DEA-C01 Data Security and Governance Practice Test 12 — 15 Questions

Question 1

A company has a data lake in Amazon S3 with millions of objects. The security team wants to enforce that all objects are encrypted with a specific customer-managed KMS key. The data engineer configures an S3 bucket policy to deny PutObject if the encryption is not set to that key. However, some existing objects are not encrypted with that key. What is the most efficient way to remediate the existing objects?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use S3 Batch Operations to copy objects in the same bucket with the new encryption settings.. S3 Batch Operations can copy objects within the same bucket with new encryption settings, efficiently updating millions of objects in place. Option A is incorrect because S3 Cross-Region Replication replicates objects to a different bucket or region, not to the same bucket with changed encryption. Option B is inefficient compared to Batch Operations for large-scale remediation. Option D is incorrect because S3 Object Lambda transforms data on read, not at rest, so it does not change the stored encryption of existing objects.

Answer

Use S3 Cross-Region Replication to replicate objects to a new bucket with the correct encryption.

Answer

Write a script using the AWS SDK to iterate over all objects and re-upload them with the correct encryption.

Answer

Use S3 Object Lambda to dynamically encrypt objects on read.

Question 2

A company uses AWS Lake Formation to manage permissions on a data lake. A data engineer creates a table in the Data Catalog and grants SELECT permission to a group of analysts. The analysts report they can see the table but get an AccessDenied error when querying it with Amazon Athena. What is the most likely cause?

Accepted Answer

The analysts' IAM role does not have permission to call the Athena API.. The analysts can see the table in the Data Catalog but receive an AccessDenied error when querying with Athena. This indicates that Lake Formation has granted SELECT permission on the table, so the table is visible and the permission exists. The error occurs when Athena attempts to run the query, meaning the IAM role used by Athena (which is the analysts' role or a service role) lacks permission to call the Athena API (e.g., StartQueryExecution, GetQueryResults). Lake Formation permissions cover Data Catalog and S3 access, but do not grant IAM permissions for Athena itself. Therefore, Option A is the most likely cause. Option B is incorrect because the table is visible, so it is registered. Option C is incorrect because the workgroup result location issue would produce a different error (e.g., insufficient permissions on S3). Option D is incorrect because Lake Formation manages S3 access via registered locations, and if the table is registered, the bucket policy is overridden by Lake Formation permissions.

Answer

The table is not registered with Lake Formation as a resource.

Answer

The Athena workgroup is configured with a per-query result location that the analysts cannot write to.

Answer

The S3 bucket policy does not allow the analysts' IAM role.

Question 3

A data engineer needs to encrypt data at rest in Amazon S3 using server-side encryption with a customer-managed KMS key. Which TWO steps are required to ensure that the KMS key can be used for S3 object encryption?

Accepted Answer

Add a statement in the KMS key policy that allows the S3 service to use the key.. Options C and D are correct. For SSE-KMS with a customer-managed key, the KMS key policy must include a statement that allows the S3 service to use the key (e.g., kms:GenerateDataKey and kms:Decrypt). Additionally, the IAM role writing objects must have kms:GenerateDataKey and kms:Decrypt permissions. Option A is not required because a VPC endpoint for KMS is not mandatory for S3 to access the key. Option B is not required because enforcing SSE-KMS via bucket policy is a separate configuration, not a prerequisite for using the key. Option E is not required because S3 does not use a service-linked role for KMS access.

Answer

Configure a VPC endpoint for KMS to allow S3 to access the key.

Answer

Set the S3 bucket policy to require SSE-KMS for all PutObject requests.

Answer

Create a service-linked role for S3 to access KMS.

Question 4

A company is using AWS Lake Formation to manage a data lake. The data engineer needs to set up fine-grained access control so that users can only see specific columns in a table based on their IAM role. Which THREE steps should the data engineer take?

Accepted Answer

Ensure that the users query the table through a service integrated with Lake Formation, such as Athena.. Options A, B, and D are correct. Lake Formation column-level access requires defining the policy in Lake Formation, granting permissions to the IAM role, and the user must use Lake Formation-enabled services. Option C is wrong because S3 bucket policies are not used for column-level control. Option E is wrong because the table must be registered with Lake Formation.

Answer

Create a view in the Data Catalog that exposes only the required columns.

Answer

Attach an S3 bucket policy to restrict access to the underlying data.

Question 5

A company wants to audit all API calls made to Amazon S3 and Amazon RDS resources. Which TWO AWS services can be used together to achieve this?

