DEA-C01 Data Security and Governance Practice Test 13 — 15 Questions

Question 1

A data engineer is designing a data pipeline that processes sensitive financial data. The data must be encrypted at rest and in transit. The pipeline uses Amazon Kinesis Data Streams to ingest data and AWS Lambda to process it. Which combination of actions ensures the data is encrypted in transit? (Select TWO.)

Accepted Answer

Enable TLS for Kinesis Data Streams.. Option A is correct because enabling TLS for Kinesis Data Streams encrypts data in transit between producers and the stream. Option D is correct because enabling Encryption in Transit for Lambda's VPC configuration ensures TLS is used for Lambda's network connections. Option B is wrong because SSE-S3 encrypts data at rest in S3. Option C is wrong because SSE-KMS encrypts data at rest in Kinesis. Option E is wrong because CloudWatch Logs encryption is at rest.

Answer

Enable Server-Side Encryption (SSE-S3) on the S3 bucket used for data storage.

Answer

Use AWS KMS to encrypt data at rest in Kinesis Data Streams.

Answer

Encrypt the Lambda function's CloudWatch Logs using KMS.

Question 2

A company wants to monitor and alert on unauthorized API calls in their AWS account. Which AWS service should be used to detect and notify on such events?

Accepted Answer

AWS CloudTrail and Amazon CloudWatch Events. Option A is correct because AWS CloudTrail logs API calls, and Amazon CloudWatch Events (or EventBridge) can be used to create rules that trigger notifications on specific API calls. Option B is wrong because AWS Config monitors resource configuration, not API calls. Option C is wrong because Amazon GuardDuty is a threat detection service that can detect API call anomalies but is not primarily designed for monitoring all unauthorized API calls. Option D is wrong because VPC Flow Logs monitor network traffic.

Answer

Amazon GuardDuty and AWS Security Hub

Answer

Amazon VPC Flow Logs and Amazon CloudWatch Logs

Answer

AWS Config and AWS Systems Manager

Question 3

A data engineer is troubleshooting an Amazon Redshift cluster that is not allowing connections from a specific IP range. The engineer verified that the cluster's security group allows inbound traffic from the IP range. What is the next step to resolve the issue?

Accepted Answer

Check the network ACL (NACL) associated with the Redshift cluster's subnet.. Option C is correct because Redshift also uses a VPC network ACL (NACL) that can block traffic at the subnet level, independent of security groups. Option A is wrong because the security group already allows traffic. Option B is wrong because IAM roles do not control network-level access. Option D is wrong because the cluster parameter group does not control network access.

Answer

Modify the Redshift cluster parameter group to enable public accessibility.

Answer

Verify that the cluster's security group is attached to the Redshift cluster.

Answer

Check the IAM role associated with the Redshift cluster.

Question 4

A company needs to enforce that all objects uploaded to an S3 bucket are encrypted at rest. Which bucket setting should be used?

Accepted Answer

Default encryption. Option C is correct because enabling default encryption on the S3 bucket ensures all objects are encrypted at rest. Option A is wrong because S3 Block Public Access controls public access, not encryption. Option B is wrong because bucket policies can enforce encryption but default encryption is simpler. Option D is wrong because S3 Object Lock is for retention, not encryption.

Answer

S3 Object Lock

Answer

Bucket policy requiring s3:x-amz-server-side-encryption header

Answer

S3 Block Public Access

Question 5

A company uses AWS Glue to run ETL jobs on data stored in S3. The data is encrypted with SSE-KMS. The Glue job fails with an 'AccessDenied' error when trying to read the data. What is the MOST likely cause?

Accepted Answer

The IAM role used by Glue does not have kms:Decrypt permission on the KMS key.. Option B is correct because Glue jobs need kms:Decrypt permission on the KMS key to read encrypted data. Option A is wrong because the S3 bucket policy may allow access but KMS permission is separate. Option C is wrong because Glue Data Catalog permissions are for the catalog, not data access. Option D is wrong because Glue connection permissions are for JDBC connections, not S3.

Answer

The S3 bucket policy denies access to the Glue service role.

Answer

The AWS Glue Data Catalog does not have permission to the table.

