DEA-C01 Data Security and Governance Practice Test 12 — 15 Questions

Question 1

A healthcare company stores sensitive patient data in an S3 bucket (bucket name: patient-data-prod). The security team requires that all data be encrypted in transit and at rest, and that access be logged for auditing. The company currently uses S3 default encryption with SSE-S3. An external auditor finds that some objects have been uploaded without encryption because the default encryption setting was not applied to objects uploaded before the setting was enabled. The company wants to prevent any future unencrypted uploads and ensure all existing objects are encrypted. Which combination of actions should the data engineer take? (Choose TWO.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use S3 Batch Operations to copy all existing objects in place with the 'Copy' operation to apply default encryption.. Option A is correct because S3 Batch Operations can run a Copy operation across all existing objects in patient-data-prod, and an in-place copy re-writes each object through S3's PUT path so the bucket's default encryption is applied to objects that were uploaded before encryption was enabled. Option E is correct because a bucket policy that denies s3:PutObject when the x-amz-server-side-encryption header is not set to 'AES256' enforces encryption at rest on every future upload, preventing unencrypted objects from being written. Option C is not correct because default encryption is already in use (SSE-S3) and enabling it again does not retroactively encrypt existing objects or block unencrypted PUTs. Option B is not correct because S3 Object Ownership and a private ACL address access control, not encryption at rest or in transit. Option D is not correct because requiring the x-amz-server-side-encryption-aws-kms-key-id header would enforce SSE-KMS, which is not the stated requirement and would reject the SSE-S3 AES256 uploads the company currently uses.

Answer

Enable S3 Object Ownership and set the bucket ACL to private.

Answer

Enable S3 default encryption on the bucket.

Answer

Create a bucket policy that denies s3:PutObject if the x-amz-server-side-encryption-aws-kms-key-id is not present.

Question 2

A data team uses AWS Glue ETL jobs to process data from an S3 bucket (s3://data-lake-raw) and write results to another S3 bucket (s3://data-lake-processed). Both buckets are encrypted with SSE-KMS using the same KMS key (alias 'data-key'). The Glue job runs in the same account. The team recently enabled S3 Server Access Logging for the raw bucket, sending logs to a separate logging account. After enabling logging, the Glue job starts failing with 'AccessDenied' when reading from the raw bucket. The Glue job's IAM role has s3:GetObject permission on the raw bucket. Which additional permission is most likely missing?

Accepted Answer

kms:Decrypt on the KMS key (alias 'data-key').. When S3 Server Access Logging is enabled for a bucket encrypted with SSE-KMS, the S3 service must write log objects to the target bucket. If the target bucket is in a different account, the S3 service needs permission to use the KMS key. However, the failure is on the Glue job reading from the raw bucket, not writing logs. The issue could be that the raw bucket's S3 access log delivery writes to a target bucket that uses a different KMS key, but that would affect logging, not Glue reads. Re-reading: The Glue job reading the raw bucket fails after enabling logging. It's likely that the raw bucket policy was modified to allow log delivery, inadvertently restricting other access. Actually, the most likely cause is that the S3 bucket policy now includes a condition that denies access unless a specific header is present, or the KMS key policy was changed. Given the options, the correct answer is that the KMS key policy for the data-key now denies the Glue role because the S3 service principal was added for cross-account logging. But the Glue role needs kms:Decrypt permission. The scenario says the same key is used for both buckets. The correct answer is B: The KMS key policy does not allow the Glue role to decrypt because the S3 log delivery service is using the key and the key policy may have a condition. Actually, the most direct answer: The Glue role is missing kms:Decrypt permission on the KMS key. But the team might have added a statement to allow S3 logging that inadvertently denies the Glue role. However, the simplest answer is that the Glue role lacks kms:Decrypt. But the question says 'Which additional permission is most likely missing?' The options are specific permissions. I'll go with the need for kms:Decrypt on the KMS key.

Answer

s3:GetBucketLocation on the raw bucket.

Answer

s3:PutObject on the processed bucket.

Answer

kms:GenerateDataKey on the KMS key.

Question 3

A data engineer stores customer PII in an Amazon S3 bucket that uses SSE-KMS with a customer managed key. An analytics team's AWS Glue ETL job reads from this bucket and writes results to a separate S3 bucket using a different customer managed key. The Glue job's IAM role currently has s3:GetObject and s3:PutObject permissions on both buckets but jobs fail with an access denied error referencing KMS. Which change will resolve the failure with the least privilege?

