DEA-C01 Data Security and Governance Practice Test 14 — 15 Questions

Question 1

Refer to the exhibit. An IAM policy allows kms:Decrypt and kms:GenerateDataKey on a specific KMS key. A data engineer is unable to upload an object to an S3 bucket that uses SSE-KMS with that key. What is the MOST likely missing permission?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

s3:PutObject permission on the bucket.. The user is unable to upload an object to an S3 bucket that uses SSE-KMS. The IAM policy currently allows kms:Decrypt and kms:GenerateDataKey on the KMS key. However, to upload an object to an S3 bucket, the user also needs the s3:PutObject permission on the bucket. Therefore, the missing permission is s3:PutObject. Option A is incorrect because kms:Decrypt is already allowed. Option C is incorrect because kms:Encrypt is not required; GenerateDataKey is sufficient. Option D is incorrect because kms:CreateGrant is not required for uploading.

Answer

kms:Decrypt permission on the key.

Answer

kms:Encrypt permission on the key.

Answer

kms:CreateGrant permission on the key.

Question 2

A company needs to ensure that data stored in Amazon RDS is encrypted at rest. Which action should the data engineer take?

Accepted Answer

Create a new RDS instance with encryption enabled using AWS KMS.. Amazon RDS encryption at rest must be enabled when the DB instance is created, using AWS KMS. It cannot be added later. Option A is incorrect because encryption cannot be enabled on an existing RDS instance; you must create a new one with encryption enabled. Option B is incorrect because encrypting the underlying EBS volumes does not encrypt the RDS database; RDS encryption at rest is separate and must be configured at the instance level. Option D is incorrect because SSL/TLS secures data in transit, not at rest.

Answer

Enable encryption at rest by modifying the existing RDS instance.

Answer

Encrypt the underlying EBS volumes using AWS KMS.

Answer

Enable SSL/TLS for connections to the RDS instance.

Question 3

A company uses Amazon Redshift for data warehousing. The security team requires that all data stored in Redshift be encrypted at rest. The current cluster is unencrypted. Which approach should the data engineer take to meet this requirement with minimal downtime?

Accepted Answer

Take a snapshot of the existing cluster and restore it to a new encrypted cluster.. Redshift allows restoring a snapshot to a new encrypted cluster. The engineer can take a snapshot of the existing cluster, restore it to a new cluster with encryption enabled, and then redirect traffic to the new cluster. Option A is wrong because encryption cannot be enabled on an existing cluster. Option B is wrong because COPY command does not encrypt the cluster. Option C is wrong because unloading and reloading data would cause significant downtime.

Answer

Modify the cluster to enable encryption.

Answer

Unload data to S3 and reload into a new encrypted cluster.

Answer

Use the COPY command to load data into a new encrypted table.

Question 4

A data engineer needs to ensure that all data stored in an S3 bucket is encrypted at rest. Which S3 bucket policy condition key should be used to enforce encryption using AWS KMS?

Accepted Answer

s3:x-amz-server-side-encryption-aws-kms-key-id. The s3:x-amz-server-side-encryption-aws-kms-key-id condition key allows you to enforce that a specific KMS key is used for server-side encryption with AWS KMS (SSE-KMS). Option A is incorrect because s3:x-amz-server-side-encryption only checks whether server-side encryption is enabled, but does not require a specific KMS key. Option B is incorrect because kms:EncryptionContext is a condition key used in KMS policies, not S3 bucket policies. Option C is incorrect because s3:x-amz-acl is used for access control lists, not encryption.

Answer

s3:x-amz-server-side-encryption

Answer

kms:EncryptionContext

Answer

s3:x-amz-acl

Question 5

A company uses AWS Lake Formation to manage data lake permissions. A data analyst is unable to query a table in the data lake using Amazon Athena. The table is registered in Lake Formation, and the analyst has SELECT permission granted via Lake Formation. What is the most likely reason for the failure?

Accepted Answer

The IAM role used by Athena does not have necessary Lake Formation permissions. Lake Formation integrates with Athena, and the IAM role assumed by Athena must have necessary Lake Formation permissions (e.g., SELECT on the table) to query the data. Option A is incorrect because encryption in transit is about data protection during transmission, not access control; it does not prevent querying. Option C is incorrect because when using Lake Formation, S3 bucket policies are not the primary mechanism for granting access; Lake Formation manages permissions, and the bucket policy typically allows the Lake Formation service role, not the analyst's role. Option D is incorrect because the table is registered in Lake Formation, which requires it to be in the AWS Glue Data Catalog; so this is not the issue.

