DEA-C01 Data Security and Governance Practice Test 13 — 15 Questions

Question 1

A media company stores video files in an Amazon S3 bucket. The bucket policy allows access only from a specific VPC. The company has enabled S3 Server Access Logs to monitor access. Recently, the security team found that some requests were coming from an IP address outside the allowed VPC. They suspect that the bucket policy may have an incorrect condition. What should they check first?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Verify that the bucket policy uses the 'aws:SourceVpc' condition key with the correct VPC ID.. The `aws:SourceVpc` condition key is specifically designed to restrict access to requests originating from a specific VPC. If the bucket policy uses `aws:SourceVpce` (for VPC endpoints) or has an incorrect VPC ID, it may allow unintended access. Therefore, verifying the condition key and its value is the first troubleshooting step. Option B is incorrect: while reviewing Server Access Logs can help identify suspicious IPs, the immediate issue is the bucket policy condition misconfiguration; logs are for detection, not root cause verification. Option C is incorrect: IAM role permissions are separate from the bucket policy's condition-based restriction; even with correct IAM permissions, the bucket policy condition could be misconfigured. Option D is incorrect: checking for public access is relevant but not the first step since the policy already uses a VPC-based condition; the specific condition key is the likely problem.

Answer

Review the S3 Server Access Logs to identify the source IP addresses.

Answer

Ensure that the IAM role used by the application has the correct permissions.

Answer

Check if the bucket policy allows public access.

Question 2

A data engineering team uses AWS Glue Data Catalog to manage metadata for datasets in Amazon S3. The datasets contain personally identifiable information (PII). The team needs to implement column-level security so that only authorized users can access columns with PII. They use Amazon Athena for querying. The team has enabled AWS Lake Formation and defined data lake locations. They have created a Lake Formation tag called 'PII' and assigned it to the columns containing PII. They have also granted 'SELECT' permission on those columns to a specific IAM role. However, when a user assumes that role and queries the table using Athena, they can still see all columns, including the PII columns. What is the most likely cause?

Accepted Answer

The IAM role does not have the necessary Lake Formation permissions; it only has IAM permissions to the S3 data.. Lake Formation column-level security requires that the table be registered as a data lake location in Lake Formation and that the IAM role has Lake Formation permissions, not just IAM permissions. The IAM role might be bypassing Lake Formation if it has S3 permissions directly. Option A is wrong because the tags are applied correctly. Option B is wrong because the S3 bucket policy should not allow direct access; Lake Formation should be the access point. Option D is wrong because disabling encryption would not cause this issue.

Answer

The data in S3 is not encrypted, so Lake Formation cannot enforce column-level security.

Answer

The S3 bucket policy grants direct access to the IAM role, bypassing Lake Formation.

Answer

The Lake Formation tag 'PII' is not properly associated with the columns.

Question 3

A company uses Amazon RDS for MySQL to store transactional data. The database contains sensitive financial information. The company's security policy requires that all data at rest be encrypted using a customer-managed KMS key. The database was originally launched without encryption at rest. The security team now needs to enable encryption without significant downtime. What should they do?

Accepted Answer

Create a snapshot of the database, copy the snapshot with encryption enabled, and restore a new DB instance from the encrypted snapshot.. You cannot enable encryption on an existing RDS instance directly. To encrypt an unencrypted RDS instance, you must create a snapshot, copy it with encryption enabled using a customer-managed KMS key, and then restore a new encrypted DB instance. This method minimizes downtime. Options B and D are incorrect because modifying the DB instance's storage settings does not allow enabling encryption in place. Option C (using DMS) could also achieve encryption but involves more downtime and complexity than the snapshot approach.

Answer

Enable encryption by modifying the DB instance's storage type to 'encrypted'.

Answer

Use the AWS DMS (Database Migration Service) to migrate data to a new encrypted RDS instance.

Answer

Modify the DB instance and enable encryption under the 'Storage' settings.

Question 4

A data engineer needs to audit all access to an S3 bucket containing sensitive customer data. The engineer must record the requester, timestamp, action, and whether the access was denied. Which AWS solution meets these requirements?

Accepted Answer

Enable S3 server access logs for the bucket, storing them in a different bucket.. S3 server access logs capture detailed records of requests made to a bucket, including the requester, timestamp, action, and response status (e.g., whether the access was denied). These logs are stored in a designated target bucket and are specifically designed for auditing access requests. Option A is incorrect because AWS Config tracks configuration changes, not individual access requests. Option B is incorrect because VPC Flow Logs capture IP traffic metadata, not application-level S3 operations. Option C is incorrect because while AWS CloudTrail can log object-level events when Data Events are enabled, S3 server access logs are purpose-built for this auditing requirement and provide granular details out of the box without additional setup or cost beyond logging.

Answer

Use AWS Config to record S3 bucket-level configuration changes.

Answer

Enable VPC Flow Logs for the VPC where the bucket resides.

Answer

Enable AWS CloudTrail Data Events for the S3 bucket.

