DEA-C01 Data Security and Governance Practice Test 12 — 15 Questions

Question 1

A data engineer is designing a data pipeline that ingests customer data from an on-premises database into Amazon S3. The data contains personally identifiable information (PII). The company policy requires that all PII be masked before it is stored in S3. The pipeline uses AWS DMS for migration and AWS Glue for transformation. The engineer needs to ensure that the masking is applied consistently and that no unmasked data is written to S3. The engineer has set up DMS to replicate data to an S3 bucket, and then a Glue job reads from S3, applies masking, and writes to another S3 bucket. However, there is a risk that unmasked data in the first S3 bucket could be accessed before the Glue job runs. What should the engineer do to mitigate this risk?

Accepted Answer

Set an S3 Lifecycle policy on the first bucket to delete objects after 1 hour.. Option B is correct because an S3 Lifecycle policy with expiration can automatically delete objects from the first bucket after a short time, reducing the window of exposure. Option A is wrong because DMS does not have native masking capabilities. Option C is wrong because blocking all access would prevent the Glue job from reading. Option D is wrong because Kinesis is not part of the pipeline.

Answer

Configure DMS to apply masking transformations before writing to S3 using DMS's built-in transformation rules.

Answer

Block all access to the first S3 bucket except for the Glue job's IAM role.

Answer

Use Amazon Kinesis Data Firehose to stream data directly to Glue for real-time masking.

Question 2

A company has a multi-account AWS environment with a centralized data lake in the Security account. Data producers in other accounts use AWS Glue to write data to S3 buckets in the Security account. The Security account uses AWS Lake Formation to manage permissions. The data engineer is setting up cross-account access so that users in the Producer account can query the data using Athena in their own account. The engineer has registered the S3 buckets and Data Catalog tables in Lake Formation. The IAM roles in the Producer account have the necessary permissions. However, when a user in the Producer account tries to query the table, they get an AccessDenied error. The error message indicates that the principal is not authorized to perform lakeformation:GetTable on the resource. What is the most likely cause?

Accepted Answer

The Lake Formation permissions in the Security account do not include a grant to the Producer account's IAM role.. Option A is correct because Lake Formation requires that the producer account's IAM role be granted cross-account permissions in Lake Formation. Option B is wrong because the S3 bucket policy should allow the Producer account's IAM role. Option C is wrong because the KMS key policy must allow the Producer account's IAM role. Option D is wrong because the Glue Data Catalog policy may need cross-account access but Lake Formation is the primary issue.

Answer

The Glue Data Catalog resource policy is missing a statement to allow cross-account access.

Answer

The S3 bucket policy does not allow the Producer account's IAM role to read the data.

Answer

The KMS key policy does not allow the Producer account's IAM role to decrypt objects.

Question 3

A company uses Amazon EMR to process large datasets stored in Amazon S3. The data is encrypted at rest using SSE-S3. The security team now requires that all data at rest be encrypted with customer-managed KMS keys (SSE-KMS). The data engineer needs to migrate existing data to use SSE-KMS without downtime. The engineer plans to use S3 Batch Operations to copy objects in place. However, the Batch Operations job fails with a KMS access denied error. The engineer has confirmed that the Batch Operations service role has the necessary KMS permissions. What is the most likely cause?

Accepted Answer

The Batch Operations service role is missing the kms:GenerateDataKey permission for the destination KMS key.. Option D is correct because Batch Operations uses a service role that must have kms:Decrypt permission for the source objects and kms:GenerateDataKey for the destination. The source objects are encrypted with SSE-S3, which does not use KMS, so the service role does not need kms:Decrypt for source. However, the error indicates KMS access denied, likely because the service role does not have kms:GenerateDataKey for the destination KMS key. Option A is wrong because the service role is used. Option B is wrong because the source objects are SSE-S3. Option C is wrong because KMS key policy is for the destination key.

Answer

The KMS key policy does not allow the S3 service to use the key.

Answer

The Batch Operations job is using the wrong IAM role.

Answer

The source objects are encrypted with SSE-S3, which cannot be copied to SSE-KMS.

Question 4

A company uses Amazon QuickSight for data visualization. The data engineer needs to ensure that users can only see data relevant to their department. The data is stored in Amazon S3 and is accessed via SPICE. The engineer has created datasets in QuickSight and wants to implement row-level security (RLS). The dataset contains a column 'Department' that indicates which department a row belongs to. The engineer has configured RLS rules using a separate permissions dataset. However, users report that they can see all rows, not just their department's rows. What is the most likely reason?