Accepted Answer

AWS CloudTrail. Options A and E are correct. AWS CloudTrail records API calls to S3 and RDS, and Amazon CloudWatch Logs can store and monitor those logs. Option B (AWS Config) records resource configuration changes, not API calls, so it is incorrect. Option C (Amazon GuardDuty) is a threat detection service, not for auditing API calls. Option D (Amazon Macie) is for data classification and protection, not for recording API calls.

Answer

AWS Config

Answer

Amazon GuardDuty

Answer

Amazon Macie

Question 6

A data engineer needs to securely store database credentials used by an AWS Glue ETL job. Which THREE steps should the engineer take?

Accepted Answer

Store the credentials in AWS Secrets Manager.. Options B, C, and D are correct. AWS Secrets Manager securely stores credentials with automatic rotation. The Glue job's IAM role must have permission to read the secret (C), and the job uses the Secrets Manager connector to retrieve credentials (D). Option A is incorrect because hardcoding credentials is insecure and violates best practices. Option E is incorrect because while Parameter Store can store secrets, Secrets Manager is the recommended service for managing database credentials due to its built-in rotation and tighter integration with Glue.

Answer

Hardcode the credentials in the Glue job script.

Answer

Use AWS Systems Manager Parameter Store with a SecureString parameter.

Question 7

A company uses Amazon Redshift for its data warehouse and needs to enforce column-level security on sensitive columns. Which TWO approaches can achieve this?

Accepted Answer

Create views that expose only non-sensitive columns and grant access to the views.. Options B and D are correct. Amazon Redshift natively supports column-level security, allowing you to grant or revoke permissions on specific columns (option D). Additionally, you can create views that include only non-sensitive columns and grant access to those views (option B), effectively achieving column-level access control. Option A (S3 bucket policy) does not control access within Redshift. Option C (Redshift Spectrum) pertains to external tables and is not a column-level security feature. Option E (row-level security) controls rows, not columns.

Answer

Apply an S3 bucket policy to the underlying data files.

Answer

Use Redshift Spectrum to query external tables and restrict columns via the external schema.

Answer

Use Redshift row-level security policies to restrict column access.

Question 8

A data engineer is designing a data pipeline that ingests customer data from an on-premises database into Amazon S3. The data contains personally identifiable information (PII). The company policy requires that all PII be masked before it is stored in S3. The pipeline uses AWS DMS for migration and AWS Glue for transformation. The engineer needs to ensure that the masking is applied consistently and that no unmasked data is written to S3. The engineer has set up DMS to replicate data to an S3 bucket, and then a Glue job reads from S3, applies masking, and writes to another S3 bucket. However, there is a risk that unmasked data in the first S3 bucket could be accessed before the Glue job runs. What should the engineer do to mitigate this risk?

Accepted Answer

Set an S3 Lifecycle policy on the first bucket to delete objects after 1 hour.. An S3 Lifecycle policy with expiration can automatically delete objects from the first bucket after a short time, reducing the window of exposure for unmasked data. Option A is incorrect because DMS does not have native masking capabilities; it can transform data types but not mask PII. Option B is incorrect because blocking all access except for the Glue role would still leave unmasked data accessible to the Glue job, and the risk of exposure exists if the Glue job fails or is delayed. Option C is incorrect because Kinesis Data Firehose is not part of the existing pipeline and would require re-architecting.

Answer

Configure DMS to apply masking transformations before writing to S3 using DMS's built-in transformation rules.

Answer

Block all access to the first S3 bucket except for the Glue job's IAM role.

Answer

Use Amazon Kinesis Data Firehose to stream data directly to Glue for real-time masking.

Question 9

A company has a multi-account AWS environment with a centralized data lake in the Security account. Data producers in other accounts use AWS Glue to write data to S3 buckets in the Security account. The Security account uses AWS Lake Formation to manage permissions. The data engineer is setting up cross-account access so that users in the Producer account can query the data using Athena in their own account. The engineer has registered the S3 buckets and Data Catalog tables in Lake Formation. The IAM roles in the Producer account have the necessary permissions. However, when a user in the Producer account tries to query the table, they get an AccessDenied error. The error message indicates that the principal is not authorized to perform lakeformation:GetTable on the resource. What is the most likely cause?

Accepted Answer

The Lake Formation permissions in the Security account do not include a grant to the Producer account's IAM role.. Lake Formation requires explicit cross-account grants to the producer account's IAM role for the Data Catalog tables. Even if the S3 buckets and Data Catalog tables are registered, the producer account's role must be granted SELECT and DESCRIBE permissions on the table in Lake Formation. Option A is incorrect because a Glue Data Catalog resource policy is not required when Lake Formation is used for cross-account access; Lake Formation handles the authorization. Option B is incorrect because the S3 bucket policy must allow the producer account's role, but the error specifically mentions lakeformation:GetTable, not S3 access. Option C is incorrect because the KMS key policy is not relevant to the lakeformation:GetTable error.