Accepted Answer

Add kms:Decrypt for the source bucket's key and kms:GenerateDataKey for the destination bucket's key to the Glue job role's IAM policy.. When S3 objects use SSE-KMS, the caller needs both the S3 object permission and the corresponding KMS data-plane permission. Reading requires kms:Decrypt on the source key, while writing with SSE-KMS requires kms:GenerateDataKey and kms:Encrypt on the destination key. Granting those operations on the specific keys involved fixes the access denied error without over-provisioning rights.

Answer

Attach the AWSKeyManagementServicePowerUser managed policy to the Glue job role so it inherits the necessary KMS permissions.

Answer

Add kms:* on all keys in the account to the Glue job role so the job can read and write any encrypted object.

Answer

Change both S3 buckets to SSE-S3 encryption so the Glue job no longer needs any KMS permissions.

Question 4

A data engineer is configuring an AWS Glue ETL job that reads from an Amazon S3 bucket and writes to another S3 bucket. The security team mandates that all data at rest in both buckets be encrypted with customer-managed AWS KMS keys and that the job be able to decrypt and encrypt without embedding secrets. The engineer attaches an IAM role to the Glue job. Which action must the engineer take to allow the Glue job to use the KMS keys?

Accepted Answer

Add kms:Decrypt and kms:Encrypt permissions for the specific KMS key ARNs to the Glue job's IAM role.. The Glue job assumes an IAM role, so the role's identity-based policy must allow the necessary KMS actions on the specific key ARNs. For reading SSE-KMS objects, kms:Decrypt is required; for writing with SSE-KMS, kms:GenerateDataKey and kms:Encrypt are required. Key policies alone are not enough because they must also permit the role, and Secrets Manager does not grant cryptographic permissions.

Answer

Enable default encryption on the S3 buckets using SSE-S3 instead of SSE-KMS.

Answer

Modify the KMS key policy to allow the AWS Glue service principal to use the key.

Answer

Configure the Glue job to use a secret stored in AWS Secrets Manager that contains the KMS key ID.

Question 5

A data engineer is implementing column-level encryption for sensitive fields in an Amazon Redshift table. The requirements are: (1) the encryption keys must be managed centrally and rotated automatically, and (2) the encrypted data must remain queryable using Redshift SQL functions. Which TWO approaches meet these requirements? (Choose two.)

Accepted Answer

Use AWS KMS to generate and manage data keys, and use Redshift's ENCRYPT and DECRYPT functions with the key material.. Column-level encryption in Redshift requires using SQL functions like ENCRYPT and DECRYPT with a key. To meet centralized management and automatic rotation, the key should be managed by AWS KMS or AWS Secrets Manager. Both services provide secure storage and rotation. Using KMS directly with Redshift functions, or retrieving keys from Secrets Manager, satisfies the requirements. Other options either misrepresent Redshift features or address cluster-level encryption.

Answer

Use Redshift's built-in column-level encryption with a cluster-managed key that rotates every 90 days.

Answer

Use AWS KMS to encrypt the entire Redshift cluster, which automatically encrypts all columns and allows decryption via SQL.

Answer

Use Redshift Spectrum to query encrypted data in Amazon S3, leveraging S3 server-side encryption with KMS.

Question 6

A data engineer is building an AWS Glue ETL job that must read and write data in Amazon S3 on behalf of several different business units. The security team requires that each unit's data be encrypted with a distinct customer managed key in AWS KMS, and that the job itself never stores long-term AWS credentials. Which approach should the data engineer use to meet these requirements?

Accepted Answer

Attach an IAM role to the AWS Glue job that allows kms:Decrypt and kms:GenerateDataKey on the relevant customer managed keys, and let S3 server-side encryption with SSE-KMS use those keys.. Attaching an IAM role to the AWS Glue job gives temporary, automatically rotated credentials, satisfying the no-long-term-credentials rule. Granting that role kms:Decrypt and kms:GenerateDataKey on each business unit's customer managed key allows S3 SSE-KMS operations under the correct key for each unit. The other approaches either embed static credentials, share one data key across units, or use AWS-managed keys that cannot be scoped per unit.

Answer

Enable default S3 encryption with SSE-S3 and configure bucket policies that deny unencrypted PUT requests, then run the Glue job with its standard service role.

Answer

Generate a KMS data key with GenerateDataKey, encrypt the plaintext key under a customer managed key, and store the wrapped key in the Glue job script.

Answer

Create an IAM user for the Glue job, generate an access key, and store the credentials in AWS Secrets Manager so the job can retrieve them at runtime.

Question 7

A company uses Amazon Redshift to store sensitive data. The security team requires that all data in the cluster be encrypted at rest using a customer-managed AWS KMS key and that the key be rotated annually. A data engineer needs to enable encryption on an existing unencrypted Redshift cluster. What should the engineer do?

