DEA-C01 Data Security and Governance Practice Test 11 — 15 Questions

Question 1

A company uses Amazon RDS for MySQL to store application data. The security team requires that all database credentials be rotated automatically every 90 days. The data engineer needs to implement a solution that minimizes operational overhead. The database credentials are stored in AWS Secrets Manager. The application retrieves the credentials at startup and caches them for the duration of the session. The application is deployed on Amazon ECS with Fargate. Which solution should the data engineer implement to meet the rotation requirement with minimal overhead?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use Secrets Manager's automatic rotation feature with a custom Lambda function that updates the RDS password.. Secrets Manager's built-in automatic rotation with a custom Lambda rotation function updates the RDS password and the secret value on a 90-day schedule, requiring no manual intervention. Because the application retrieves credentials at startup and caches them, it will pick up the new password on its next restart, minimizing operational overhead.

Answer

Store the credentials in AWS Systems Manager Parameter Store and use a scheduled job to update the password.

Answer

Create a scheduled Lambda function that updates the password in Secrets Manager and manually updates the application configuration.

Answer

Configure IAM database authentication for the RDS instance and update the application to use IAM credentials.

Question 2

A company is using Amazon S3 to store log files. The security team wants to ensure that any object uploaded to the S3 bucket is automatically scanned for malware before being processed by downstream applications. The data engineer needs to implement a solution that integrates with AWS services and minimizes latency. The bucket receives thousands of objects per day. Which solution should the data engineer use?

Accepted Answer

Enable Amazon GuardDuty with malware protection for S3.. Amazon GuardDuty Malware Protection for S3 automatically scans newly uploaded objects for malware using AWS-managed scanning infrastructure, integrates natively with S3 event notifications, and requires no EC2 instances or agents to manage. It is designed for high-volume buckets and provides findings through GuardDuty without adding significant latency to downstream processing. This meets the requirement for an integrated, low-latency, scalable malware scanning solution.

Answer

Deploy an EC2 instance with antivirus software that triggers on S3 events.

Answer

Use AWS WAF to inspect objects as they are uploaded.

Answer

Enable Amazon Macie on the S3 bucket to detect malware.

Question 3

A data engineering team uses AWS Glue ETL jobs to process data from an S3 data lake and load it into an Amazon Redshift cluster. The security policy mandates that all data in transit between AWS Glue and Redshift must be encrypted using TLS. The team uses a JDBC connection. Currently, the connection is failing with an SSL-related error. Which configuration change should the team make to ensure encrypted connectivity?

Accepted Answer

Update the JDBC connection string to include ssl=true and sslmode=require.. To enforce TLS encryption for the JDBC connection between AWS Glue and Redshift, the connection string must include SSL parameters. Adding ssl=true and sslmode=require instructs the JDBC driver to use SSL and require it, ensuring data in transit is encrypted. This directly addresses the SSL error and meets the security policy.

Answer

Modify the Redshift security group to allow inbound traffic on port 5439 from the Glue subnet.

Answer

Enable server-side encryption on the S3 bucket using AWS KMS.

Answer

Set the Redshift cluster parameter group to require_ssl=ON.

Question 4

A data analytics company uses Amazon Athena to query data stored in an S3 bucket. The data contains personally identifiable information (PII). The security team wants to ensure that only authorized users can access the data through Athena, and that the data is encrypted at rest in S3. Which combination of actions should the company take? (Choose two.)

Accepted Answer

Attach an IAM policy to users that grants Athena access and S3 read access to the bucket.. Option A is correct because attaching an IAM policy that grants Athena access (e.g., athena:StartQueryExecution, athena:GetQueryResults) and S3 read access (s3:GetObject, s3:ListBucket) to the specific bucket is the standard way to authorize users to query the PII data through Athena while restricting access to only authorized principals. Option E is correct because enabling server-side encryption with SSE-S3 (AES-256) on the S3 bucket ensures the data is encrypted at rest, satisfying the encryption requirement. Option B is not required here because Lake Formation is a separate permission layer for data lakes and is not necessary when IAM policies already govern Athena and S3 access for this scenario. Option C is incorrect because Kinesis is a streaming service and has no role in controlling Athena access or encrypting S3 data at rest. Option D is incorrect because an S3 Access Point with a restricted policy is an alternative access mechanism, not a required combination for granting Athena access and enabling encryption at rest.

Answer

Use AWS Lake Formation to define data lake permissions.

Answer

Use AWS Kinesis to stream data to Athena.

Answer

Create an S3 Access Point with a restricted policy.

Question 5

A company uses AWS Lake Formation to manage permissions on a data lake stored in S3. A data scientist is unable to query a table in Amazon Athena, receiving an 'Access Denied' error. The data scientist has IAM permissions to call Athena and has been granted SELECT permission on the table in Lake Formation. What is the most likely cause?