Answer

Athena is configured to use encryption in transit

Answer

The S3 bucket policy does not grant access to the analyst's IAM role

Answer

The table is not registered in the AWS Glue Data Catalog

Question 6

A financial services company needs to share sensitive customer data with a third-party analytics firm. The data resides in an S3 bucket encrypted with an AWS KMS customer managed key. The third party has their own AWS account. Which combination of steps is required to securely share the data? (Choose TWO.)

Accepted Answer

Update the KMS key policy to include the third-party account as a principal with kms:Decrypt permission. To share encrypted data cross-account, you must grant the third-party account access to both the S3 objects and the KMS key. Option B is correct: the KMS key policy must include the third-party account as a principal with kms:Decrypt permission to allow decryption. Option E is correct: the S3 bucket policy must grant the third-party account access to the objects (e.g., s3:GetObject). Option A is wrong because sharing the key material is insecure and not necessary; instead, you grant decrypt permissions via the key policy. Option C is wrong: the IAM role should be created in the data owner's account, not the third-party's, and the third-party would assume that role; however, this alone does not provide KMS decrypt access. Option D is wrong because the third party does not need key management permissions (e.g., kms:PutKeyPolicy); only decrypt is needed.

Answer

Share the KMS key material with the third party

Answer

Create an IAM role in the third-party account that can be assumed by the data owner

Answer

Grant the third-party account access to the KMS key management

Question 7

A company is designing a data lake on AWS and must comply with GDPR requirements. The company needs to implement data masking for personally identifiable information (PII) columns in Amazon Redshift. Which feature should be used?

Accepted Answer

Create views in Redshift that apply masking functions. Amazon Redshift supports dynamic data masking through views that apply masking functions, such as using CASE statements or custom masking functions to obfuscate PII columns. Option A is incorrect because Amazon RDS Proxy is a connection proxy for RDS databases and does not provide data masking capabilities for Redshift. Option B is incorrect because Amazon S3 Object Lambda is used to transform data in S3, not to mask data in Redshift queries. Option D is incorrect because AWS Lake Formation row-level security filters rows based on permissions but does not mask or obfuscate column values; it is for access control, not data masking.

Answer

Use Amazon RDS Proxy to intercept queries

Answer

Amazon S3 Object Lambda to mask data on the fly

Answer

AWS Lake Formation row-level security

Question 8

A data engineer needs to audit who accessed specific objects in an S3 bucket over the past 30 days. Which AWS service should be used?

Accepted Answer

Amazon S3 server access logs. Amazon S3 server access logs provide detailed records of requests made to an S3 bucket, including object-level access (e.g., who accessed which object, when, and from where). Option A (AWS Config) is used for resource inventory and compliance, not access auditing. Option B (Amazon CloudWatch Logs) can store and monitor logs but does not generate S3 access logs. Option D (AWS CloudTrail) logs API calls to S3, but by default it records bucket-level operations, not object-level access; CloudTrail can be enabled for data events to log object-level operations, but S3 server access logs are specifically designed for detailed object access auditing and are simpler to enable for this requirement.

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Answer

AWS CloudTrail

Question 9

A company has an AWS Glue ETL job that reads data from an S3 bucket encrypted with SSE-S3. The job runs successfully, but the output written to another S3 bucket with SSE-KMS fails. The IAM role for the Glue job has s3:PutObject and kms:GenerateDataKey permissions. What is the most likely cause?

Accepted Answer

The IAM role is missing kms:Encrypt permission. For SSE-KMS, the IAM role needs both kms:GenerateDataKey and kms:Encrypt permissions to write objects. The role already has kms:GenerateDataKey, but missing kms:Encrypt causes the write to fail. Option A is correct. Option B is incorrect because if the bucket policy denied s3:PutObject, the job would fail on the PutObject action itself, not on encryption. Option C is incorrect because the role already has kms:GenerateDataKey; the missing permission is kms:Encrypt. Option D is incorrect because the source bucket's encryption (SSE-S3) is irrelevant to the write operation; the error occurs on the target bucket with SSE-KMS.

Answer

The target S3 bucket policy denies s3:PutObject

Answer

The KMS key policy does not grant the Glue role kms:GenerateDataKey

Answer

The source bucket's encryption type is incompatible with the target

Question 10

A company wants to centrally manage encryption keys for multiple AWS services and automatically rotate them every year. Which AWS service should be used?

