DEA-C01 Data Security and Governance Practice Test 14 — 15 Questions

Question 1

A data engineer is using AWS Glue to read from a JDBC data source that requires a password. The security team mandates that the password must not be stored in plaintext in the Glue job script or in the Glue Data Catalog. The engineer needs to configure the Glue connection securely. Which solution meets these requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Store the password in AWS Secrets Manager and reference it in the Glue connection using a secret ARN.. AWS Glue connections natively support using AWS Secrets Manager to store JDBC credentials. By specifying the secret ARN in the connection, the password is not stored in plaintext in the connection or job script. This meets the security requirement and integrates with IAM for access control. Other methods either require custom code or are not supported.

Answer

Create an IAM role with a trust policy that allows Glue to assume it and embed the password in the role's tags.

Answer

Encrypt the password with a KMS key and store the ciphertext in the Glue connection's password field.

Answer

Use AWS Systems Manager Parameter Store to store the password as a SecureString and reference it in the Glue job script.

Question 2

A company runs an AWS Glue ETL job that reads from an Amazon S3 bucket and writes to another S3 bucket. The security team requires that all data written by the job be encrypted with a customer-managed AWS KMS key, and the job must have the least privilege necessary. Which configuration should the data engineer apply to meet these requirements?

Accepted Answer

Configure the Glue job to write with SSE-KMS using a customer-managed key by setting the job parameter --enable-s3-encryption and specifying the KMS key ARN, and grant the Glue job's IAM role kms:GenerateDataKey and kms:Decrypt on that key.. The requirement is to write data encrypted with a specific customer-managed KMS key using least privilege. The most direct and secure method is to configure the AWS Glue job to use SSE-KMS with that key and grant the job's IAM role only the necessary KMS actions. This ensures both the encryption type and the key are correct, and the permissions are scoped to the job.

Answer

Add a bucket policy to the target S3 bucket that denies PutObject requests unless the x-amz-server-side-encryption header is set to aws:kms.

Answer

Enable default encryption on the target S3 bucket using SSE-S3, and rely on the bucket default to encrypt all objects written by the Glue job.

Answer

Attach an IAM policy to the Glue job's role that allows s3:PutObject with the condition StringEquals on s3:x-amz-server-side-encryption to aws:kms, and use the default Glue encryption behavior.

Question 3

A data engineer is building an AWS Glue ETL job that reads from an Amazon S3 bucket. The security team requires that data be encrypted in transit between AWS Glue and Amazon S3. The S3 bucket has a bucket policy that denies requests where aws:SecureTransport is false. Which of the following must the engineer do to meet the encryption-in-transit requirement?

Accepted Answer

Configure the Glue job to use the S3A filesystem with the property fs.s3a.ssl.enabled set to true.. To encrypt data in transit between AWS Glue and Amazon S3, the Glue job must use the S3A filesystem with SSL enabled. This ensures that all data transferred uses TLS, satisfying the bucket policy's aws:SecureTransport condition. Other options either address encryption at rest or do not actively enforce encryption during transmission, making them incorrect for this scenario.

Answer

Use AWS Glue's built-in encryption context to encrypt data before writing to S3.

Answer

Enable server-side encryption with AWS KMS keys (SSE-KMS) on the S3 bucket.

Answer

Attach an IAM policy to the Glue job role that allows s3:PutObject with a condition on aws:SecureTransport.

Question 4

A data engineer manages a large S3 data lake and wants to enforce that all new objects are encrypted with SSE-KMS using a specific customer managed key. The engineer also needs to ensure that any PUT requests without the required encryption headers are automatically denied. Which approach should the engineer take?

Accepted Answer

Enable default encryption on the S3 bucket with the desired KMS key, and add a bucket policy that denies s3:PutObject requests that do not include the s3:x-amz-server-side-encryption-aws-kms-key-id condition matching the key ARN.. To enforce that all new objects are encrypted with a specific KMS key, the engineer must combine S3 default encryption with a bucket policy that denies PUT requests unless the request includes the correct KMS key ID condition. Default encryption alone does not prevent users from specifying a different key or no key, and a policy checking only the encryption algorithm does not enforce the specific key. The bucket policy condition key s3:x-amz-server-side-encryption-aws-kms-key-id ensures the exact key is used.

