DEA-C01 Data Security and Governance Practice Test 13 — 15 Questions

Question 1

A data engineering team stores sensitive customer records in an Amazon S3 bucket. A compliance requirement mandates that the AWS account team cannot view or manage the encryption keys that protect these objects, and the data must be encrypted at rest using keys that the company controls and rotates independently. Which encryption option should the team implement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

SSE-KMS with a customer managed key in AWS KMS. The requirement demands that the account team cannot view or manage the encryption keys while the company retains independent control and rotation. AWS KMS customer managed keys provide this separation: the key material is protected by AWS KMS, and the company defines key policies and rotation schedules. SSE-S3, SSE-C with stored keys, and client-side keys on EBS all allow the account team to access or manage the keys, failing the compliance constraint.

Answer

SSE-C with customer-provided encryption keys stored in AWS Secrets Manager

Answer

Client-side encryption with a custom application-managed key stored on Amazon EBS

Answer

SSE-S3 with bucket default encryption enabled

Question 2

A financial services company stores customer transaction records in Amazon S3. An AWS Glue ETL job reads these records, applies transformations, and writes the results to another S3 bucket. The security team mandates that all data at rest be encrypted with customer-managed AWS KMS keys, and that the Glue job must not be able to read or write unencrypted data. The company wants to enforce this requirement with minimal ongoing administrative effort. Which solution should the data engineer implement?

Accepted Answer

Configure the S3 buckets with default encryption using SSE-KMS with a customer-managed key, and attach an IAM policy to the Glue job role that allows kms:Decrypt and kms:GenerateDataKey on that key.. The correct solution uses S3 default encryption with SSE-KMS and a customer-managed key, combined with appropriate KMS permissions for the Glue job role. This enforces encryption at rest for all objects written to the buckets and allows the Glue job to read and write encrypted data without code changes. It meets the security mandate with minimal administrative effort, as default encryption applies automatically to all new objects.

Answer

Use S3 bucket policies to deny any PutObject requests that do not include the x-amz-server-side-encryption header with the value aws:kms, and provide the Glue job role with kms:Decrypt permissions only.

Answer

Enable S3 default encryption with SSE-S3 on both buckets and configure the Glue job to use the --encryption-mode sse-s3 parameter. Grant the Glue job role full S3 access.

Answer

Create an AWS Lambda function that triggers on S3 PutObject events to encrypt objects with a customer-managed KMS key after they are uploaded, and grant the Glue job role permissions to invoke the function.

Question 3

A data engineer is using AWS Lake Formation to manage access to a data lake in Amazon S3. The engineer needs to grant a specific IAM role access to only the columns containing non-sensitive data in a table, while hiding sensitive columns. The table is registered in the AWS Glue Data Catalog. Which Lake Formation permission model should the engineer use?

Accepted Answer

Grant the IAM role SELECT permission on the table with column-level filters using Lake Formation tag-based access control (LF-TBAC).. Lake Formation tag-based access control (LF-TBAC) enables column-level security by associating tags with columns and granting permissions based on those tags. This allows the IAM role to access only non-sensitive columns. The other options do not provide column-level filtering within the table.

Answer

Use AWS Glue Data Catalog resource policies to grant column-level permissions to the IAM role.

Answer

Create an IAM policy that allows s3:GetObject on the S3 bucket and use S3 Access Points to restrict access to specific prefixes.

Answer

Grant the IAM role SELECT permission on the table and use AWS Glue job bookmarks to filter sensitive columns during ETL.

Question 4

A data engineer is building a pipeline that copies sensitive datasets from an on-premises data center into Amazon S3 and then processes them with AWS Glue. The security team requires that data be encrypted in transit and that access to the S3 buckets be auditable. Which TWO actions should the engineer take to meet these requirements? (Choose two.)

Accepted Answer

Use AWS DataSync with TLS enabled to transfer the on-premises data to Amazon S3.. AWS DataSync encrypts data in transit using TLS while moving on-premises data into Amazon S3, satisfying the transport encryption requirement. CloudTrail data events record object-level S3 API calls such as GetObject and PutObject, providing the audit trail the security team requires. Together these two actions cover both the encryption-in-transit and auditability requirements.

Answer

Enable Amazon Macie on the account to classify sensitive data in the S3 buckets.