Answer

The Glue job's connection does not have the necessary permissions.

Question 6

Refer to the exhibit. An S3 bucket policy allows the DataEngineerRole to get objects only if the request uses HTTPS. However, requests from this role are being denied even when using HTTPS. What is the MOST likely reason?

Accepted Answer

The IAM role's attached policy does not allow s3:GetObject on the bucket.. Option D is correct because the condition key aws:SecureTransport evaluates to true when the request is made over HTTPS, but the IAM role's policy might also need to allow the action. Option A is wrong because the bucket policy already allows the role. Option B is wrong because SSE-S3 does not require additional permissions. Option C is wrong because the condition is correctly written.

Answer

The IAM role does not have permission to use SSE-S3.

Answer

The condition key aws:SecureTransport is misspelled.

Answer

The bucket policy does not include a Deny statement for HTTP requests.

Question 7

A data engineer needs to grant an IAM user read-only access to an S3 bucket named 'data-lake'. Which IAM policy statement should be used?

Accepted Answer

{"Effect":"Allow","Action":["s3:ListBucket","s3:GetObject"],"Resource":["arn:aws:s3:::data-lake","arn:aws:s3:::data-lake/*"]}. Option B is correct because it allows ListBucket on the bucket and GetObject on objects. Option A is wrong because it allows all actions. Option C is wrong because it allows write actions. Option D is wrong because it only allows ListBucket, not GetObject.

Answer

{"Effect":"Allow","Action":["s3:PutObject","s3:DeleteObject"],"Resource":"arn:aws:s3:::data-lake/*"}

Answer

{"Effect":"Allow","Action":"s3:*","Resource":"*"}

Answer

{"Effect":"Allow","Action":"s3:ListBucket","Resource":"arn:aws:s3:::data-lake"}

Question 8

Refer to the exhibit. A data engineer runs the AWS CLI command to look up GetObject events. The output shows an event from the DataEngineer role. However, the engineer suspects that some GetObject requests are not being logged. What is the MOST likely reason?

Accepted Answer

The CloudTrail trail is not configured to log data events.. Option B is correct because CloudTrail must have Data Events enabled for S3 object-level operations such as GetObject. Option A is wrong because the event is logged, so the trail exists. Option C is wrong because the engineer is looking up events, not configuring logging. Option D is wrong because the lookup is for a specific region, but the bucket might be in a different region, but that would not cause missing logs if events are logged in the bucket's region.

Answer

The IAM role does not have permission to read the CloudTrail logs.

Answer

The trail is not enabled in the us-east-1 region.

Answer

The S3 bucket is in a different region than the CloudTrail trail.

Question 9

Refer to the exhibit. An IAM policy allows kms:Decrypt and kms:GenerateDataKey on a specific KMS key. A data engineer is unable to upload an object to an S3 bucket that uses SSE-KMS with that key. What is the MOST likely missing permission?

Accepted Answer

s3:PutObject permission on the bucket.. Option A is correct because to upload an object with SSE-KMS, the user needs kms:GenerateDataKey, which is already allowed, but also s3:PutObject permission on the bucket. Option B is wrong because kms:Decrypt is already allowed. Option C is wrong because kms:CreateGrant is not required for uploading. Option D is wrong because kms:Encrypt is not required; GenerateDataKey is sufficient.

Answer

kms:Decrypt permission on the key.

Answer

kms:Encrypt permission on the key.

Answer

kms:CreateGrant permission on the key.

Question 10

A company needs to ensure that data stored in Amazon RDS is encrypted at rest. Which action should the data engineer take?

Accepted Answer

Create a new RDS instance with encryption enabled using AWS KMS.. Option D is correct because encryption at rest for RDS is enabled at instance creation time by enabling encryption with KMS. Option A is wrong because encryption is not automatic; it must be enabled. Option B is wrong because encrypting the EBS volumes is not sufficient for RDS; the database must be encrypted. Option C is wrong because encryption in transit is different from at rest.

Answer

Enable encryption at rest by modifying the existing RDS instance.

Answer

Encrypt the underlying EBS volumes using AWS KMS.

