including the SQL queries executed, and that the logs be stored in a separate S3 bucket that is encrypted with a customer-managed KMS key. Additionally, the logs must be retained for 7 years. The data engineer has enabled audit logging on the Redshift cluster and configured it to deliver logs to an S3 bucket. However, the compliance team reports that the logs are not being delivered. The S3 bucket policy allows the Redshift service to write logs. What is the most likely reason for the failure?

Accepted Answer

The S3 bucket policy does not include a statement allowing the Redshift service principal to write objects.. Amazon Redshift audit logging requires a specific S3 bucket policy that grants the Redshift service principal permission to write objects. Without this policy statement, log delivery fails. Option A is incorrect because the S3 bucket can be in a different region. Option B is incorrect because versioning does not block log delivery. Option C is incorrect because the issue is the bucket policy, not the KMS key policy; the Redshift service principal needs s3:PutObject permission, not KMS decrypt.

Answer

The S3 bucket is in a different region than the Redshift cluster.

Answer

The S3 bucket has versioning enabled, which blocks log delivery.

Answer

The KMS key policy does not grant the Redshift service principal decrypt permissions.

Question 12

A company uses Amazon S3 to store sensitive customer data. The security policy requires that all objects in the bucket be encrypted at rest using server-side encryption with a customer-managed KMS key. The data engineer has enabled default encryption on the bucket using SSE-KMS with the required KMS key. However, a security scan reveals that some objects in the bucket are not encrypted with the KMS key. The objects were uploaded before the default encryption was enabled. The data engineer needs to ensure that all objects are encrypted with the KMS key without disrupting ongoing data access. What should the data engineer do?

Accepted Answer

Use S3 Batch Operations with a Lambda function to apply SSE-KMS encryption to all existing objects using the KMS key.. S3 Batch Operations can apply SSE-KMS encryption to existing objects without disrupting access. It uses a Lambda function to re-encrypt each object with the specified KMS key. Option A is wrong because copying objects to themselves with the --sse-kms-key-id parameter does not work - it requires a full copy to a new location and back. Option B is wrong because the bucket policy only prevents new unencrypted uploads, it does not fix existing objects. Option C is wrong because deleting and re-uploading disrupts access and is inefficient.

Answer

Use the AWS CLI to copy the objects to themselves with the --sse-kms-key-id parameter.

Answer

Modify the bucket policy to deny access to objects not encrypted with the KMS key.

Answer

Delete the unencrypted objects and re-upload them with encryption.

Question 13

A company uses AWS Glue to catalog data in Amazon S3. The security team requires that all sensitive data be identified and encrypted at rest using customer-managed KMS keys. Which combination of steps should a data engineer take to meet these requirements?

Accepted Answer

Configure AWS Glue to use Detect Sensitive Data and write encrypted output to S3 with SSE-KMS.. AWS Glue provides a 'Detect Sensitive Data' transform (such as FindMatches or custom classifiers) that can be used in a Glue ETL job to identify sensitive data within the catalog. The same ETL job can then write the processed data to Amazon S3 with server-side encryption using customer-managed KMS keys (SSE-KMS), meeting both identification and encryption-at-rest requirements. Option A is incorrect because S3 Access Logs and Athena queries do not directly identify sensitive data patterns reliably, nor do they enforce encryption. Option B is incorrect because Amazon Macie can scan for sensitive data, but it does not automatically apply S3 default encryption; moreover, default encryption uses S3-managed keys, not customer-managed KMS keys. Option C is incorrect because enabling S3 default encryption and using IAM policies addresses encryption and access control but lacks the sensitive data identification step required by the security team.

Answer

Enable S3 Access Logs and use Athena to query the logs for sensitive data patterns.

Answer

Use Amazon Macie to scan the S3 bucket and automatically apply S3 default encryption.

Answer

Enable S3 default encryption for the bucket and use IAM policies to restrict access.

Question 14

A data engineer is setting up cross-account access to an encrypted S3 bucket. The bucket uses a customer-managed KMS key. The engineer has configured the bucket policy and the IAM role in the source account. The target account still gets access denied errors when trying to read objects. What is the most likely cause?

Accepted Answer

The KMS key policy does not grant the target account's IAM role the kms:Decrypt permission.. For cross-account access to an S3 bucket encrypted with a customer-managed KMS key, the KMS key policy must explicitly grant the target account's IAM role the kms:Decrypt permission. Without this, the target account will get access denied errors even if the bucket policy and IAM role are correctly configured. Option B is incorrect because Object Ownership does not affect cross-account read access. Option C is incorrect because the bucket policy only needs to allow the target account's IAM role, not the root user. Option D is incorrect because VPC Endpoint policies are not relevant to this cross-account access issue.

Answer

The S3 bucket has Object Ownership set to BucketOwnerPreferred.

Answer

The bucket policy does not allow the target account's root user.

Answer

The VPC Endpoint policy blocks access from the target account.

Question 15

A company uses Amazon RDS for MySQL with encryption at rest enabled. The security team requires that all database audit logs be stored in Amazon S3 for at least 7 years. Which AWS service should the data engineer use to collect and store the logs?

Accepted Answer

Amazon CloudWatch Logs with a subscription filter to Amazon S3.. Amazon RDS for MySQL can publish audit logs to Amazon CloudWatch Logs. A subscription filter can then forward these logs to Amazon S3 for long-term storage, satisfying the 7-year retention requirement. Option A is wrong because S3 Object Lock is a storage feature, not a log collection service. Option B is wrong because Kinesis Data Firehose is not natively integrated with RDS audit logs. Option D is wrong because AWS CloudTrail captures API calls, not database audit logs.

Answer

Amazon S3 with S3 Object Lock enabled for write-once-read-many (WORM) protection.

Answer

Amazon Kinesis Data Firehose to stream logs directly to Amazon S3.

Answer

AWS CloudTrail to capture database queries and store in S3.