DEA-C01 Data Security and Governance Practice Test 15 — 15 Questions

Question 1

A data engineer is configuring an AWS Glue ETL job that reads a large CSV dataset from Amazon S3 and writes Parquet output to a second S3 bucket. The security team requires that data be encrypted in transit between Glue and S3, and that encryption keys be managed and rotated by AWS without the company managing key material. Which configuration meets these requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Set the Glue connection to use an S3 VPC endpoint and rely on default HTTPS, and store output with SSE-S3 (AES-256).. AWS Glue always communicates with Amazon S3 over HTTPS, so transit encryption is satisfied by default. For at-rest encryption with keys fully managed and rotated by AWS, SSE-S3 (AES-256) is the correct choice because it requires no customer key material or key policy management. Combining default HTTPS with SSE-S3 satisfies both stated requirements.

Answer

Enable SSE-KMS with a customer managed key on both buckets, and set the Glue job to use TLS 1.3 exclusively.

Answer

Configure the Glue job to write with client-side encryption using a KMS key, and enable SSL on the S3 bucket policy.

Answer

Use SSE-C with a key stored in AWS Secrets Manager, and require HTTPS on the Glue connection.

Question 2

A data engineer needs to ensure that data stored in Amazon S3 is protected against accidental deletion and that all access is logged for compliance. The company uses AWS CloudTrail for API logging and wants to detect any unauthorized attempts to delete objects. The engineer must implement a solution that provides object-level logging and prevents deletion of critical objects. Which TWO actions should the engineer take? (Choose two.)

Accepted Answer

Enable S3 Object Lock in compliance mode with a retention period.. To meet the requirements, the engineer should enable CloudTrail data events for object-level logging and configure S3 Object Lock in compliance mode to prevent deletion. CloudTrail data events capture all object-level API calls, including deletion attempts, which satisfies the logging requirement. S3 Object Lock in compliance mode ensures that objects cannot be deleted or overwritten during the retention period, even by privileged users, providing strong protection. Together, they provide both detection and prevention.

Answer

Configure S3 Object Lock in governance mode with a retention period.

Answer

Enable S3 server access logging on the bucket.

Answer

Configure an S3 bucket policy that denies s3:DeleteObject for all principals.

Question 3

A retail company uses Amazon Redshift to store sales data. Auditors require that the data be encrypted at rest with keys the company controls, that key usage be logged, and that the cluster remain available if a single key is accidentally disabled. Which combination should the data engineer implement?

Accepted Answer

Enable Redshift encryption with a customer managed key in AWS KMS and enable CloudTrail logging of KMS API calls.. Redshift supports cluster encryption with a customer managed key in AWS KMS, which puts key policy and rotation under company control. Enabling CloudTrail to log KMS API calls produces the audit trail of key usage. Together these satisfy the control and logging requirements for the auditors.

Answer

Enable Redshift encryption with a customer managed key and configure automatic key rotation every 90 days.

Answer

Enable Redshift encryption with an AWS owned key and rely on AWS CloudTrail for key usage records.

Answer

Enable Redshift encryption with SSE-S3 keys and export KMS audit logs to Amazon S3 for the auditors.

Question 4

A data engineer is configuring an AWS Glue ETL job that reads a large CSV dataset from Amazon S3 and writes Parquet output to a second S3 bucket. The security team requires that data be encrypted in transit between Glue and S3, and that encryption keys be managed and rotated by AWS without the company managing key material. Which configuration meets these requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Attach a bucket policy to the S3 bucket that denies requests not using HTTPS.. The most effective way to ensure that data in transit to Amazon S3 is encrypted is to attach a bucket policy that denies requests not using HTTPS. This policy checks the `aws:SecureTransport` condition key and denies any request where it is false. AWS Glue uses HTTPS by default when accessing S3, so the job will continue to work. The other options either do not exist, address encryption at rest, or do not enforce TLS.

Answer

Configure the Glue job to use the `--use-https` parameter.

Answer

Configure the Glue job to use a VPC endpoint for Amazon S3.

Answer

Enable default encryption on the S3 bucket with SSE-S3.

Question 5

A company uses AWS Glue to process sensitive data stored in Amazon S3. The security team requires that all data in transit between AWS Glue and S3 be encrypted. Which configuration should be used to meet this requirement?

Accepted Answer

Use an S3 bucket policy that denies requests not using HTTPS.. Requiring HTTPS for all requests to the S3 bucket ensures that data in transit between AWS Glue and S3 is encrypted using TLS. By using an S3 bucket policy with a condition that denies requests where `aws:SecureTransport` is false, the company enforces encryption for all connections, including those from AWS Glue. This meets the security requirement without needing to modify Glue or S3 configurations beyond the bucket policy.

Answer

Use an AWS KMS key to encrypt the data before uploading to S3.