Answer

The Glue Data Catalog resource policy is missing a statement to allow cross-account access.

Answer

The S3 bucket policy does not allow the Producer account's IAM role to read the data.

Answer

The KMS key policy does not allow the Producer account's IAM role to decrypt objects.

Question 10

A company uses Amazon EMR to process large datasets stored in Amazon S3. The data is encrypted at rest using SSE-S3. The security team now requires that all data at rest be encrypted with customer-managed KMS keys (SSE-KMS). The data engineer needs to migrate existing data to use SSE-KMS without downtime. The engineer plans to use S3 Batch Operations to copy objects in place. However, the Batch Operations job fails with a KMS access denied error. The engineer has confirmed that the Batch Operations service role has the necessary KMS permissions. What is the most likely cause?

Accepted Answer

The Batch Operations service role is missing the kms:GenerateDataKey permission for the destination KMS key.. Batch Operations uses a service role that must have kms:Decrypt permission for the source objects and kms:GenerateDataKey for the destination. The source objects are encrypted with SSE-S3, which does not use KMS, so the service role does not need kms:Decrypt for source. However, the error indicates KMS access denied, likely because the service role does not have kms:GenerateDataKey for the destination KMS key. Option A is wrong because the service role is used. Option B is wrong because the source objects are SSE-S3. Option C is wrong because KMS key policy is for the destination key.

Answer

The KMS key policy does not allow the S3 service to use the key.

Answer

The Batch Operations job is using the wrong IAM role.

Answer

The source objects are encrypted with SSE-S3, which cannot be copied to SSE-KMS.

Question 11

A company uses Amazon QuickSight for data visualization. The data engineer needs to ensure that users can only see data relevant to their department. The data is stored in Amazon S3 and is accessed via SPICE. The engineer has created datasets in QuickSight and wants to implement row-level security (RLS). The dataset contains a column 'Department' that indicates which department a row belongs to. The engineer has configured RLS rules using a separate permissions dataset. However, users report that they can see all rows, not just their department's rows. What is the most likely reason?

Accepted Answer

The RLS permissions dataset is not correctly configured to map users to department values.. The most likely reason because the RLS permissions dataset must correctly map each user to the specific department values they are allowed to see. If this mapping is misconfigured or missing, QuickSight will default to showing all rows, making the RLS ineffective. The 'Department' column is present in the dataset (Option B is false). Admin access to the dashboard does not bypass RLS at the dataset level (Option C is false). SPICE datasets fully support row-level security (Option D is false).

Answer

The 'Department' column is not included in the dataset.

Answer

The users have been granted admin access to the QuickSight dashboard.

Answer

The SPICE dataset does not support row-level security.

Question 12

A company uses Amazon DynamoDB to store session data. The security team requires that all data be encrypted at rest using a customer-managed KMS key. The data engineer has enabled DynamoDB encryption with a customer-managed key. However, the security team notices that the key is not being used for all tables; some tables still use the default AWS-managed key. The engineer needs to ensure that all new tables are automatically encrypted with the customer-managed key. The company has hundreds of developers who create tables using various methods (console, CLI, SDK, CloudFormation). What is the most efficient way to enforce this policy?

Accepted Answer

Use an AWS Config rule to check for tables not using the customer-managed key and trigger auto-remediation.. AWS Config rules can evaluate whether DynamoDB tables use customer-managed KMS keys and take remediation actions. Option A is wrong because it requires updating all existing code. Option B is wrong because CloudFormation templates can be bypassed. Option D is wrong because SCPs cannot enforce encryption configuration for DynamoDB.

Answer

Create a CloudFormation template that all developers must use to create tables.

Answer

Attach an SCP to deny creating DynamoDB tables without the customer-managed key.

Answer

Update the company's internal documentation and require all developers to specify the KMS key in their code.

Question 13

A financial services company uses AWS Glue ETL jobs to process sensitive customer data stored in Amazon S3. The data is encrypted at rest with SSE-KMS using a customer-managed key. Recently, the security team discovered that the Glue job's IAM role has an overly permissive policy that allows the 'kms:Decrypt' action for all KMS keys in the account. The company wants to follow the principle of least privilege. The Glue job runs on a schedule and reads from a specific S3 bucket. The security team needs to update the IAM policy to restrict KMS decryption to only the specific key used for that bucket. What should they do?