Accepted Answer

Modify the Redshift cluster to enable KMS encryption, specifying the customer-managed key.. Amazon Redshift supports modifying an existing unencrypted cluster to enable KMS encryption. You can specify a customer-managed KMS key and enable automatic rotation. This directly satisfies the requirement without creating a new cluster. Other options either create a new cluster, use invalid parameters, or misunderstand how KMS keys are associated with Redshift.

Answer

Create a new encrypted Redshift cluster from a snapshot of the unencrypted cluster.

Answer

Use AWS KMS to create a new key and attach it to the Redshift cluster's IAM role.

Answer

Enable encryption by turning on the encrypt_using_kms parameter in the Redshift parameter group.

Question 8

A data engineer is configuring encryption for an AWS Glue ETL job that reads from and writes to Amazon S3. The security team requires that data is encrypted at rest using SSE-KMS with a customer managed key, and that data in transit is encrypted. The engineer needs to ensure the Glue job meets these requirements. Which TWO actions should the engineer take? (Choose two.)

Accepted Answer

Enable security configuration for the Glue job with S3 encryption mode set to SSE-KMS and specify the KMS key.. To meet the encryption requirements, the Glue job must be configured with a security configuration that specifies SSE-KMS and the customer managed key for S3 writes, and its IAM role must have the necessary KMS permissions to use that key. These two actions together ensure both at-rest encryption with the correct key and the ability to perform cryptographic operations.

Answer

Enable S3 default encryption on the target bucket with SSE-KMS.

Answer

Configure the Glue job to use a VPC endpoint for S3 to encrypt data in transit.

Answer

Ensure that the Glue job uses the S3a or S3n protocol with SSL enabled (e.g., fs.s3a.ssl.enabled=true).

Question 9

A data engineer is designing an analytics pipeline that ingests sensitive customer records into Amazon S3 and then catalogs them with AWS Glue. The security team requires that individual cell values such as credit card numbers and email addresses be masked so that analysts using Amazon Athena see only redacted values, while the underlying data remains intact for audit purposes. Which approach meets these requirements with the LEAST operational overhead?

Accepted Answer

Define a data cell filter in the AWS Glue Data Catalog on the table and grant analysts access through Lake Formation with column and row permissions.. Lake Formation data filters let you enforce column-level and cell-level masking directly on AWS Glue Data Catalog tables, so engines such as Athena return redacted values to unauthorized analysts while the original S3 objects stay untouched for audit. This avoids copying data, writing custom ETL redaction logic, or maintaining separate datasets, giving the lowest ongoing operational burden.

Answer

Configure an AWS Glue DataBrew recipe that applies cell-level redaction and write the transformed dataset to a separate S3 prefix used by analysts.

Answer

Enable Amazon Macie sensitive data discovery on the bucket and create an EventBridge rule that deletes objects containing detected personal data.

Answer

Apply an S3 bucket policy that denies GetObject for the sensitive prefixes unless the caller's IAM principal is in an approved auditor role.

Question 10

A data engineer is using AWS Glue to extract data from an Amazon RDS for MySQL database and load it into Amazon S3. The security team requires that the data in transit between Glue and RDS be encrypted using SSL/TLS, and that the RDS instance enforce SSL connections. Which combination of steps should the engineer take to meet these requirements? (Choose two.)

Accepted Answer

Configure the Glue connection to use the JDBC URL with the sslMode=REQUIRED parameter.. To enforce SSL/TLS for Glue connections to RDS for MySQL, you must configure both the client and server sides. The JDBC URL with sslMode=REQUIRED ensures the Glue connection uses SSL. Setting require_secure_transport=1 in the RDS parameter group forces all connections to use SSL. Together, they meet the requirement. IAM policies, encryption at rest, and ACM do not enforce in-transit encryption for RDS.

Answer

Attach an IAM policy to the Glue job role that allows rds:Encrypt.

Answer

Enable encryption at rest on the RDS instance using a KMS key.

Answer

Use AWS Certificate Manager (ACM) to provision a certificate for the RDS instance.

Question 11

A data engineer must enforce column-level masking so that analysts querying an AWS Glue Data Catalog table through Amazon Athena see only the last four digits of a credit_card column, while an ETL role retains full values. The table is backed by Parquet in Amazon S3. Which approach meets the requirement with the least operational overhead?

Accepted Answer

Use AWS Lake Formation column-level security with a data filter that returns only the last four characters of the credit_card column, and grant analysts access to that filtered view.. Lake Formation column-level security combined with a data filter masks cell values at query time without copying data or rewriting ETL. Analysts granted on the filtered resource see only the last four digits, while the ETL role granted on the base table continues to read full values. This centralizes enforcement in the catalog and avoids duplicate pipelines or brittle SQL views.