Question 5

A company uses AWS Lake Formation to manage access to data in a data lake. A new data engineer has been granted SELECT permission on a table but receives an 'AccessDeniedException' when querying via Amazon Athena. The table is registered in Lake Formation and the data is encrypted with SSE-KMS. Which of the following is the MOST likely cause?

Accepted Answer

The IAM role used by Athena does not have kms:Decrypt permission on the KMS key.. The IAM role used by Athena does not have kms:Decrypt permission on the KMS key. When data is encrypted with SSE-KMS, Athena's IAM role requires kms:Decrypt to read the data from S3. Even if Lake Formation grants SELECT permission, the query fails without KMS access. Option A is incorrect because Lake Formation does not use resource-based policies on tables; it uses LF-Tags or resource links to grant permissions. Option B is incorrect because while an S3 bucket policy could block access, the most likely issue with encrypted data is missing KMS permissions. Option C is incorrect because the Glue Data Catalog does not enforce data access; Lake Formation is the service that manages fine-grained access.

Answer

The table's resource-based policy does not include the engineer's IAM role.

Answer

The S3 bucket policy denies access to the engineer's IAM role.

Answer

The AWS Glue Data Catalog has not been granted permission to the engineer's role.

Question 6

A data engineer needs to securely store database credentials used by a Lambda function. The solution must automatically rotate the credentials every 90 days. Which AWS service should the engineer use?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager supports automatic rotation of secrets. Option A is wrong because CloudHSM is a hardware security module, not a secret store with rotation. Option B is wrong because Parameter Store does not natively rotate secrets. Option C is wrong because IAM Roles are for access to AWS services, not for storing database credentials.

Answer

AWS CloudHSM

Answer

AWS Systems Manager Parameter Store

Answer

IAM Roles for Lambda

Question 7

A company has an S3 bucket policy that allows access to a specific IAM role. However, an administrator notices that requests from that role are being denied. The bucket is encrypted with AES-256. What is the MOST likely reason for the denial?

Accepted Answer

The bucket policy allows access, but the VPC endpoint policy denies the action.. The most likely reason for the denial is that the VPC endpoint policy denies the action. Even if the bucket policy allows access to the IAM role, the VPC endpoint policy can explicitly deny the action, which overrides the bucket policy. Option A is incorrect because AES-256 encryption does not require additional permissions like s3:Decrypt. Option B is incorrect because the question indicates the bucket policy allows access, not denies. Option D is incorrect because S3 Block Public Access settings only apply to public access, not to requests from an IAM role.

Answer

The IAM role does not have s3:Decrypt permission on the bucket.

Answer

The bucket policy has an explicit deny statement that overrides the allow.

Answer

The S3 Block Public Access settings are blocking the request.

Question 8

A data engineer is designing a data pipeline that processes sensitive financial data. The data must be encrypted at rest and in transit. The pipeline uses Amazon Kinesis Data Streams to ingest data and AWS Lambda to process it. Which combination of actions ensures the data is encrypted in transit? (Select TWO.)

Accepted Answer

Enable TLS for Kinesis Data Streams.. Enabling TLS for Kinesis Data Streams encrypts data in transit between producers and the stream. Option B is correct because enabling encryption in transit for the Lambda function's VPC configuration ensures TLS is used when Lambda communicates, such as with Kinesis over a VPC endpoint. Option C is incorrect because SSE-S3 encrypts data at rest in S3, not in transit. Option D is incorrect because encrypting data at rest in Kinesis using KMS does not address encryption in transit. Option E is incorrect because encrypting CloudWatch Logs with KMS is for data at rest.

Answer

Enable Server-Side Encryption (SSE-S3) on the S3 bucket used for data storage.

Answer

Use AWS KMS to encrypt data at rest in Kinesis Data Streams.

Answer

Encrypt the Lambda function's CloudWatch Logs using KMS.

Question 9

A company wants to monitor and alert on unauthorized API calls in their AWS account. Which AWS service should be used to detect and notify on such events?

Accepted Answer

AWS CloudTrail and Amazon CloudWatch Events. D is correct because AWS CloudTrail records all API calls in the AWS account, and Amazon CloudWatch Events (or EventBridge) can be configured with rules to detect specific API calls (e.g., unauthorized actions) and trigger notifications. Option A is incorrect because Amazon GuardDuty and AWS Security Hub are threat detection and security management services, not primarily for monitoring all API calls. Option B is incorrect because Amazon VPC Flow Logs capture network traffic metadata, not API calls. Option C is incorrect because AWS Config monitors resource configuration changes, not API calls.

Answer

Amazon GuardDuty and AWS Security Hub

Answer

Amazon VPC Flow Logs and Amazon CloudWatch Logs

Answer

AWS Config and AWS Systems Manager

Question 10

A data engineer is troubleshooting an Amazon Redshift cluster that is not allowing connections from a specific IP range. The engineer verified that the cluster's security group allows inbound traffic from the IP range. What is the next step to resolve the issue?

Accepted Answer

Check the network ACL (NACL) associated with the Redshift cluster's subnet.. Even if the security group allows inbound traffic from a specific IP range, the network ACL (NACL) associated with the Redshift cluster's subnet can block traffic at the subnet level. NACLs are stateless and can override security group rules. Option A is incorrect because modifying the cluster parameter group does not control network-level access; public accessibility is a separate setting. Option B is incorrect because the engineer already verified the security group, but even if it is correctly attached, the NACL could still block traffic. Option C is incorrect because IAM roles control authentication and authorization, not network connectivity.