Answer

Create an S3 bucket policy that requires requests to include the aws:SecureTransport condition key.

Answer

Configure the S3 buckets to use SSE-S3 default encryption so that objects are encrypted at rest.

Question 5

A company uses AWS Lake Formation to manage access to a data lake in Amazon S3. A data engineer needs to grant a specific IAM role read access to only the columns 'customer_id' and 'purchase_amount' in a table stored in Parquet format, while denying access to all other columns. The role should also be able to query the table using Amazon Athena. Which Lake Formation permission configuration should the data engineer use?

Accepted Answer

Grant the role SELECT permission on the table and then apply column-level filters using Lake Formation tag-based access control (LF-TBAC) with tags assigned to the allowed columns.. Lake Formation tag-based access control (LF-TBAC) allows granting permissions based on tags attached to columns. By tagging the allowed columns and granting the role SELECT on those tags, the role can access only those columns. Athena enforces these permissions, providing column-level security. Other methods either do not provide column-level granularity or are not the correct Lake Formation mechanism.

Answer

Grant the role SELECT permission on the table and use a Lake Formation data filter that includes only the allowed columns, then grant the role access to the data filter.

Answer

Create an IAM policy that allows s3:GetObject on the specific Parquet files and attach it to the role, then use Athena to query the table.

Answer

Grant the role SELECT permission on the table and use an Athena workgroup with a query editor that restricts column visibility.

Question 6

A data engineer is configuring AWS Lake Formation to manage access to data in an S3 bucket. The company wants to ensure that all data access is logged for auditing purposes. The security team requires that every Lake Formation permission change and data access attempt be recorded in AWS CloudTrail. The engineer has enabled CloudTrail for the account. Which additional step is necessary to capture Lake Formation data access events?

Accepted Answer

Configure Lake Formation to log data access events to CloudTrail by enabling 'Data access events' in the Lake Formation settings.. Lake Formation data access events are not captured by default in CloudTrail management events. To log them, you must explicitly enable data access events in Lake Formation settings. This ensures that all permission evaluations and data access attempts are recorded, meeting the auditing requirement.

Answer

Create an AWS Config rule that monitors Lake Formation permissions and logs changes to CloudTrail.

Answer

Use AWS CloudTrail Insights to automatically detect and log anomalous Lake Formation data access patterns.

Answer

Enable CloudTrail data events for the S3 bucket that contains the data.

Question 7

A data engineer is implementing a data governance strategy for a multi-account AWS environment. The company uses AWS Organizations and wants to ensure that all data in Amazon S3 is encrypted at rest and that no S3 bucket can be made public. The engineer needs to enforce these policies centrally across all accounts. Which TWO actions should the engineer take to meet these requirements? (Choose two.)

Accepted Answer

Configure an S3 Block Public Access setting at the organization level using AWS Organizations.. To centrally enforce encryption and prevent public S3 buckets across an organization, use AWS Config managed rules with automatic remediation for continuous compliance, and enable S3 Block Public Access at the organization level to block public access settings. SCPs and IAM policies cannot enforce dynamic encryption or public access states, and CloudFormation StackSets alone do not provide ongoing enforcement.

Answer

Create a service control policy (SCP) that denies s3:PutBucketPolicy and s3:PutBucketAcl actions unless the bucket is encrypted and not public.

Answer

Use AWS CloudFormation StackSets to deploy a baseline S3 bucket policy that denies public access and enforces encryption to all accounts.

Answer

Attach an IAM policy to all users that denies s3:PutBucketAcl and s3:PutBucketPolicy actions.

Question 8

A data engineer is using AWS Lake Formation to manage fine-grained access to a Data Catalog table that contains sensitive columns. The table is stored in Amazon S3 in Parquet format. The engineer grants SELECT permissions on specific columns to an IAM role used by an Amazon Athena workgroup. However, when a user in that workgroup queries the table, they receive an error indicating insufficient permissions to access the underlying S3 data. The Lake Formation data lake location is registered, and the role has been granted DESCRIBE on the database. What is the MOST likely reason for this error?

Accepted Answer

The query engine (Athena) does not support column-level fine-grained access control with Lake Formation when the table is in Parquet format.. Lake Formation column-level permissions require the query engine to support fine-grained access control and to be configured to use Lake Formation credentials. If the S3 data is encrypted with SSE-KMS, the Lake Formation service-linked role needs kms:Decrypt. The error indicates that the query engine cannot access the underlying data, often because the KMS key policy does not allow the Lake Formation role to decrypt.