Accepted Answer

The RLS permissions dataset is not correctly configured to map users to department values.. Option B is correct because QuickSight RLS requires a permissions dataset that maps users to the values in the restricted column. If the RLS rules are not properly set, all rows are visible. Option A is wrong because the column exists. Option C is wrong because SPICE supports RLS. Option D is wrong because RLS is dataset-level, not dashboard-level.

Answer

The 'Department' column is not included in the dataset.

Answer

The users have been granted admin access to the QuickSight dashboard.

Answer

The SPICE dataset does not support row-level security.

Question 5

A company uses Amazon DynamoDB to store session data. The security team requires that all data be encrypted at rest using a customer-managed KMS key. The data engineer has enabled DynamoDB encryption with a customer-managed key. However, the security team notices that the key is not being used for all tables; some tables still use the default AWS-managed key. The engineer needs to ensure that all new tables are automatically encrypted with the customer-managed key. The company has hundreds of developers who create tables using various methods (console, CLI, SDK, CloudFormation). What is the most efficient way to enforce this policy?

Accepted Answer

Use an AWS Config rule to check for tables not using the customer-managed key and trigger auto-remediation.. Option C is correct because AWS Config rules can evaluate whether DynamoDB tables use customer-managed KMS keys and take remediation actions. Option A is wrong because it requires updating all existing code. Option B is wrong because CloudFormation templates can be bypassed. Option D is wrong because SCPs cannot enforce encryption configuration for DynamoDB.

Answer

Create a CloudFormation template that all developers must use to create tables.

Answer

Attach an SCP to deny creating DynamoDB tables without the customer-managed key.

Answer

Update the company's internal documentation and require all developers to specify the KMS key in their code.

Question 6

A financial services company uses AWS Glue ETL jobs to process sensitive customer data stored in Amazon S3. The data is encrypted at rest with SSE-KMS using a customer-managed key. Recently, the security team discovered that the Glue job's IAM role has an overly permissive policy that allows the 'kms:Decrypt' action for all KMS keys in the account. The company wants to follow the principle of least privilege. The Glue job runs on a schedule and reads from a specific S3 bucket. The security team needs to update the IAM policy to restrict KMS decryption to only the specific key used for that bucket. What should they do?

Accepted Answer

Update the policy to allow 'kms:Decrypt' only for the specific KMS key ARN used by the S3 bucket containing the customer data.. Option B is correct because the IAM policy should grant 'kms:Decrypt' only for the specific KMS key ARN used by the target S3 bucket, following least privilege. Option A is wrong because using '*' for the key is overly permissive. Option C is wrong because using a wildcard in the key ARN (key/*) is not a valid ARN pattern; KMS key ARNs are specific. Option D is wrong because 'kms:Decrypt' is required for the Glue job to access encrypted data; removing it would break the job.

Answer

Update the policy to allow 'kms:Decrypt' with a resource of 'arn:aws:kms:us-east-1:123456789012:key/*' to cover all keys in the account.

Answer

Update the policy to allow 'kms:Decrypt' with a resource of '*' to ensure the job can always decrypt data.

Answer

Remove the 'kms:Decrypt' action from the policy and rely on S3 bucket policies to grant decryption permissions.

Question 7

A healthcare organization uses AWS Lake Formation to manage a data lake in Amazon S3. The data lake contains sensitive patient information that must be encrypted at rest. The organization uses AWS KMS with a customer-managed key (CMK) for encryption. Recently, the security team noticed that a new IAM user was able to query the data lake using Amazon Athena without explicit permissions in Lake Formation. The data lake administrator suspects that the IAM user might have been granted access through an IAM policy that allows 'lakeformation:GetDataAccess' without proper resource restrictions. The organization wants to enforce that only Lake Formation permissions control access to the data lake, and IAM policies should not grant access directly. What should they do?

Accepted Answer

Revoke the 'lakeformation:GetDataAccess' permission from all IAM users and groups, and require that access be granted only through Lake Formation permissions.. Option C is correct because the 'Lakeformation:GetDataAccess' permission is required for principals to access data through Lake Formation, and revoking it for all IAM users forces them to rely solely on Lake Formation permissions. Option A is wrong because IAM policies for Lake Formation actions (like GetDataAccess) can grant access to data lake resources; removing them from the specific user is not enough. Option B is wrong because S3 bucket policies would bypass Lake Formation's fine-grained access control. Option D is wrong because KMS keys do not control data access permissions; they control encryption.

