DEA-C01 Data Security and Governance Practice Test 11 — 15 Questions

Question 1

A company uses Amazon Redshift for data warehousing. The security team requires that all queries be logged for audit and that sensitive columns be masked for non-privileged users. Which THREE steps should the data engineer take? (Choose 3)

Accepted Answer

Implement row-level security using Redshift's row-level security feature.. Options A, C, and D are correct. Option A: audit logging captures queries. Option C: column-level access control can be achieved with views. Option D: row-level security filters rows. Option B is wrong because IAM roles do not control column access. Option E is wrong because CloudTrail does not log queries.

Answer

Enable CloudTrail logging for Redshift data events.

Answer

Use IAM roles to restrict access to specific columns.

Question 2

A company wants to enforce encryption in transit for data moving between an EC2 instance and an S3 bucket. Which TWO methods can achieve this? (Choose 2)

Accepted Answer

Add a bucket policy that denies requests without the aws:SecureTransport condition.. Options A and C are correct. Option A: HTTPS ensures encryption in transit. Option C: S3 bucket policy enforcing aws:SecureTransport ensures HTTPS. Option B is wrong because SSE-S3 is for at-rest encryption. Option D is wrong because VPC endpoints do not automatically enforce encryption. Option E is wrong because CloudTrail is for logging.

Answer

Use a VPC endpoint for S3.

Answer

Enable default SSE-S3 encryption on the bucket.

Answer

Enable CloudTrail to monitor for non-encrypted requests.

Question 3

A company runs a data lake on AWS using S3 for storage and AWS Glue for ETL. The security team discovers that a contractor who left the company two months ago still has access to an S3 bucket containing sensitive data. The access was granted via an IAM user that was not deleted. The data engineer is asked to implement a solution to prevent future occurrences. The company uses AWS Organizations and has multiple accounts. The requirement is to automatically detect and remediate IAM users that have not been used for 90 days by disabling their access keys and notifying the security team. The solution must be least privilege and use AWS-native services. Which approach should the data engineer take?

Accepted Answer

Use AWS IAM Access Analyzer to generate findings for unused access and create an AWS Config custom rule with a Lambda function that automatically disables the access keys and sends a notification via SNS.. Option D is correct. AWS IAM Access Analyzer can generate findings for unused access, and AWS Config with a custom rule can auto-remediate by invoking a Lambda function to disable keys and notify via SNS. Option A is wrong because IAM roles are not relevant for user access keys. Option B is wrong because CloudTrail does not automatically disable keys. Option C is wrong because Lake Formation does not manage IAM users.

Answer

Use AWS IAM Access Analyzer to generate findings for unused access and create an AWS Config managed rule to automatically disable the IAM user's access keys.

Answer

Use AWS CloudTrail to monitor IAM user activity and set up a CloudWatch alarm that triggers an SNS notification to the security team to manually disable the keys.

Answer

Use AWS Lake Formation to revoke the permissions of the IAM user and set up a scheduled Lambda function to check for unused IAM users.

Question 4

A financial services company uses Amazon Redshift for its data warehouse. The compliance team requires that all access to the database be logged, including the SQL queries executed, and that the logs be stored in a separate S3 bucket that is encrypted with a customer-managed KMS key. Additionally, the logs must be retained for 7 years. The data engineer has enabled audit logging on the Redshift cluster and configured it to deliver logs to an S3 bucket. However, the compliance team reports that the logs are not being delivered. The S3 bucket policy allows the Redshift service to write logs. What is the most likely reason for the failure?

Accepted Answer

The S3 bucket policy does not include a statement allowing the Redshift service principal to write objects.. Option C is correct. Redshift audit logging requires that the S3 bucket have a specific bucket policy that allows the Redshift service principal to write logs. Without that policy, delivery fails. Option A is wrong because KMS key permissions are not the issue if bucket policy is correct. Option B is wrong because versioning is not required. Option D is wrong because cross-region is supported.

Answer

The S3 bucket is in a different region than the Redshift cluster.

Answer

The S3 bucket has versioning enabled, which blocks log delivery.

Answer

The KMS key policy does not grant the Redshift service principal decrypt permissions.

Question 5

A company uses Amazon S3 to store sensitive customer data. The security policy requires that all objects in the bucket be encrypted at rest using server-side encryption with a customer-managed KMS key. The data engineer has enabled default encryption on the bucket using SSE-KMS with the required KMS key. However, a security scan reveals that some objects in the bucket are not encrypted with the KMS key. The objects were uploaded before the default encryption was enabled. The data engineer needs to ensure that all objects are encrypted with the KMS key without disrupting ongoing data access. What should the data engineer do?