Answer

The IAM role lacks s3:GetObject permission on the S3 bucket where the table data resides.

Answer

The Lake Formation data lake location for the S3 bucket is not registered with the correct IAM role that has access to the S3 data.

Answer

The IAM role has not been granted SELECT permission on the table at the table level, only column-level permissions.

Question 9

A company uses AWS Key Management Service (AWS KMS) to encrypt data across multiple AWS services. A data engineer needs to ensure that a specific KMS key can only be used by a particular IAM role for cryptographic operations, and that the key cannot be deleted accidentally. The engineer has created the key and wants to apply the necessary controls. Which combination of actions should the engineer take to meet these requirements?

Accepted Answer

Update the KMS key policy to allow only the specific IAM role to perform kms:Encrypt, kms:Decrypt, and kms:GenerateDataKey, and enable key deletion protection.. The KMS key policy is the authoritative access control for a KMS key. Modifying it to allow only the specific IAM role ensures that no other principals can use the key, even if they have IAM policies granting access. Enabling key deletion protection prevents accidental deletion by requiring a waiting period and a second confirmation. This combination satisfies both the access restriction and deletion prevention requirements.

Answer

Use an AWS Organizations service control policy (SCP) to deny all KMS actions except for the specific IAM role, and enable key deletion protection.

Answer

Create a grant on the KMS key for the specific IAM role with the necessary permissions, and set a CloudWatch alarm for key deletion events.

Answer

Attach an IAM policy to the specific IAM role that allows kms:Encrypt, kms:Decrypt, and kms:GenerateDataKey, and enable automatic key rotation.

Question 10

A data engineering team must ensure that a sensitive dataset stored in Amazon S3 is automatically encrypted at rest and that the encryption keys are rotated annually. The team wants minimal operational overhead and no custom key management processes. Which solution meets these requirements?

Accepted Answer

Use server-side encryption with Amazon S3 managed keys (SSE-S3), which automatically encrypts objects and rotates keys without user intervention.. SSE-S3 provides automatic encryption at rest with keys fully managed by Amazon S3, including automatic rotation. It requires no key management effort from the team, satisfying both automatic encryption and annual key rotation with minimal operational overhead. Other options either introduce custom key management, require manual key configuration, or do not rotate keys annually.

Answer

Use client-side encryption with a custom key management application that rotates keys every year.

Answer

Enable server-side encryption with AWS KMS customer managed keys (SSE-KMS) and configure automatic annual key rotation.

Answer

Enable Amazon S3 default encryption with SSE-KMS using the AWS managed key aws/s3, which automatically rotates keys annually.

Question 11

A data engineer is configuring AWS Glue DataBrew to profile a dataset stored in Amazon S3. The dataset contains personally identifiable information (PII) such as social security numbers. The company's security policy requires that PII be masked in the profiling results and that the original data remains unchanged. The data engineer needs to ensure that DataBrew identifies and masks the PII columns automatically. Which solution should the data engineer implement?

Accepted Answer

In the DataBrew profile job configuration, enable the 'PII detection' option and select the appropriate masking level (e.g., mask all PII). Run the profile job on the dataset.. DataBrew profile jobs have a built-in PII detection feature that can automatically identify columns containing PII and mask the values in the profiling results. Enabling this option in the profile job configuration ensures that sensitive data is masked in the output without modifying the source dataset. This is the most direct and efficient solution, requiring no additional ETL or external services.

Answer

Use AWS Glue Studio to create an ETL job that reads the dataset, applies a 'Detect PII' transform, masks the identified columns, and writes the masked data to a new S3 location. Then run a DataBrew profile job on the masked dataset.

Answer

Configure the S3 bucket to use Macie to automatically discover and mask PII, and then run a DataBrew profile job on the bucket. Macie will ensure that PII is masked in the profiling results.

Answer

Create a DataBrew recipe with a 'Mask sensitive data' transform step, selecting the columns containing PII and choosing a masking pattern. Apply the recipe to the dataset and run a profile job.