Answer

Change the KMS key policy to require that any request to decrypt data must come from the Lake Formation service role.

Answer

Remove the IAM policy that grants 'lakeformation:GetDataAccess' from the specific user and ensure Lake Formation permissions are correctly set.

Answer

Add an S3 bucket policy that denies all principals except the Lake Formation service role.

Question 8

A gaming company uses Amazon Redshift for analytics. The Redshift cluster stores user data that must be encrypted at rest using a customer-managed KMS key. The company has enabled audit logging using AWS CloudTrail. The security team wants to ensure that any attempt to disable or delete the KMS key is immediately detected and triggers an automated response. They have set up a CloudWatch Events rule that triggers an SNS notification when the KMS key is scheduled for deletion. However, they also want to prevent the key from being deleted accidentally. What should they do?

Accepted Answer

Add a statement to the KMS key policy that denies 'kms:ScheduleKeyDeletion' for all principals except the root user.. Option B is correct because enabling key rotation does not prevent deletion. Option A is wrong because while CloudTrail can detect deletion, it does not prevent it. Option C is correct because a KMS key policy can explicitly deny the 'kms:ScheduleKeyDeletion' action for all principals except the account root, preventing accidental deletion. Option D is wrong because using an IAM policy to deny deletion is less reliable if the key policy allows it; the key policy is the authoritative control.

Answer

Enable automatic key rotation for the KMS key to ensure that even if the key is deleted, the data remains encrypted.

Answer

Attach an IAM policy to the Redshift cluster role that denies 'kms:ScheduleKeyDeletion'.

Answer

Set up a CloudTrail trail to monitor for 'ScheduleKeyDeletion' events and send an alert to the security team.

Question 9

A media company stores video files in an Amazon S3 bucket. The bucket policy allows access only from a specific VPC. The company has enabled S3 Server Access Logs to monitor access. Recently, the security team found that some requests were coming from an IP address outside the allowed VPC. They suspect that the bucket policy may have an incorrect condition. What should they check first?

Accepted Answer

Verify that the bucket policy uses the 'aws:SourceVpc' condition key with the correct VPC ID.. Option A is correct because the 'aws:SourceVpce' condition key is used to restrict access to a specific VPC endpoint, not the VPC itself. To restrict to a VPC, they should use 'aws:SourceVpc'. Option B is wrong because the bucket policy already restricts access; the issue is with the condition key used. Option C is wrong because S3 Server Access Logs show the source IP, but the condition key is the root cause. Option D is wrong because IAM policies are evaluated in addition to bucket policies, but the bucket policy condition is likely the issue.

Answer

Review the S3 Server Access Logs to identify the source IP addresses.

Answer

Ensure that the IAM role used by the application has the correct permissions.

Answer

Check if the bucket policy allows public access.

Question 10

A data engineering team uses AWS Glue Data Catalog to manage metadata for datasets in Amazon S3. The datasets contain personally identifiable information (PII). The team needs to implement column-level security so that only authorized users can access columns with PII. They use Amazon Athena for querying. The team has enabled AWS Lake Formation and defined data lake locations. They have created a Lake Formation tag called 'PII' and assigned it to the columns containing PII. They have also granted 'SELECT' permission on those columns to a specific IAM role. However, when a user assumes that role and queries the table using Athena, they can still see all columns, including the PII columns. What is the most likely cause?

Accepted Answer

The IAM role does not have the necessary Lake Formation permissions; it only has IAM permissions to the S3 data.. Option C is correct because Lake Formation column-level security requires that the table be registered as a data lake location in Lake Formation and that the IAM role has Lake Formation permissions, not just IAM permissions. The IAM role might be bypassing Lake Formation if it has S3 permissions directly. Option A is wrong because the tags are applied correctly. Option B is wrong because the S3 bucket policy should not allow direct access; Lake Formation should be the access point. Option D is wrong because disabling encryption would not cause this issue.

Answer

The data in S3 is not encrypted, so Lake Formation cannot enforce column-level security.

Answer

The S3 bucket policy grants direct access to the IAM role, bypassing Lake Formation.

Answer

The Lake Formation tag 'PII' is not properly associated with the columns.