Accepted Answer

Use S3 Batch Operations with a Lambda function to apply SSE-KMS encryption to all existing objects using the KMS key.. Option A is correct. S3 Batch Operations can apply SSE-KMS encryption to existing objects using the KMS key. Option B is wrong because copying objects manually is inefficient and error-prone. Option C is wrong because the bucket policy only prevents new unencrypted uploads. Option D is wrong because deleting and re-uploading is disruptive.

Answer

Use the AWS CLI to copy the objects to themselves with the --sse-kms-key-id parameter.

Answer

Modify the bucket policy to deny access to objects not encrypted with the KMS key.

Answer

Delete the unencrypted objects and re-upload them with encryption.

Question 6

A company uses AWS Glue to catalog data in Amazon S3. The security team requires that all sensitive data be identified and encrypted at rest using customer-managed KMS keys. Which combination of steps should a data engineer take to meet these requirements?

Accepted Answer

Configure AWS Glue to use Detect Sensitive Data and write encrypted output to S3 with SSE-KMS.. Option B is correct because using AWS Glue FindMatches ML transforms or custom classifiers with Detect Sensitive Data can identify sensitive data, and then the Glue ETL job can write to S3 with SSE-KMS. Option A is wrong because S3 default encryption does not guarantee customer-managed KMS keys. Option C is wrong because Macie is not integrated directly with Glue cataloging. Option D is wrong because S3 Access Logs do not help with identification or encryption.

Answer

Enable S3 Access Logs and use Athena to query the logs for sensitive data patterns.

Answer

Use Amazon Macie to scan the S3 bucket and automatically apply S3 default encryption.

Answer

Enable S3 default encryption for the bucket and use IAM policies to restrict access.

Question 7

A data engineer is setting up cross-account access to an encrypted S3 bucket. The bucket uses a customer-managed KMS key. The engineer has configured the bucket policy and the IAM role in the source account. The target account still gets access denied errors when trying to read objects. What is the most likely cause?

Accepted Answer

The KMS key policy does not grant the target account's IAM role the kms:Decrypt permission.. Option B is correct because cross-account access with customer-managed KMS keys requires the key policy to grant the target account's IAM role permission to use the key. Option A is wrong because the bucket policy and IAM role are correctly configured. Option C is wrong because S3 Object Ownership does not affect cross-account read access. Option D is wrong because VPC Endpoint policies are not the issue here.

Answer

The S3 bucket has Object Ownership set to BucketOwnerPreferred.

Answer

The bucket policy does not allow the target account's root user.

Answer

The VPC Endpoint policy blocks access from the target account.

Question 8

A company uses Amazon RDS for MySQL with encryption at rest enabled. The security team requires that all database audit logs be stored in Amazon S3 for at least 7 years. Which AWS service should the data engineer use to collect and store the logs?

Accepted Answer

Amazon CloudWatch Logs with a subscription filter to Amazon S3.. Option A is correct because RDS for MySQL can publish audit logs to CloudWatch Logs, and a subscription filter can forward them to S3 for long-term storage. Option B is wrong because Kinesis Data Firehose is not directly integrated with RDS audit logs. Option C is wrong because S3 is for storage, not collection. Option D is wrong because CloudTrail does not capture RDS audit logs.

Answer

Amazon S3 with S3 Object Lock enabled for write-once-read-many (WORM) protection.

Answer

Amazon Kinesis Data Firehose to stream logs directly to Amazon S3.

Answer

AWS CloudTrail to capture database queries and store in S3.

Question 9

A company has a data lake in Amazon S3 with millions of objects. The security team wants to enforce that all objects are encrypted with a specific customer-managed KMS key. The data engineer configures an S3 bucket policy to deny PutObject if the encryption is not set to that key. However, some existing objects are not encrypted with that key. What is the most efficient way to remediate the existing objects?

Accepted Answer

Use S3 Batch Operations to copy objects in the same bucket with the new encryption settings.. Option D is correct because S3 Batch Operations can copy objects in place with new encryption settings, efficiently updating millions of objects. Option A is wrong because it is inefficient for millions of objects. Option B is wrong because S3 Replication is for cross-region or cross-bucket copying. Option C is wrong because S3 Object Lambda modifies data on read, not at rest.

Answer

Use S3 Cross-Region Replication to replicate objects to a new bucket with the correct encryption.