Answer

Use an S3 Access Point with a policy that requires s3:x-amz-server-side-encryption to be aws:kms, and rely on S3 default encryption to apply the specific key.

Answer

Create an S3 bucket policy that denies s3:PutObject requests where the s3:x-amz-server-side-encryption condition key is not equal to aws:kms.

Answer

Configure an S3 Batch Operations job to retroactively encrypt all objects with the desired KMS key, and schedule it to run daily.

Question 5

A data engineer manages an AWS Glue ETL job that processes customer PII stored in an Amazon S3 bucket. The security team requires that the data be masked so that only the last four digits of each credit card number remain visible in the transformed output, while the full number is still available for downstream joins within the same job. The engineer wants to implement this with the least development effort. Which approach should the engineer use?

Accepted Answer

Use the AWS Glue Sensitive Data Detection transform to identify credit card columns, then apply the built-in masking option that replaces all but the last four digits.. The Sensitive Data Detection transform in AWS Glue Studio can identify PII columns using built-in patterns and apply masking actions such as partial redaction. Because it operates within the same Glue job, the original credit card value remains usable for joins while the written output contains only the last four digits. This satisfies both the masking requirement and the need for the full value during processing with minimal custom code.

Answer

Configure an S3 bucket policy that denies GetObject unless the request includes a condition for the credit card prefix.

Answer

Use the AWS Glue DataBrew PII masking transform in a recipe and run it as a DataBrew job before the Glue job.

Answer

Use the GlueTransform 'ApplyMapping' to drop the credit card column and add a new column with only the last four digits.

Question 6

A data engineer is responsible for securing an Amazon Redshift cluster that contains sensitive customer data. The security team requires that data be encrypted at rest and in transit, and that access to the cluster be audited. Which TWO actions should the data engineer take to meet these requirements? (Choose two.)

Accepted Answer

Configure the Redshift cluster to require SSL connections by setting the 'require_ssl' parameter to true in the cluster's parameter group.. To encrypt data at rest in Amazon Redshift, enable cluster encryption using AWS KMS. To encrypt data in transit, set the require_ssl parameter to true in the cluster's parameter group, forcing all connections to use SSL/TLS. These two actions together meet the encryption requirements for data at rest and in transit. Other actions like audit logging, IAM policies, and VPC configuration are important for security but do not provide encryption.

Answer

Create an IAM policy that restricts access to the Redshift cluster to only authorized users, and attach it to the appropriate IAM roles.

Answer

Configure the Redshift cluster to use a VPC with private subnets and a NAT gateway to isolate it from the internet.

Answer

Enable Amazon Redshift audit logging to capture connection and user activity logs, and store them in an S3 bucket.

Question 7

A data engineer is designing a solution to store sensitive data in Amazon S3. The company requires that the data be encrypted at rest using a customer managed key in AWS KMS, and that the key be automatically rotated every year. The engineer creates a KMS customer managed key with automatic rotation enabled. However, the security team later discovers that the key was not rotated as expected. What is the most likely reason for the rotation not occurring?

Accepted Answer

The KMS key is imported key material, and automatic rotation is not supported for imported key material.. Automatic rotation is not supported for KMS keys with imported key material. If the engineer created a key with imported key material and enabled automatic rotation, the rotation would not occur; AWS KMS cannot rotate key material it does not manage. This is the most likely reason for the rotation failure.

Answer

The KMS key is a multi-Region key, and automatic rotation is not supported for multi-Region keys.

Answer

The KMS key is in a custom key store, and automatic rotation is not supported for custom key stores.

Answer

The KMS key is asymmetric, and automatic rotation is not supported for asymmetric keys.

Question 8

A data engineer is responsible for a data lake in Amazon S3 that contains sensitive customer information. The security team requires that access to the data be audited and that any changes to the S3 bucket policy be monitored. The engineer needs to implement logging and monitoring for these requirements. Which TWO actions should the engineer take? (Choose two.)

