DEA-C01 Data Security and Governance Practice Test 15 — 15 Questions

Question 1

A company uses Amazon Kinesis Data Streams to ingest real-time data. The compliance team requires that all data in the stream be encrypted at rest. Which configuration should be enabled?

Accepted Answer

Enable server-side encryption using an AWS KMS key. Server-side encryption (SSE) for Amazon Kinesis Data Streams uses an AWS KMS key to automatically encrypt data at rest as it is written to the stream and decrypt it when read. This meets the compliance requirement for encryption at rest without requiring any changes to the producer or consumer applications.

Answer

Enable TLS encryption on the Kinesis stream

Answer

Use client-side encryption in the producer application

Answer

Store the data in Amazon CloudWatch Logs instead

Question 2

A company has a multi-account strategy using AWS Organizations. The data engineering team needs to share a central S3 bucket across multiple accounts while maintaining fine-grained access control. Which solution should be used?

Accepted Answer

Use S3 access points with a policy per account. S3 access points allow you to create separate access points for each account with their own policies, enabling fine-grained access control while sharing the same bucket. This integrates with AWS Organizations to simplify policy management. Option A is incorrect because cross-account IAM roles grant full access to the role's permissions and lack object-level granularity. Option B is incorrect because CloudFront is a content delivery network, not an access control mechanism. Option D is incorrect because a bucket policy with principal ARNs for each account becomes difficult to manage as accounts scale, and it doesn't provide per-account fine-grained control like access points do.

Answer

Use IAM roles in each account with cross-account access

Answer

Use Amazon CloudFront to serve the data

Answer

Create a bucket policy with principal ARNs for each account

Question 3

A company needs to automate the detection of sensitive data in Amazon S3 and generate reports. Which AWS service should be used?

Accepted Answer

Amazon Macie. Amazon Macie is the correct service for automating detection of sensitive data in S3 and generating reports. It uses machine learning to discover and classify sensitive data. Amazon Inspector is for vulnerability management, not sensitive data detection. Amazon GuardDuty is for threat detection. AWS Config is for resource compliance and configuration auditing.

Answer

Amazon Inspector

Answer

Amazon GuardDuty

Answer

AWS Config

Question 4

A data engineer needs to ensure that an Amazon Redshift cluster only accepts encrypted connections. Which parameter should be modified?

Accepted Answer

require_SSL. Setting the `require_SSL` parameter to `true` forces all connections to the Amazon Redshift cluster to use SSL/TLS encryption, ensuring that data in transit is encrypted. This parameter is modified in the cluster's parameter group and applies to both JDBC and ODBC connections, as well as the Redshift Query Editor.

Answer

enable_user_activity_logging

Answer

max_concurrency_scaling_clusters

Answer

wlm_json_configuration

Question 5

A company uses Amazon EMR to process data stored in S3 with server-side encryption using AWS KMS. The EMR cluster fails with a "403 Access Denied" error when reading data from S3. The IAM role for the EMR cluster has s3:GetObject and kms:Decrypt permissions. What is the most likely issue?

Accepted Answer

The EC2 instance profile does not have kms:Decrypt permission. Although the IAM role assigned to the EMR cluster has s3:GetObject and kms:Decrypt permissions, the EC2 instances themselves run under an instance profile (an IAM role for EC2). For S3 objects encrypted with SSE-KMS, the EC2 instance performing the read must have kms:Decrypt permission. If the instance profile lacks this permission, the request is denied with a 403 error. Option B is less likely because a bucket policy denying access would be explicit and typically not the first thing to check. Option C (EMRFS consistent view) does not affect S3 access permissions. Option D (incorrect KMS key ID) would cause a different error (e.g., 400 Bad Request or access denied for specific keys), but the primary cause is the missing kms:Decrypt on the instance profile.

Answer

The S3 bucket policy denies access to the EMR cluster's IAM role

Answer

The EMRFS consistent view is not enabled

Answer

The EMR cluster is using an incorrect KMS key ID

Question 6

A company needs to tag all resources created in a specific AWS account to enforce data governance policies. Which AWS service can automatically enforce tagging rules?

Accepted Answer

AWS Organizations SCPs. (AWS Organizations SCPs) is correct. Service Control Policies (SCPs) can be used to enforce tagging rules across all accounts in an organization by denying actions that don't meet tagging requirements. Option B (AWS Service Catalog) is used for creating and managing approved IT services, not for enforcing tagging rules. Option C (AWS Resource Access Manager) is for sharing resources across accounts, not for enforcement. Option D (AWS Systems Manager) is for operational management, not for governance policies.

Answer

AWS Service Catalog

Answer

AWS Resource Access Manager

Answer

AWS Systems Manager

Question 7

A data engineer needs to store encryption keys used for protecting data in Amazon S3 and automatically rotate them every year. Which service should be used?

Accepted Answer

AWS KMS. AWS KMS supports automatic key rotation for customer managed keys. Option B is wrong because CloudHSM does not provide automatic rotation. Option C is wrong because Secrets Manager is for secrets. Option D is wrong because ACM is for certificates.