Answer

Modify the Redshift cluster parameter group to enable public accessibility.

Answer

Verify that the cluster's security group is attached to the Redshift cluster.

Answer

Check the IAM role associated with the Redshift cluster.

Question 11

A company needs to enforce that all objects uploaded to an S3 bucket are encrypted at rest. Which bucket setting should be used?

Accepted Answer

Default encryption. Default encryption, is the correct bucket setting because it ensures all objects uploaded to the bucket are automatically encrypted at rest using SSE-S3 or SSE-KMS. Option B is incorrect because S3 Object Lock is used for compliance and retention, not encryption. Option C is incorrect because while a bucket policy can enforce encryption via the s3:x-amz-server-side-encryption header, the question asks for a bucket setting, and default encryption is the simpler and direct setting. Option D is incorrect because S3 Block Public Access controls public access, not encryption.

Answer

S3 Object Lock

Answer

Bucket policy requiring s3:x-amz-server-side-encryption header

Answer

S3 Block Public Access

Question 12

A company uses AWS Glue to run ETL jobs on data stored in S3. The data is encrypted with SSE-KMS. The Glue job fails with an 'AccessDenied' error when trying to read the data. What is the MOST likely cause?

Accepted Answer

The IAM role used by Glue does not have kms:Decrypt permission on the KMS key.. When data is encrypted with SSE-KMS, the IAM role used by Glue must have kms:Decrypt permission on the KMS key to read the data. Without it, the Glue job will fail with an 'AccessDenied' error despite S3 bucket permissions. Option A is incorrect because the S3 bucket policy may allow access, but KMS permission is separate and required. Option B is incorrect because the Glue Data Catalog permissions are for catalog operations, not for reading actual data from S3. Option D is incorrect because Glue connection permissions are for JDBC connections, not for S3 data access.

Answer

The S3 bucket policy denies access to the Glue service role.

Answer

The AWS Glue Data Catalog does not have permission to the table.

Answer

The Glue job's connection does not have the necessary permissions.

Question 13

Refer to the exhibit. An S3 bucket policy allows the DataEngineerRole to get objects only if the request uses HTTPS. However, requests from this role are being denied even when using HTTPS. What is the MOST likely reason?

Accepted Answer

The IAM role's attached policy does not allow s3:GetObject on the bucket.. Even though the bucket policy condition requires HTTPS, the IAM role must also have an IAM policy that explicitly allows s3:GetObject on the bucket. Without this, the request is denied regardless of the bucket policy. Option A is incorrect because SSE-S3 does not require explicit IAM permissions; it is a server-side encryption option that works by default. Option B is incorrect because aws:SecureTransport is spelled correctly; misspelling would cause the condition to not apply, potentially allowing HTTP, but the issue is requests being denied. Option C is incorrect because the bucket policy uses a condition to require HTTPS, which effectively denies HTTP requests even without a separate Deny statement.

Answer

The IAM role does not have permission to use SSE-S3.

Answer

The condition key aws:SecureTransport is misspelled.

Answer

The bucket policy does not include a Deny statement for HTTP requests.

Question 14

A data engineer needs to grant an IAM user read-only access to an S3 bucket named 'data-lake'. Which IAM policy statement should be used?

Accepted Answer

{"Effect":"Allow","Action":["s3:ListBucket","s3:GetObject"],"Resource":["arn:aws:s3:::data-lake","arn:aws:s3:::data-lake/*"]}. It allows ListBucket on the bucket and GetObject on objects, enabling read-only access. Option A is wrong because it grants write actions (PutObject, DeleteObject). Option B is wrong because it allows all S3 actions (s3:*). Option D is wrong because it only allows ListBucket, not GetObject.

Answer

{"Effect":"Allow","Action":["s3:PutObject","s3:DeleteObject"],"Resource":"arn:aws:s3:::data-lake/*"}

Answer

{"Effect":"Allow","Action":"s3:*","Resource":"*"}

Answer

{"Effect":"Allow","Action":"s3:ListBucket","Resource":"arn:aws:s3:::data-lake"}

Question 15

Refer to the exhibit. A data engineer runs the AWS CLI command to look up GetObject events. The output shows an event from the DataEngineer role. However, the engineer suspects that some GetObject requests are not being logged. What is the MOST likely reason?

Accepted Answer

The CloudTrail trail is not configured to log data events.. CloudTrail must have Data Events enabled for S3 object-level operations such as GetObject. Option A is wrong because the event is logged, so the trail exists. Option C is wrong because the engineer is looking up events, not configuring logging. Option D is wrong because the lookup is for a specific region, but the bucket might be in a different region, but that would not cause missing logs if events are logged in the bucket's region.

Answer

The IAM role does not have permission to read the CloudTrail logs.

Answer

The trail is not enabled in the us-east-1 region.

Answer

The S3 bucket is in a different region than the CloudTrail trail.