Answer

Enable SSL/TLS for connections to the RDS instance.

Question 11

A company uses Amazon Redshift for data warehousing. The security team requires that all data stored in Redshift be encrypted at rest. The current cluster is unencrypted. Which approach should the data engineer take to meet this requirement with minimal downtime?

Accepted Answer

Take a snapshot of the existing cluster and restore it to a new encrypted cluster.. Option D is correct because Redshift allows restoring a snapshot to a new encrypted cluster. The engineer can take a snapshot of the existing cluster, restore it to a new cluster with encryption enabled, and then redirect traffic to the new cluster. Option A is wrong because encryption cannot be enabled on an existing cluster. Option B is wrong because COPY command does not encrypt the cluster. Option C is wrong because unloading and reloading data would cause significant downtime.

Answer

Modify the cluster to enable encryption.

Answer

Unload data to S3 and reload into a new encrypted cluster.

Answer

Use the COPY command to load data into a new encrypted table.

Question 12

A data engineer needs to ensure that all data stored in an S3 bucket is encrypted at rest. Which S3 bucket policy condition key should be used to enforce encryption using AWS KMS?

Accepted Answer

s3:x-amz-server-side-encryption-aws-kms-key-id. Option A is correct because the s3:x-amz-server-side-encryption-aws-kms-key-id condition key can be used to require a specific KMS key. Option B is wrong because s3:x-amz-server-side-encryption only checks for encryption, not the specific key. Option C is wrong because kms:EncryptionContext is for KMS-level conditions. Option D is wrong because s3:x-amz-acl is for access control lists.

Answer

s3:x-amz-server-side-encryption

Answer

kms:EncryptionContext

Answer

s3:x-amz-acl

Question 13

A company uses AWS Lake Formation to manage data lake permissions. A data analyst is unable to query a table in the data lake using Amazon Athena. The table is registered in Lake Formation, and the analyst has SELECT permission granted via Lake Formation. What is the most likely reason for the failure?

Accepted Answer

The IAM role used by Athena does not have necessary Lake Formation permissions. Option B is correct because Lake Formation integrates with Athena, and the IAM role assumed by Athena must have necessary Lake Formation permissions. Option A is wrong because Lake Formation permissions are separate from S3 bucket policies. Option C is wrong because Data Catalog permissions are managed by Lake Formation. Option D is wrong because enabling encryption in transit is not required for access.

Answer

Athena is configured to use encryption in transit

Answer

The S3 bucket policy does not grant access to the analyst's IAM role

Answer

The table is not registered in the AWS Glue Data Catalog

Question 14

A financial services company needs to share sensitive customer data with a third-party analytics firm. The data resides in an S3 bucket encrypted with an AWS KMS customer managed key. The third party has their own AWS account. Which combination of steps is required to securely share the data? (Choose TWO.)

Accepted Answer

Update the KMS key policy to include the third-party account as a principal with kms:Decrypt permission. Options A and D are correct. Option A: The S3 bucket policy must grant cross-account access. Option D: The KMS key policy must grant decrypt permission to the third-party account. Option B is wrong because the third party does not need access to the KMS key management. Option C is wrong because the third party should not have cross-account access to the S3 bucket without appropriate permissions. Option E is wrong because sharing the KMS key directly is not secure.

Answer

Share the KMS key material with the third party

Answer

Create an IAM role in the third-party account that can be assumed by the data owner

Answer

Grant the third-party account access to the KMS key management

Question 15

A company is designing a data lake on AWS and must comply with GDPR requirements. The company needs to implement data masking for personally identifiable information (PII) columns in Amazon Redshift. Which feature should be used?

Accepted Answer

Create views in Redshift that apply masking functions. Option C is correct. Redshift supports dynamic data masking through views that apply masking functions. Option A is wrong because S3 Object Lambda is for S3. Option B is wrong because Lake Formation does not mask data in Redshift directly. Option D is wrong because RDS Proxy is for RDS, not Redshift.

Answer

Use Amazon RDS Proxy to intercept queries

Answer

Amazon S3 Object Lambda to mask data on the fly

Answer

AWS Lake Formation row-level security