Accepted Answer

AWS Key Management Service (KMS). AWS KMS manages encryption keys and supports automatic key rotation annually. Option A is wrong because CloudHSM provides hardware-based key storage but does not offer automatic key rotation. Option B is wrong because ACM manages SSL/TLS certificates, not encryption keys. Option C is wrong because Secrets Manager is designed to manage secrets like database credentials, not encryption keys.

Answer

AWS CloudHSM

Answer

AWS Certificate Manager (ACM)

Answer

AWS Secrets Manager

Question 11

A data engineer needs to ensure that an Amazon Redshift cluster encrypts all data at rest. Which setting must be enabled when creating the cluster?

Accepted Answer

Enable encryption. Amazon Redshift encryption at rest is enabled during cluster creation by selecting the encryption option. Option A is incorrect because enabling automated snapshots is for backup and recovery, not encryption. Option C is incorrect because SSL/TLS ensures encryption in transit, not at rest. Option D is incorrect because VPC is for network isolation, not encryption.

Answer

Enable automated snapshots

Answer

Enable SSL/TLS

Answer

Enable VPC

Question 12

A company uses Amazon RDS for PostgreSQL with encryption at rest using AWS KMS. The company needs to share a database snapshot with a different AWS account. What must be done to allow the target account to restore the snapshot?

Accepted Answer

Share the snapshot and update the KMS key policy to allow the target account to use the key. Cross-account snapshot sharing of an encrypted snapshot requires both sharing the snapshot and granting the target account permission to use the KMS key via the key policy. Option A is incorrect because copying does not grant the necessary key access. Option B is incorrect because IAM roles are not used for this purpose; KMS key policies are the mechanism for cross-account access. Option D is incorrect because encryption cannot be disabled on an existing encrypted snapshot.

Answer

Copy the snapshot to the target account's region and share it

Answer

Create an IAM role in the source account that allows cross-account snapshot access

Answer

Disable encryption on the snapshot before sharing

Question 13

Refer to the exhibit.

Exhibit:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::123456789012:role/DataEngineer"
      },
      "Action": [
        "kms:Decrypt",
        "kms:ReEncrypt*"
      ],
      "Resource": "*"
    }
  ]
}

A data engineer tries to encrypt data using the KMS key associated with this key policy and receives an access denied error. What is the cause?

Accepted Answer

The policy does not include kms:Encrypt action. The key policy grants Decrypt and ReEncrypt* actions, but not Encrypt. Therefore, the DataEngineer role does not have permission to encrypt data using this key. Option A is incorrect because IAM roles can be used as principals in key policies. Option B is incorrect because there is no explicit deny statement in the policy. Option C is incorrect because "Resource": "*" is valid in KMS key policies and refers to the current key.

Answer

The principal is an IAM role, which is not allowed

Answer

There is an explicit deny in the policy

Answer

The Resource element is set to "*", which is invalid for KMS key policies

Question 14

A data engineer runs an AWS Glue ETL job that reads from a table in the AWS Glue Data Catalog. The job fails with the error shown. The IAM role used by the Glue job has the following policy attached:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "glue:GetTable",
                "glue:GetDatabase"
            ],
            "Resource": "*"
        }
    ]
}

What should be added to the IAM role's policy to resolve the error?

Accepted Answer

lakeformation:GetDataAccess on the table resource. Lake Formation requires lakeformation:GetDataAccess permission on the table. Option A is wrong because the error is about Lake Formation, not S3. Option B is wrong because the role already has glue:GetTable. Option D is wrong because kms:Decrypt is not indicated.

Answer

s3:GetObject on the underlying S3 bucket

Answer

glue:GetTable on the specific table resource

Answer

kms:Decrypt on the KMS key

Question 15

A data engineer applies the above bucket policy to an S3 bucket containing sensitive data. The goal is to allow only encrypted (HTTPS) requests. However, a user reports being able to access an object using an HTTP (non-HTTPS) request. What is the most likely reason?

Accepted Answer

The condition key aws:SecureTransport is used with BoolIfExists instead of Bool. The policy uses "BoolIfExists" instead of "Bool" for the aws:SecureTransport condition. "BoolIfExists" evaluates to true if the key is absent (as in HTTP requests), thus the Deny effect is not triggered, allowing HTTP access. Option A is wrong because using Allow or Deny is not the issue; the condition key's evaluation is the problem. Option B is incorrect because the resource ARN must include the bucket itself when using bucket policies, but this is not relevant here. Option D is wrong because a principal of "*" includes all authenticated users (not anonymous).

Answer

The policy uses Allow instead of Deny

Answer

The resource ARN does not include the bucket itself

Answer

The principal is set to "*", which allows anonymous access