Accepted Answer

Update the policy to allow 'kms:Decrypt' only for the specific KMS key ARN used by the S3 bucket containing the customer data.. To follow least privilege, the IAM role for the Glue job should only have access to decrypt using the specific KMS key that encrypts the S3 bucket containing the customer data. This is done by allowing 'kms:Decrypt' with a resource set to the exact ARN of that key, not a wildcard or all keys. Option A is incorrect because using a wildcard in the key ARN (key/*) still grants access to all keys under that key hierarchy, which is overly permissive. Option B is incorrect because allowing 'kms:Decrypt' with resource '*' would grant access to all keys in the account, violating least privilege. Option D is incorrect because removing 'kms:Decrypt' from the IAM policy would prevent the Glue job from decrypting the data; the job's IAM role needs the permission, and relying solely on S3 bucket policies cannot grant decryption permissions cross-account or for IAM roles.

Answer

Update the policy to allow 'kms:Decrypt' with a resource of 'arn:aws:kms:us-east-1:123456789012:key/*' to cover all keys in the account.

Answer

Update the policy to allow 'kms:Decrypt' with a resource of '*' to ensure the job can always decrypt data.

Answer

Remove the 'kms:Decrypt' action from the policy and rely on S3 bucket policies to grant decryption permissions.

Question 14

A healthcare organization uses AWS Lake Formation to manage a data lake in Amazon S3. The data lake contains sensitive patient information that must be encrypted at rest. The organization uses AWS KMS with a customer-managed key (CMK) for encryption. Recently, the security team noticed that a new IAM user was able to query the data lake using Amazon Athena without explicit permissions in Lake Formation. The data lake administrator suspects that the IAM user might have been granted access through an IAM policy that allows 'lakeformation:GetDataAccess' without proper resource restrictions. The organization wants to enforce that only Lake Formation permissions control access to the data lake, and IAM policies should not grant access directly. What should they do?

Accepted Answer

Revoke the 'lakeformation:GetDataAccess' permission from all IAM users and groups, and require that access be granted only through Lake Formation permissions.. Revoking the 'lakeformation:GetDataAccess' permission from all IAM users and groups ensures that only Lake Formation permissions control access to the data lake. This prevents IAM policies from bypassing Lake Formation's fine-grained access control. Option A is wrong because changing the KMS key policy would not address the IAM policy issue; KMS controls encryption, not access permissions. Option C is wrong because removing the policy from a single user does not prevent other users from having similar permissions; a broader revocation is needed. Option D is wrong because S3 bucket policies would still allow direct S3 access, bypassing Lake Formation's controls.

Answer

Change the KMS key policy to require that any request to decrypt data must come from the Lake Formation service role.

Answer

Remove the IAM policy that grants 'lakeformation:GetDataAccess' from the specific user and ensure Lake Formation permissions are correctly set.

Answer

Add an S3 bucket policy that denies all principals except the Lake Formation service role.

Question 15

A gaming company uses Amazon Redshift for analytics. The Redshift cluster stores user data that must be encrypted at rest using a customer-managed KMS key. The company has enabled audit logging using AWS CloudTrail. The security team wants to ensure that any attempt to disable or delete the KMS key is immediately detected and triggers an automated response. They have set up a CloudWatch Events rule that triggers an SNS notification when the KMS key is scheduled for deletion. However, they also want to prevent the key from being deleted accidentally. What should they do?

Accepted Answer

Add a statement to the KMS key policy that denies 'kms:ScheduleKeyDeletion' for all principals except the root user.. Adding a statement to the KMS key policy that denies 'kms:ScheduleKeyDeletion' for all principals except the root user explicitly prevents any user (including IAM users with full admin permissions) from scheduling deletion of the key. This is the most direct and authoritative control to prevent accidental deletion. Option A is incorrect because automatic key rotation does not prevent the key from being deleted; it only changes the backing key material. Option C is incorrect because an IAM policy attached to the Redshift cluster role does not affect permissions on the KMS key; the key policy is the authoritative control for actions on a customer-managed key. Option D is incorrect because CloudTrail monitoring only detects deletion events but does not prevent the deletion itself.

Answer

Enable automatic key rotation for the KMS key to ensure that even if the key is deleted, the data remains encrypted.

Answer

Attach an IAM policy to the Redshift cluster role that denies 'kms:ScheduleKeyDeletion'.

Answer

Set up a CloudTrail trail to monitor for 'ScheduleKeyDeletion' events and send an alert to the security team.