Answer

Write a script using the AWS SDK to iterate over all objects and re-upload them with the correct encryption.

Answer

Use S3 Object Lambda to dynamically encrypt objects on read.

Question 10

A company uses AWS Lake Formation to manage permissions on a data lake. A data engineer creates a table in the Data Catalog and grants SELECT permission to a group of analysts. The analysts report they can see the table but get an AccessDenied error when querying it with Amazon Athena. What is the most likely cause?

Accepted Answer

The analysts' IAM role does not have permission to call the Athena API.. Option C is correct because Lake Formation integrates with Athena for fine-grained access control. The analysts need both Lake Formation permissions and IAM permissions to use Athena. Option A is wrong because S3 bucket policy is not the issue if Lake Formation is managing permissions. Option B is wrong because Workgroup settings are not likely the cause. Option D is wrong because the table is registered with Lake Formation.

Answer

The table is not registered with Lake Formation as a resource.

Answer

The Athena workgroup is configured with a per-query result location that the analysts cannot write to.

Answer

The S3 bucket policy does not allow the analysts' IAM role.

Question 11

A data engineer needs to encrypt data at rest in Amazon S3 using server-side encryption with a customer-managed KMS key. Which TWO steps are required to ensure that the KMS key can be used for S3 object encryption?

Accepted Answer

Add a statement in the KMS key policy that allows the S3 service to use the key.. Options A and B are correct. The KMS key policy must grant the S3 service principal kms:GenerateDataKey and kms:Decrypt permissions. Option C is not required because S3 does not use KMS via VPC. Option D is not required because S3 does not need to assume a role for SSE-KMS. Option E is not required because SSE-KMS does not use S3 bucket policies.

Answer

Configure a VPC endpoint for KMS to allow S3 to access the key.

Answer

Set the S3 bucket policy to require SSE-KMS for all PutObject requests.

Answer

Create a service-linked role for S3 to access KMS.

Question 12

A company is using AWS Lake Formation to manage a data lake. The data engineer needs to set up fine-grained access control so that users can only see specific columns in a table based on their IAM role. Which THREE steps should the data engineer take?

Accepted Answer

Ensure that the users query the table through a service integrated with Lake Formation, such as Athena.. Options A, B, and D are correct. Lake Formation column-level access requires defining the policy in Lake Formation, granting permissions to the IAM role, and the user must use Lake Formation-enabled services. Option C is wrong because S3 bucket policies are not used for column-level control. Option E is wrong because the table must be registered with Lake Formation.

Answer

Create a view in the Data Catalog that exposes only the required columns.

Answer

Attach an S3 bucket policy to restrict access to the underlying data.

Question 13

A company wants to audit all API calls made to Amazon S3 and Amazon RDS resources. Which TWO AWS services can be used together to achieve this?

Accepted Answer

AWS CloudTrail. Options A and B are correct. CloudTrail records API calls to S3 and RDS, and CloudWatch Logs can store the logs for monitoring. Option C is wrong because Config records resource configuration changes, not API calls. Option D is wrong because GuardDuty is a threat detection service. Option E is wrong because Macie is for data classification.

Answer

AWS Config

Answer

Amazon GuardDuty

Answer

Amazon Macie

Question 14

A data engineer needs to securely store database credentials used by an AWS Glue ETL job. Which THREE steps should the engineer take?

Accepted Answer

Store the credentials in AWS Secrets Manager.. Options A, B, and D are correct. AWS Secrets Manager securely stores credentials, and the Glue job can retrieve them via the AWS Secrets Manager connector or directly from the service. Option C is wrong because hardcoding credentials is insecure. Option E is wrong because Parameter Store does not support automatic rotation.

Answer

Hardcode the credentials in the Glue job script.

Answer

Use AWS Systems Manager Parameter Store with a SecureString parameter.

Question 15

A company uses Amazon Redshift for its data warehouse and needs to enforce column-level security on sensitive columns. Which TWO approaches can achieve this?

Accepted Answer

Create views that expose only non-sensitive columns and grant access to the views.. Options A and D are correct. Redshift column-level security allows defining access controls at the column level. Views can also restrict column access. Option B is wrong because row-level security does not restrict columns. Option C is wrong because S3 bucket policies are unrelated. Option E is wrong because Redshift Spectrum queries external data, not column-level control.

Answer

Apply an S3 bucket policy to the underlying data files.

Answer

Use Redshift Spectrum to query external tables and restrict columns via the external schema.

Answer

Use Redshift row-level security policies to restrict column access.