Answer

Configure AWS Glue to use SSL by setting the 'ssl' parameter to 'true'.

Answer

Enable default encryption on the S3 bucket using SSE-S3.

Question 6

A company uses Amazon Redshift to store customer data. The security team requires that all queries are logged for auditing purposes. Which step should be taken to meet this requirement? (Select ONE.)

Accepted Answer

Enable Amazon Redshift audit logging to an S3 bucket.. The requirement is to log all queries for auditing. Amazon Redshift's native audit logging captures connection logs, user activity logs, and query logs, and can be exported to an S3 bucket. This is the only step that directly logs SQL queries. AWS CloudTrail does not log SQL queries; it logs management API calls (e.g., CreateCluster, ModifyCluster). Therefore, only Option E meets the requirement.

Answer

Enable AWS CloudTrail database audit logging.

Answer

Use AWS CloudTrail to log Redshift API calls.

Answer

Enable logging on the Redshift security group.

Answer

Enable VPC Flow Logs for the Redshift cluster.

Question 7

A company is using Amazon EMR to process data stored in Amazon S3. The S3 bucket is configured with a bucket policy that denies access unless the request includes a specific tag. The EMR cluster's IAM role has s3:GetObject permission. However, the EMR job fails to read data from S3. What is the most likely cause?

Accepted Answer

The IAM role does not have a condition that matches the required tag.. The bucket policy denies access unless the request includes a specific tag. Even though the EMR cluster's IAM role has s3:GetObject permission, the IAM role does not have a condition key (e.g., aws:RequestTag) that matches the required tag. Therefore, the request is denied by the bucket policy, causing the EMR job to fail.

Answer

The bucket policy is not attached to the EMR role.

Answer

The EMR cluster is not in the same account as the S3 bucket.

Answer

The EMR role does not have s3:GetObject permission.

Question 8

A company uses AWS Lake Formation to manage data lake permissions. The data lake contains sensitive customer data in the 'customer' database. The security team wants to ensure that only users with a specific tag 'access_level=analyst' can query the 'customer' table. Which combination of steps should the data engineer take to enforce this?

Accepted Answer

In Lake Formation, create an LF-tag 'access_level' with values 'analyst' and 'admin'. Grant 'SELECT' permission on the 'customer' table to the tag value 'analyst'. Associate the LF-tag with the 'customer' table.. Lake Formation LF-tags allow you to define metadata tags (key-value pairs) and grant permissions to those tags. By creating an LF-tag 'access_level' with values 'analyst' and 'admin', granting SELECT on the 'customer' table to the tag value 'analyst', and associating that LF-tag with the table, only principals who have the tag 'access_level=analyst' (or are granted via the tag) can query the table. This enforces tag-based access control at the Lake Formation permission layer, which is the intended mechanism for fine-grained, attribute-based access control in Lake Formation.

Answer

Create an IAM policy that conditionally allows 'glue:GetTable' based on the tag 'access_level=analyst'.

Answer

Apply a bucket policy on the S3 location of the 'customer' table that allows access only if the request carries the tag 'access_level=analyst'.

Answer

Use Lake Formation column-level filters to restrict access to columns based on the tag 'access_level=analyst'.

Question 9

A data engineer is configuring AWS Glue jobs to access data stored in Amazon S3. The data is encrypted using server-side encryption with AWS KMS (SSE-KMS). The Glue job needs to read and write data to the S3 bucket. Which IAM policy statement should be added to the Glue job's IAM role to allow it to use the KMS key?

Accepted Answer

{"Effect":"Allow","Action":["kms:Decrypt","kms:GenerateDataKey"],"Resource":"*"}. To read and write data encrypted with SSE-KMS, AWS Glue needs both `kms:Decrypt` (to read existing encrypted data) and `kms:GenerateDataKey` (to create a new data key for writing encrypted data). `kms:GenerateDataKey` is required because S3 uses a data key to encrypt objects, and the caller must generate that key via KMS. Option B correctly includes both actions, allowing the Glue job to perform read and write operations on the SSE-KMS encrypted bucket.

Answer

{"Effect":"Allow","Action":["kms:Decrypt"],"Resource":"*"}

Answer

{"Effect":"Allow","Action":["kms:Decrypt","kms:ReEncrypt"],"Resource":"*"}

Answer

{"Effect":"Allow","Action":["kms:Decrypt","kms:Encrypt"],"Resource":"*"}

Question 10

A company is building a data pipeline that ingests sensitive customer data from an on-premises database into Amazon S3 using AWS DMS. The data must be encrypted at rest in S3 and in transit. The security team requires that the encryption keys be managed by the company (not AWS). Which TWO actions should the data engineer take to meet these requirements? (Choose TWO.)