Answer

AWS CloudHSM

Answer

AWS Certificate Manager

Answer

AWS Secrets Manager

Question 8

A data engineer needs to ensure that an Amazon S3 bucket containing sensitive customer data is encrypted at rest. Which AWS service can be used to manage the encryption keys?

Accepted Answer

AWS Key Management Service (KMS). AWS KMS is the service for managing encryption keys. S3 SSE-S3 uses S3-managed keys, while SSE-C uses customer-provided keys. CloudHSM is a hardware security module but not directly used for S3 encryption key management.

Answer

AWS Certificate Manager

Answer

AWS Secrets Manager

Answer

AWS CloudHSM

Question 9

A company stores sensitive data in an Amazon S3 bucket. To comply with regulations, all data must be encrypted at rest using server-side encryption. The security team wants to ensure that any attempt to upload an unencrypted object is automatically denied. Which S3 bucket policy condition should be used?

Accepted Answer

s3:x-amz-server-side-encryption. The s3:x-amz-server-side-encryption condition key enforces that objects must be encrypted with AES-256 (SSE-S3). s3:x-amz-server-side-encryption-aws-kms-key-id is for KMS key enforcement. s3:x-amz-acl controls access control lists, not encryption.

Answer

s3:x-amz-server-side-encryption-aws-kms-key-id

Answer

s3:x-amz-acl

Answer

s3:x-amz-storage-class

Question 10

A company uses AWS Glue to process data from Amazon S3. The data contains personally identifiable information (PII). The data engineer needs to automatically detect and mask PII fields before the data is loaded into Amazon Redshift. Which combination of AWS services should be used?

Accepted Answer

Amazon Macie and AWS Glue. Amazon Macie discovers sensitive data, and then AWS Glue can apply transformations to mask the PII before loading into Redshift. CloudWatch Logs is for monitoring, not detection. IAM Access Analyzer is for analyzing resource policies. S3 Object Lambda can redact data during retrieval but not during Glue ETL.

Answer

Amazon CloudWatch Logs and AWS Lambda

Answer

Amazon S3 Object Lambda and AWS Glue

Answer

AWS IAM Access Analyzer and AWS Glue

Question 11

A data engineer is setting up an Amazon RDS for MySQL database. The compliance team requires that all data at rest be encrypted. What must the engineer do to enable encryption for this database?

Accepted Answer

Specify an AWS KMS key when launching the DB instance. Encryption at rest for Amazon RDS can only be enabled at launch time. After creation, you cannot enable encryption; you must create a new encrypted instance and migrate data.

Answer

Enable encryption after the DB instance is created by modifying the DB instance

Answer

Use AWS Secrets Manager to store the encryption key and attach it to the DB instance

Answer

Encrypt the underlying EBS volumes after the instance is created

Question 12

A company uses Amazon S3 to store log files. The security team notices that some objects are being accessed from an unexpected AWS account. The data engineer needs to identify which specific IAM user or role is accessing the objects. Which AWS service should be used to get this information?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records API calls including S3 object-level operations. It logs who made the call, from which account, and other details. S3 server access logs provide similar info but are log files themselves, not a queryable service. Config is for resource configuration tracking. Trusted Advisor gives best practice checks.

Answer

AWS Trusted Advisor

Answer

Amazon S3 server access logs

Answer

AWS Config

Question 13

A data engineer needs to share a dataset stored in an Amazon S3 bucket with another AWS account. The dataset must remain encrypted at rest using AWS KMS. The data engineer creates a bucket policy that grants the other account access to the bucket. However, the other account reports that objects appear encrypted and they cannot decrypt them. What is the most likely cause?

Accepted Answer

The KMS key policy does not grant the other account the kms:Decrypt permission. When using SSE-KMS, the bucket policy alone is not enough; the KMS key policy must also grant the consuming account permission to use the key (kms:Decrypt). The bucket policy controls access to the S3 objects, but KMS key policy controls who can decrypt. Therefore, option A is correct.

Answer

The bucket policy does not grant the s3:GetObject permission

Answer

The other account must use the same KMS key to upload objects

Answer

The objects are encrypted with SSE-S3, which is not supported for cross-account access

Question 14

A company wants to audit all changes to IAM policies in their AWS account. Which AWS service should be used to record these changes?

Accepted Answer

AWS Config. AWS Config records configuration changes to AWS resources, including IAM policies. CloudTrail records API calls, not configuration snapshots. GuardDuty is for threat detection. Inspector is for vulnerability assessment.

Answer

AWS CloudTrail

Answer

Amazon GuardDuty

Answer

Amazon Inspector

Question 15

A company uses Amazon Redshift for data warehousing. The security team requires that all data loading into Redshift be encrypted in transit. Which configuration ensures this requirement is met?

Accepted Answer

Configure the Redshift cluster to require SSL connections. Encryption in transit for Redshift is achieved by using SSL connections. Client-side encryption before loading does not encrypt the transmission. Server-side encryption is for at-rest. VPC security groups control network access, not encryption.

Answer

Use a VPC security group to restrict access

Answer

Use client-side encryption before loading data

Answer

Enable server-side encryption on the Redshift cluster