Accepted Answer

The S3 bucket containing the data is not registered as a Lake Formation location.. Lake Formation requires that the S3 location containing the data be registered with Lake Formation before it can manage fine-grained access to that data. If the bucket is not registered, Lake Formation cannot enforce or grant access, and Athena queries fail with Access Denied even when the user has SELECT permission on the table. Registering the location establishes the trust relationship that allows Lake Formation to vend credentials to the query engine.

Answer

The data scientist does not have DESCRIBE permission on the table.

Answer

The data is encrypted with SSE-KMS and the data scientist lacks kms:Decrypt permission.

Answer

The S3 bucket policy denies access to the data scientist's IAM role.

Question 6

A data engineer needs to grant an IAM user read-only access to a specific prefix (folder) in an S3 bucket. The bucket contains sensitive data. Which S3 bucket policy statement achieves this?

Accepted Answer

{"Effect":"Allow","Principal":{"AWS":"arn:aws:iam::123456789012:user/DataEng"},"Action":"s3:GetObject","Resource":"arn:aws:s3:::mybucket/sensitive/*"}. It grants s3:GetObject for the specific prefix and denies access to other prefixes implicitly. Option A is wrong because it grants access to all objects. Option C is wrong because it uses a condition that does not restrict prefix. Option D is wrong because it grants access to all objects in the bucket.

Answer

{"Effect":"Allow","Principal":{"AWS":"arn:aws:iam::123456789012:user/DataEng"},"Action":"s3:GetObject","Resource":"arn:aws:s3:::mybucket"}

Answer

{"Effect":"Allow","Principal":{"AWS":"arn:aws:iam::123456789012:user/DataEng"},"Action":"s3:GetObject","Resource":"arn:aws:s3:::mybucket/*","Condition":{"StringLike":{"s3:prefix":"sensitive/"}}}

Answer

{"Effect":"Allow","Principal":{"AWS":"arn:aws:iam::123456789012:user/DataEng"},"Action":"s3:GetObject","Resource":"arn:aws:s3:::mybucket/*"}

Question 7

A company is designing a data lake on AWS using S3. The security team requires that all data be encrypted at rest and that encryption keys be rotated annually. Which services can be used to meet these requirements? (Choose TWO.)

Accepted Answer

AWS Key Management Service (AWS KMS). AWS KMS (option C) is correct because it provides customer managed keys (CMKs) that support automatic annual rotation, and S3 server-side encryption with SSE-KMS encrypts objects at rest using those keys, satisfying both the encryption and rotation requirements. Amazon S3 managed keys (SSE-S3, option E) is also correct because it encrypts all objects at rest with AES-256 and S3 automatically rotates the underlying keys annually at no additional cost, meeting the stated requirements without customer key management. AWS Secrets Manager (option A) is for storing and rotating secrets such as database credentials and API keys, not for encrypting S3 data at rest. AWS Certificate Manager (option B) issues and manages TLS/SSL certificates for data in transit, not encryption at rest. AWS CloudHSM (option D) provides dedicated hardware security modules for key storage and cryptographic operations, but it does not by itself deliver S3 at-rest encryption with built-in annual key rotation as required here.

Answer

AWS Secrets Manager

Answer

AWS Certificate Manager (ACM)

Answer

AWS CloudHSM

Question 8

A data engineer needs to audit all access to an S3 bucket containing sensitive data. The engineer must capture who accessed the bucket, from which IP address, and what actions were performed. Which AWS services should be used together to meet this requirement? (Choose THREE.)

Accepted Answer

Amazon CloudWatch Logs. AWS CloudTrail (D) is correct because it records S3 data-plane API calls such as GetObject and PutObject, capturing the IAM identity (who), the source IP address, and the specific action performed, which is exactly the audit detail required. Amazon S3 server access logs (C) are correct because they provide detailed, object-level records of every request made to the bucket, including the requester, source IP, request time, and operation, complementing CloudTrail for full access auditing. Amazon CloudWatch Logs (A) is correct because it is the destination where these logs (CloudTrail events via a trail and S3 access logs delivered through logging) are centralized, stored, and made searchable with metric filters and Logs Insights for auditing and alerting. AWS Config (B) is not correct because it records resource configuration changes and compliance state, not individual data-access events or source IPs. VPC Flow Logs (E) is not correct because it captures IP-level network traffic metadata for ENIs, subnets, and VPCs, but cannot identify S3 object actions or the IAM principal who performed them.

Answer

AWS Config

Answer

VPC Flow Logs

Question 9

A company uses Amazon Redshift for data warehousing. The security team requires that data be encrypted at rest using a customer-managed key (CMK) in AWS KMS, and that the key be rotated automatically every year. Additionally, the team wants to restrict access to the key to only the Redshift cluster and a security admin IAM role. Which steps should the company take? (Choose THREE.)