Question 11

A company uses Amazon RDS for MySQL to store transactional data. The database contains sensitive financial information. The company's security policy requires that all data at rest be encrypted using a customer-managed KMS key. The database was originally launched without encryption at rest. The security team now needs to enable encryption without significant downtime. What should they do?

Accepted Answer

Create a snapshot of the database, copy the snapshot with encryption enabled, and restore a new DB instance from the encrypted snapshot.. Option B is correct because you cannot enable encryption on an existing RDS instance; you must create a snapshot, copy it with encryption, and restore a new encrypted instance. Option A is wrong because RDS does not support enabling encryption in place. Option C is wrong because modifying the DB instance does not allow enabling encryption. Option D is wrong because you cannot change the storage encryption setting directly.

Answer

Enable encryption by modifying the DB instance's storage type to 'encrypted'.

Answer

Use the AWS DMS (Database Migration Service) to migrate data to a new encrypted RDS instance.

Answer

Modify the DB instance and enable encryption under the 'Storage' settings.

Question 12

A data engineer needs to audit all access to an S3 bucket containing sensitive customer data. The engineer must record the requester, timestamp, action, and whether the access was denied. Which AWS solution meets these requirements?

Accepted Answer

Enable S3 server access logs for the bucket, storing them in a different bucket.. Option C is correct because S3 server access logs capture detailed records of requests made to a bucket, including requester, timestamp, action, and response status. Option A is wrong because CloudTrail logs object-level events only if Data Events are enabled, but server access logs are specifically designed for this purpose and are more granular. Option B is wrong because VPC Flow Logs capture network traffic metadata but not application-level S3 operations. Option D is wrong because AWS Config tracks resource configuration changes, not access requests.

Answer

Use AWS Config to record S3 bucket-level configuration changes.

Answer

Enable VPC Flow Logs for the VPC where the bucket resides.

Answer

Enable AWS CloudTrail Data Events for the S3 bucket.

Question 13

A company uses AWS Lake Formation to manage access to data in a data lake. A new data engineer has been granted SELECT permission on a table but receives an 'AccessDeniedException' when querying via Amazon Athena. The table is registered in Lake Formation and the data is encrypted with SSE-KMS. Which of the following is the MOST likely cause?

Accepted Answer

The IAM role used by Athena does not have kms:Decrypt permission on the KMS key.. Option B is correct because Lake Formation integrates with AWS KMS for encrypted data; the IAM role used by Athena must have kms:Decrypt permission on the KMS key. Option A is wrong because Lake Formation permissions are not passed via the resource-based policy on the table. Option C is wrong because the AWS Glue Data Catalog does not enforce data access by default. Option D is wrong because S3 bucket policies can block access, but the primary issue with encrypted data is KMS permissions.

Answer

The table's resource-based policy does not include the engineer's IAM role.

Answer

The S3 bucket policy denies access to the engineer's IAM role.

Answer

The AWS Glue Data Catalog has not been granted permission to the engineer's role.

Question 14

A data engineer needs to securely store database credentials used by a Lambda function. The solution must automatically rotate the credentials every 90 days. Which AWS service should the engineer use?

Accepted Answer

AWS Secrets Manager. Option D is correct because AWS Secrets Manager supports automatic rotation of secrets. Option A is wrong because Parameter Store does not natively rotate secrets. Option B is wrong because CloudHSM is a hardware security module, not a secret store with rotation. Option C is wrong because IAM Roles are for access to AWS services, not for storing database credentials.

Answer

AWS CloudHSM

Answer

AWS Systems Manager Parameter Store

Answer

IAM Roles for Lambda

Question 15

A company has an S3 bucket policy that allows access to a specific IAM role. However, an administrator notices that requests from that role are being denied. The bucket is encrypted with AES-256. What is the MOST likely reason for the denial?

Accepted Answer

The bucket policy allows access, but the VPC endpoint policy denies the action.. Option B is correct because even if the bucket policy allows access, if the bucket is not publicly accessible and the VPC endpoint policy does not allow the action, access will be denied. Option A is wrong because AES-256 encryption does not require additional permissions. Option C is wrong because an explicit deny in the bucket policy would override an allow. Option D is wrong because S3 Block Public Access settings affect only public access, not IAM role access.

Answer

The IAM role does not have s3:Decrypt permission on the bucket.

Answer

The bucket policy has an explicit deny statement that overrides the allow.

Answer

The S3 Block Public Access settings are blocking the request.