Answer

Attach an IAM policy to the analysts that denies athena:GetQueryResults for any query referencing the credit_card column.

Answer

Create a separate masked copy of the Parquet data for analysts and a second catalog table, and refresh both copies on every ETL run.

Answer

Convert the table to a Hive-style text format and apply an Athena view that calls regexp_replace on the credit_card column, then grant analysts access only to the view.

Question 12

A data engineer is setting up an AWS Glue crawler to catalog data in an Amazon S3 bucket. The security team requires that the crawler access the S3 bucket using a specific IAM role that has least privilege permissions. What should the engineer do to ensure the crawler uses this role?

Accepted Answer

Attach the IAM role to the AWS Glue crawler when defining it.. The IAM role for an AWS Glue crawler is specified directly in the crawler's definition. This role is assumed by the crawler to access data sources. By assigning the least-privilege role to the crawler, the engineer ensures that the crawler operates with only the necessary permissions.

Answer

Use the AWS Glue console to set the crawler's security configuration to use the IAM role.

Answer

Configure the S3 bucket policy to allow the AWS Glue service principal to access the bucket.

Answer

Create an IAM policy and attach it to the AWS Glue service role, then the crawler will automatically use it.

Question 13

A data engineer is responsible for securing an Amazon Redshift cluster that contains sensitive financial data. The security team requires that all data be encrypted at rest and in transit, and that access to the cluster be restricted to specific IAM roles. The engineer has already enabled encryption at rest using AWS KMS and configured a cluster subnet group in a private VPC. Which TWO additional steps should the engineer take to meet the security requirements? (Choose two.)

Accepted Answer

Configure the Redshift cluster to use IAM authentication by enabling it and creating database users mapped to IAM roles.. To encrypt data in transit, require_ssl must be set to true in the cluster parameter group. To restrict access to specific IAM roles, IAM authentication must be enabled and database users mapped to IAM roles. These two steps together satisfy the encryption and access control requirements for the Redshift cluster.

Answer

Enable audit logging for the Redshift cluster to capture connection and query activity.

Answer

Use Amazon Redshift Spectrum to query data in Amazon S3, which automatically encrypts data in transit.

Answer

Use an IAM role with a trust policy that allows only specific IAM roles to assume it, and attach this role to the Redshift cluster for accessing other AWS services.

Question 14

A financial services company uses AWS Glue to process transactional data stored in Amazon S3. The security team mandates that all data in transit between AWS Glue and Amazon S3 must be encrypted using TLS 1.2 or higher, and that the Glue connection must enforce this. Which configuration should the data engineer apply to meet these requirements?

Accepted Answer

Enable AWS Glue security configuration with 'S3 encryption in transit' set to 'Required' and rely on AWS Glue's default use of TLS 1.2 or higher for all S3 connections.. AWS Glue security configurations provide a setting to enforce encryption in transit for S3. When enabled, Glue uses TLS 1.2 or higher for all S3 connections, satisfying the requirement without additional custom configuration. Other options either use non-existent properties or do not guarantee the minimum TLS version.

Answer

Set the Glue connection property 'sslMode' to 'require' and specify a minimum TLS version of 1.2 in the connection options.

Answer

Configure the Glue job to use a VPC endpoint for S3 and set the endpoint policy to require TLS 1.2, then enable AWS Glue security configuration with S3 encryption in transit.

Answer

Attach an S3 bucket policy that denies requests with aws:SecureTransport set to false, and ensure the Glue job uses the S3a or S3n protocol with HTTPS endpoints.

Question 15

A data engineer is configuring an AWS Glue ETL job that reads from an Amazon S3 bucket containing sensitive customer records. The security team requires that all data be encrypted end-to-end using a customer-managed KMS key, and that the job itself be able to decrypt the data. The engineer has created a KMS key and attached a key policy granting the Glue service role decrypt permissions. However, when the job runs, it fails with an access denied error when reading the S3 objects. What is the MOST likely cause of this failure?

Accepted Answer

The S3 bucket policy does not allow the Glue service role to perform s3:GetObject.. The Glue job needs both S3 read permissions and KMS decrypt permissions. The key policy grants KMS decrypt, but the S3 bucket policy must also allow the Glue service role to perform s3:GetObject. Without that, the job cannot access the objects, leading to an access denied error.

Answer

The KMS key policy must also grant the Glue service role kms:GenerateDataKey permissions.

Answer

The S3 bucket uses SSE-KMS with an AWS managed key instead of the customer-managed key.

Answer

The Glue job's IAM role lacks permissions to call kms:Decrypt on the key.