Accepted Answer

Add the security admin IAM role as a key user in the KMS key policy.. Option A is correct because the KMS key policy must explicitly grant the security admin IAM role kms:Decrypt, kms:DescribeKey, and related permissions as a key user; otherwise, even an administrator role cannot use the CMK unless it is listed in the policy or has permissions via IAM plus the key policy. Option C is correct because automatic key rotation is enabled as a property of the KMS customer-managed key itself (via EnableKeyRotation, which sets a rotation period of one year by default), satisfying the requirement that the key rotate automatically every year. Option E is correct because a Redshift cluster's encryption key cannot be changed after creation — you cannot alter an existing unencrypted or differently-encrypted cluster to use a new CMK, so you must create a new cluster specifying the CMK (or restore from a snapshot with the new key). Option B is incorrect because ALTER CLUSTER cannot change the KMS key of an existing Redshift cluster; encryption settings are fixed at creation. Option D is incorrect because disabling rotation directly contradicts the requirement for automatic annual rotation.

Answer

Alter the existing Redshift cluster to enable encryption with the CMK.

Answer

Disable automatic key rotation to comply with security policy.

Question 10

A company is using AWS Glue to catalog data in S3. The security team wants to ensure that only authorized users can access the Glue Data Catalog and that data lineage is tracked. Which AWS services can be used together to meet these requirements? (Choose TWO.)

Accepted Answer

AWS Glue DataBrew. AWS Lake Formation (D) is correct because it provides fine-grained, table- and column-level access control over the Glue Data Catalog, letting you grant or revoke permissions to specific principals so only authorized users can access cataloged data. AWS Glue DataBrew (B) is correct because it includes data lineage tracking, automatically capturing the origin and transformation history of datasets as they are prepared, which satisfies the lineage requirement. Together, Lake Formation enforces catalog authorization while DataBrew records lineage. AWS CloudTrail (A) only logs API activity for auditing and does not itself control catalog access or provide data lineage. Amazon Athena (C) is a query service that reads the catalog but does not manage permissions or lineage. Amazon Kinesis (E) is a streaming data service unrelated to catalog access control or lineage.

Answer

AWS CloudTrail

Answer

Amazon Athena

Answer

Amazon Kinesis

Question 11

A data engineer is configuring an S3 bucket policy to allow cross-account access for a partner organization to write data to a specific prefix. The partner's AWS account ID is 111111111111. The engineer wants to ensure that only the partner can write, and that the partner cannot read or delete objects. Which policy statements should be included? (Choose TWO.)

Accepted Answer

{"Effect":"Allow","Principal":{"AWS":"111111111111"},"Action":"s3:PutObject","Resource":"arn:aws:s3:::mybucket/partner/*"}. Option C is correct because it grants the partner account (Principal {"AWS":"111111111111"}) only the s3:PutObject action on the specific prefix arn:aws:s3:::mybucket/partner/*, which is exactly the write-only access requested. Option E is correct because the explicit Deny with NotAction s3:PutObject on the same prefix blocks every other S3 action (including s3:GetObject and s3:DeleteObject) for that principal, enforcing the requirement that the partner cannot read or delete objects. Together, C allows the write and E denies all non-write actions, satisfying both constraints. Option A is not marked correct because it scopes the principal to a specific IAM user ARN rather than the account, which is narrower than the stated requirement and not one of the chosen answers. Option B is not marked correct because Principal "*" with only an aws:SourceAccount condition is a confused-deputy pattern that does not restrict the principal to the partner account as directly as an account principal. Option D is not marked correct because it explicitly grants s3:GetObject and s3:DeleteObject, which directly violates the requirement that the partner cannot read or delete.

Answer

{"Effect":"Allow","Principal":{"AWS":"arn:aws:iam::111111111111:user/PartnerUser"},"Action":"s3:PutObject","Resource":"arn:aws:s3:::mybucket/partner/*"}

Answer

{"Effect":"Allow","Principal":"*","Action":"s3:PutObject","Resource":"arn:aws:s3:::mybucket/partner/*","Condition":{"StringEquals":{"aws:SourceAccount":"111111111111"}}}

Answer

{"Effect":"Allow","Principal":{"AWS":"111111111111"},"Action":["s3:GetObject","s3:DeleteObject"],"Resource":"arn:aws:s3:::mybucket/partner/*"}

Question 12

A financial services company uses Amazon Athena to query a data lake in S3. The data lake contains sensitive financial transactions. The security team has implemented row-level security using views in AWS Glue Data Catalog. Each view is defined with a WHERE clause that filters rows based on the user's IAM role using a custom tag. However, when a data analyst runs a SELECT * FROM view_name in Athena, the query returns all rows, ignoring the row-level filter. The analyst's IAM role has the tag 'department=analytics'. The view was created with a filter condition 'department = current_user_department()', where current_user_department() is a user-defined function that extracts the department tag from the caller's IAM role. The function is defined in the Glue Data Catalog. What is the most likely reason the filter is not applied?