Accepted Answer

Configure the S3 bucket to use server-side encryption with AWS KMS (SSE-KMS) using a customer managed key.. Option B is correct because SSE-KMS with a customer managed key lets the company own and control the KMS key that protects the data at rest in Amazon S3, satisfying the requirement that keys be managed by the company rather than AWS. Option D is correct because enabling SSL/TLS on the DMS source and target endpoints encrypts data in transit between the on-premises database and Amazon S3, which is the required in-transit protection. Option A is incorrect because the default DMS encryption settings do not provide company-managed keys for S3 data at rest. Option C is incorrect because SSE-S3 uses S3-managed keys, which AWS controls, not the company. Option E is incorrect because KMS keys are used for encryption at rest, not for encrypting DMS data in transit; in-transit encryption is handled by SSL/TLS on the endpoints.

Answer

Enable encryption at rest using the default DMS encryption settings.

Answer

Configure the S3 bucket to use server-side encryption with S3 managed keys (SSE-S3).

Answer

Create an AWS KMS key and use it in the DMS endpoint to encrypt data in transit.

Question 11

A data engineer is configuring a data lake on Amazon S3 that contains sensitive customer information. The company requires that all access to this data be logged and monitored, and that any data shared with external partners must be anonymized before leaving the S3 bucket. Which combination of AWS services should the engineer use to meet these requirements? (Choose THREE.)

Accepted Answer

AWS Lake Formation. AWS Lake Formation (B) is correct because it provides fine-grained access control and data anonymization capabilities for data lakes on Amazon S3. It allows you to define column-level and row-level security policies, and can automatically anonymize sensitive data (e.g., via masking or tokenization) before it is shared with external partners, ensuring compliance with data governance requirements.

Answer

AWS WAF

Answer

AWS Direct Connect

Question 12

Order the steps to migrate an on-premises database to Amazon RDS using AWS DMS.

Accepted Answer

Step 1: Create a replication instance. Step 2: Configure source and target endpoints. Step 3: Create a migration task. Step 4: Start the migration task. Step 5: Validate the migrated data.. First, create the replication instance. Then configure endpoints, create the migration task, start it, and finally validate the migrated data.

Answer

Step 1: Configure source and target endpoints. Step 2: Create a replication instance. Step 3: Create a migration task. Step 4: Start the migration task. Step 5: Validate the migrated data.

Answer

Step 1: Create a replication instance. Step 2: Create a migration task. Step 3: Configure source and target endpoints. Step 4: Start the migration task. Step 5: Validate the migrated data.

Answer

Step 1: Create a replication instance. Step 2: Configure source and target endpoints. Step 3: Start the migration task. Step 4: Create a migration task. Step 5: Validate the migrated data.

Question 13

Arrange the steps to implement data encryption at rest for an Amazon Redshift cluster using AWS KMS.

Accepted Answer

Step 1: Create a KMS key. Step 2: Launch a new Amazon Redshift cluster. Step 3: Enable encryption and specify the KMS key during launch. Step 4: Verify that the cluster is encrypted at rest.. First, create the KMS key. Then launch a new encrypted cluster, specify the key, configure, and verify encryption.

Answer

Step 1: Launch a new Amazon Redshift cluster. Step 2: Create a KMS key. Step 3: Enable encryption and specify the KMS key. Step 4: Verify encryption.

Answer

Step 1: Create a KMS key. Step 2: Verify encryption. Step 3: Launch a new Amazon Redshift cluster. Step 4: Enable encryption and specify the KMS key.

Answer

Step 1: Specify the KMS key. Step 2: Create a KMS key. Step 3: Launch a new Amazon Redshift cluster. Step 4: Verify encryption.

Question 14

Match each AWS storage class to its description.

Accepted Answer

S3 Standard: Designed for frequently accessed data with low latency and high throughput.. Correct matches: S3 Standard for frequently accessed data, S3 Intelligent-Tiering for automatic cost optimization, and S3 Glacier for archival. Common confusions involve mixing up Standard-IA and Glacier Deep Archive definitions.

Answer

S3 Standard-IA: Lowest-cost storage class for long-term retention with retrieval times of 12 hours.

Answer

S3 Glacier Deep Archive: For data accessed less frequently but requires rapid access when needed.

Question 15

A company uses AWS KMS to encrypt sensitive data stored in S3. To meet compliance requirements, they need to ensure that the encryption keys are automatically rotated every year. Which type of KMS key should they use?

Accepted Answer

Customer managed key with automatic rotation enabled. Customer managed keys with automatic rotation enabled support automatic annual rotation, meeting the compliance requirement. AWS managed keys rotate automatically every year, but they cannot be controlled or customized by the customer, so they are not the best choice when the customer needs to manage the key policy or rotation schedule. Custom key stores (CloudHSM) do not support automatic rotation. Option A (customer managed key with manual rotation) requires manual intervention to rotate, not automatic. Therefore, D is the correct answer.

Answer

Customer managed key with manual rotation

Answer

AWS managed key

Answer

Custom key store (CloudHSM) key