Accepted Answer

Enable AWS CloudTrail data events for the S3 bucket to log object-level operations such as GetObject and PutObject.. To audit access to sensitive data, CloudTrail data events must be enabled for the S3 bucket to log object-level operations. To monitor changes to the bucket policy, an EventBridge rule can capture the PutBucketPolicy management event from CloudTrail and trigger notifications. These two actions together satisfy the auditing and monitoring requirements.

Answer

Enable Amazon GuardDuty S3 Protection to detect suspicious activity and automatically remediate bucket policy changes.

Answer

Use AWS Config to record changes to the S3 bucket policy and send notifications when the policy becomes noncompliant with a custom rule.

Answer

Configure S3 server access logging to capture detailed records of all requests made to the bucket.

Question 9

A data engineer is using AWS Lake Formation to manage fine-grained access to a data lake stored in Amazon S3. The engineer needs to grant a specific IAM role access to only the columns 'customer_id' and 'purchase_amount' in a table, while denying access to all other columns. The role also requires the ability to query the table using Amazon Athena. Which combination of actions should the engineer take?

Accepted Answer

Grant the IAM role DESCRIBE permission on the table, and then create a data filter that includes only the two columns and grant SELECT on that data filter.. Lake Formation column-level security is implemented by granting DESCRIBE on the table and then creating a data filter that includes only the allowed columns, followed by granting SELECT on that data filter. This grants the IAM role the ability to query only those columns through Athena. Granting SELECT on the table directly would allow access to all columns, and IAM policies alone cannot enforce column-level restrictions in Athena.

Answer

Grant the IAM role SELECT permission on the table in Lake Formation, and then create a data filter that includes only the two columns and excludes all others.

Answer

Create an AWS Glue Data Catalog table that contains only the two columns, and grant the IAM role SELECT permission on that new table.

Answer

Use an IAM policy that allows athena:StartQueryExecution and s3:GetObject on the table's S3 location, and rely on Athena's column-level security to restrict access.

Question 10

A data engineer is designing a data lake on Amazon S3. The company has strict compliance requirements: all data must be encrypted at rest using AWS KMS, and the encryption key must be rotated annually. The engineer creates a customer-managed KMS key and enables automatic key rotation. After one year, the key is rotated. A data analyst attempts to read an object that was encrypted with the old key version but receives an access denied error. The analyst's IAM policy allows s3:GetObject and kms:Decrypt on the KMS key. What is the most likely cause of the error?

Accepted Answer

The analyst's IAM policy allows kms:Decrypt but the KMS key policy does not grant the analyst's role access to the key.. Access to a KMS key requires permissions in both the IAM policy and the KMS key policy. Even if the analyst's IAM policy allows kms:Decrypt, the key policy must also grant that permission to the analyst's role. If the key policy is restrictive or does not include the role, decryption fails. Key rotation does not change this requirement; old key versions remain usable if permissions are correctly configured. The other options misunderstand KMS key versioning and S3 Bucket Keys.

Answer

The S3 object was encrypted with an S3 Bucket Key, and the analyst lacks kms:Decrypt on the bucket key.

Answer

The analyst's IAM policy must include kms:Decrypt on the old key version's ARN.

Answer

The KMS key policy does not allow the analyst to use the old key version.

Question 11

A data engineer is configuring an AWS Glue job that processes data from an Amazon Kinesis Data Stream. The security team requires that all data in transit be encrypted using TLS. The Kinesis stream is configured with server-side encryption using an AWS KMS key. Which additional configuration is required to ensure that data is encrypted in transit between the Glue job and Kinesis?

Accepted Answer

Ensure the Glue job uses the Kinesis Data Streams endpoint with HTTPS.. AWS Glue uses the Kinesis Data Streams API over HTTPS by default, which encrypts data in transit using TLS. Therefore, no additional configuration is required beyond ensuring the job uses the standard HTTPS endpoint. Security configurations and IAM policies do not enforce TLS and are not the correct solutions for this requirement.

Answer

Attach an IAM policy to the Glue job role that denies requests where aws:SecureTransport is false.

Answer

Enable the Glue job's security configuration to use TLS.

Answer

Configure the Kinesis stream to use server-side encryption with a customer-managed KMS key.