Accepted Answer

The view is not defined with the filter condition properly; the function current_user_department() may not be invoked correctly in the view definition.. Athena views are stored as Hive-style view definitions in the Glue Data Catalog, and Athena does not evaluate arbitrary UDFs (especially ones that read IAM tags) at query time inside a view's WHERE clause. The filter 'department = current_user_department()' is effectively a no-op because the function cannot resolve the caller's IAM tag context during Athena query execution, so the WHERE predicate does not restrict rows and SELECT * returns everything. The most likely cause is that the view's filter condition was not defined in a way Athena can actually enforce.

Answer

The user-defined function current_user_department() is not registered in the Glue Data Catalog.

Answer

Athena does not support user-defined functions in views.

Answer

The IAM role does not have the tag 'department=analytics'.

Question 13

A company uses Amazon RDS for MySQL to store application data. The database contains personally identifiable information (PII). The security team requires that all data be encrypted at rest using AWS KMS. The database is currently unencrypted. The data engineer needs to enable encryption without significant downtime. Which approach should the data engineer take?

Accepted Answer

Take a snapshot of the database, copy it with encryption enabled, and restore from the encrypted snapshot.. To enable encryption on an existing unencrypted RDS instance, you must take a snapshot of the database, copy it with encryption enabled (using AWS KMS), and restore from the encrypted snapshot. This process involves downtime during the restore but is the only supported method. Option A is incorrect because AWS DMS can migrate data to a new encrypted RDS instance, but that adds complexity and is not the simplest approach. Option C is incorrect because read replicas cannot be promoted to primary if encryption is enabled on the replica but not on the source; also, the source must be encrypted. Option D is incorrect because you cannot modify an existing RDS instance to enable encryption directly; encryption can only be enabled when creating a new instance from an encrypted snapshot.

Answer

Use AWS DMS to migrate data to a new encrypted RDS instance continuously.

Answer

Create a read replica with encryption enabled and promote it to primary.

Answer

Modify the RDS instance and enable encryption in the configuration.

Question 14

A data engineering team uses AWS Lambda functions to process streaming data from Amazon Kinesis Data Streams and write the results to an S3 bucket. The S3 bucket is encrypted with SSE-KMS using a customer-managed key (CMK). The Lambda function's IAM role has permissions for kms:Decrypt and kms:GenerateDataKey on the CMK. However, the Lambda function fails with an 'Access Denied' error when writing to S3. The S3 bucket policy allows s3:PutObject from the Lambda function's IAM role. What is the most likely cause?

Accepted Answer

The S3 bucket policy denies s3:PutObject from the Lambda function.. The most likely cause is that the S3 bucket policy denies s3:PutObject from the Lambda function's IAM role. Even though the stem states the policy allows, there could be an explicit deny statement that overrides, resulting in an 'Access Denied' error. The Lambda function's IAM role has the necessary KMS permissions (kms:GenerateDataKey and kms:Decrypt) for SSE-KMS writes, so missing kms:Encrypt is not the issue. Option A is incorrect because invocation permissions are unrelated. Option B is incorrect because kms:Encrypt is not required for SSE-KMS writes. Option D is incorrect because Kinesis stream encryption is unrelated.

Answer

The Lambda function's execution role does not have permission to invoke the function.

Answer

The Lambda function's IAM role is missing the kms:Encrypt permission on the CMK.

Answer

The Kinesis data stream is not encrypted, causing the Lambda function to fail.

Question 15

A multinational corporation uses AWS Organizations to manage multiple accounts. The data engineering team has a central data lake account that stores all data in S3. The security team requires that all cross-account access to the data lake be logged and that any access from outside the organization be blocked. The team has enabled S3 server access logs and AWS CloudTrail. However, they notice that some requests from an external AWS account are still able to read data from the data lake. The bucket policy currently allows cross-account access to a specific partner account for data exchange. What additional step should the team take to block access from all other external accounts?

Accepted Answer

Add a Deny statement to the bucket policy that denies access to any principal not in the organization or the partner account.. Adding a Deny statement that explicitly blocks any principal not in the organization or the partner account ensures that all other external accounts are denied access, even if an Allow statement exists. In S3 bucket policies, an explicit Deny always overrides any Allow, so this is the most effective way to block unauthorized external access.

Answer

Add a condition to the existing Allow statement to require that the source account be in the organization.

Answer

Remove the cross-account access statement from the bucket policy.

Answer

Use S3 Access Points to restrict access to only the partner account.