Question 12

A financial services company uses AWS Lake Formation to manage a data lake in Amazon S3. The company needs to audit all access to sensitive tables and retain the audit logs for 10 years in a tamper-evident manner. The logs must be immutable and stored in a separate AWS account. Which combination of actions should the data engineer take to meet these requirements?

Accepted Answer

Enable AWS CloudTrail data events for the S3 bucket, deliver logs to an S3 bucket in a separate account, and enable S3 Object Lock in compliance mode on that bucket.. Auditing access to Lake Formation-managed tables requires capturing S3 data events, as Lake Formation access translates to S3 object reads. CloudTrail data events provide this. Delivering logs to a separate account with S3 Object Lock in compliance mode ensures they are immutable and retained for the required period, meeting tamper-evident and 10-year retention. This combination is the most secure and compliant.

Answer

Enable AWS CloudTrail management events for Lake Formation, deliver logs to an S3 bucket in the same account, and use S3 Lifecycle policies to transition logs to Glacier after 10 years.

Answer

Use AWS Lake Formation to enable audit logging, which automatically writes logs to an S3 bucket with Object Lock enabled in the same account.

Answer

Enable Amazon S3 server access logging on the data lake bucket, deliver logs to a separate account, and use AWS KMS to encrypt the logs.

Question 13

A company stores sensitive data in an Amazon S3 bucket and uses AWS KMS customer managed keys for encryption. The security team wants to ensure that all data uploaded to the bucket is encrypted with a specific KMS key, and that any upload attempt without that key is denied. They have created a bucket policy that denies s3:PutObject if the request does not include the s3:x-amz-server-side-encryption header set to aws:kms. However, some uploads are still succeeding without encryption. What is the MOST likely reason?

Accepted Answer

The bucket policy does not include a Deny statement with the condition StringNotEquals on the s3:x-amz-server-side-encryption header.. To enforce encryption with a specific KMS key, the bucket policy must include a Deny statement with a condition like StringNotEquals on s3:x-amz-server-side-encryption and StringNotEquals on s3:x-amz-server-side-encryption-aws-kms-key-id. Without an explicit deny, uploads that omit the header may still succeed if allowed by IAM or other policies.

Answer

The bucket policy condition uses the wrong header name; it should be s3:x-amz-server-side-encryption-aws-kms-key-id.

Answer

The S3 bucket has default encryption enabled with SSE-S3, which allows uploads without the KMS header to succeed.

Answer

The IAM policies of the uploading principals allow s3:PutObject without encryption conditions, which overrides the bucket policy.

Question 14

A data engineer is designing a solution to protect sensitive data in an Amazon Redshift cluster. The security team requires that data be encrypted at rest and in transit, and that access to the cluster be restricted to specific IAM roles. The engineer has enabled encryption for the cluster and configured SSL for connections. Which TWO additional measures should the data engineer implement to meet the security requirements? (Choose two.)

Accepted Answer

Create an IAM policy that allows Redshift GetClusterCredentials action for specific IAM roles and attach it to those roles.. To restrict Redshift access to specific IAM roles, the engineer should enable IAM authentication and map database users to IAM roles, and grant GetClusterCredentials permission only to those roles. These two measures together enforce identity-based access control, meeting the security requirement.

Answer

Use a VPC security group to allow connections only from specific IP ranges.

Answer

Enable audit logging for the Redshift cluster to capture connection and user activity logs.

Answer

Use AWS Secrets Manager to rotate the Redshift master user password regularly.

Question 15

A data engineer is configuring an Amazon Redshift cluster to load data from an Amazon S3 bucket. The security team requires that data be encrypted in transit and that Redshift uses a specific AWS KMS key to decrypt the data. Which action should the engineer take to meet these requirements?

Accepted Answer

Use the COPY command with the KMS_KEY_ID parameter to specify the KMS key ARN, and ensure the Redshift cluster's IAM role has permissions to use the key.. The COPY command with the KMS_KEY_ID parameter allows Redshift to decrypt data from S3 using a specific KMS key. The cluster's IAM role must have kms:Decrypt permission. Data in transit is encrypted by default. Other options either use incorrect commands or do not specify the required KMS key.

Answer

Enable encryption in transit on the Redshift cluster and use the default KMS key for S3 encryption.

Answer

Use the COPY command with the ENCRYPTED option and specify the KMS key ARN.

Answer

Use the UNLOAD command with the KMS_KEY_ID parameter to load data from S3.