Question 12

A company needs to implement data masking to protect sensitive information in an Amazon Redshift cluster. The security team requires that the masking be applied dynamically based on the user's role, without altering the stored data. Which two features or approaches should the data engineer use to achieve this? (Choose two.)

Accepted Answer

Enable dynamic data masking (DDM) on the Redshift cluster and define masking policies for specific columns based on IAM roles.. To dynamically mask sensitive data in Redshift based on user role without altering stored data, two approaches are valid: using views with masking functions, and using Redshift's native dynamic data masking (DDM). Views allow you to apply expressions to mask columns and grant access to the view. DDM lets you attach masking policies to columns that automatically apply based on the user's role. Both achieve dynamic masking.

Answer

Use Redshift column-level access control (CLAC) to grant SELECT permission on specific columns, and use masking expressions in the grants.

Answer

Use AWS Glue to create a masked copy of the table in Amazon S3, and query the masked data using Redshift Spectrum.

Answer

Implement row-level security (RLS) policies in Redshift to restrict which rows users can access, and rely on RLS to mask column values.

Question 13

A data engineer needs to ensure that an Amazon S3 bucket used for storing sensitive data is encrypted at rest with a customer-managed AWS KMS key. The engineer wants to enforce that all objects uploaded to the bucket are encrypted with this key. Which action should the engineer take?

Accepted Answer

Enable default encryption on the bucket with SSE-KMS using the customer-managed key.. Enabling default encryption on the S3 bucket with SSE-KMS using the customer-managed key ensures that all objects are automatically encrypted with that key upon upload. This enforces the requirement without relying on clients to specify encryption headers. Other options either do not enforce encryption, require manual intervention, or use the wrong encryption method.

Answer

Use AWS CloudTrail to monitor all PutObject requests and remediate any unencrypted objects.

Answer

Configure the bucket to use SSE-S3 and then re-encrypt all objects with the customer-managed key using a batch job.

Answer

Create a bucket policy that denies PutObject requests that do not include the x-amz-server-side-encryption header with the correct key.

Question 14

A company stores sensitive data in an Amazon S3 bucket and uses AWS KMS customer-managed keys for encryption. The security team requires that all data be encrypted with a specific KMS key and that the key be rotated every year. The data engineer needs to ensure that the key policy allows only authorized principals to use the key for encryption and decryption. Which combination of actions should the engineer take to meet these requirements?

Accepted Answer

Enable automatic key rotation on the KMS key with a rotation period of 365 days, and update the key policy to allow the authorized IAM roles to perform kms:Encrypt, kms:Decrypt, and kms:GenerateDataKey.. Enabling automatic key rotation on a customer-managed KMS key with a 365-day period satisfies the yearly rotation requirement. Updating the key policy to allow the authorized IAM roles to perform the necessary KMS operations ensures that only those principals can use the key for encryption and decryption. This is the correct and secure configuration.

Answer

Enable automatic key rotation on the KMS key with a rotation period of 365 days, and rely on the default key policy to grant access to the authorized roles.

Answer

Manually rotate the KMS key every year by creating a new key and updating the S3 bucket to use the new key, and attach an IAM policy to the authorized roles allowing kms:Encrypt and kms:Decrypt.

Answer

Use an AWS managed key for S3 (aws/s3) instead of a customer-managed key, and enable automatic rotation, which is managed by AWS.

Question 15

A data engineer is designing a data lake on Amazon S3 that will store sensitive personal data. The security team requires that the data be encrypted at rest and that access to the data be logged for auditing. The engineer needs to choose TWO AWS services or features that together provide encryption at rest and access logging for the S3 bucket. (Choose two.)

Accepted Answer

Enable AWS CloudTrail data events for the S3 bucket.. To meet both encryption at rest and access logging, the engineer should use SSE-KMS for encryption and CloudTrail data events for logging. SSE-KMS encrypts objects at rest and allows auditing of key usage, while CloudTrail data events record object-level access. Together they satisfy the security team's requirements without unnecessary overlap.

Answer

Configure an S3 bucket policy that requires requests to use the 'aws:SecureTransport' condition.

Answer

Enable default bucket encryption using SSE-S3.

Answer

Enable S3 server access logging and deliver logs to a separate bucket.