DEA-C01 Data Security and Governance Practice Test 16 — 15 Questions

Question 1

A data engineer needs to audit data access events in Amazon S3. Which AWS service should be used to record and monitor API calls for S3 buckets?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records API activity across AWS services, including S3 data-plane and management-plane events, capturing who made each request, from where, and when. For auditing data access to S3 buckets, CloudTrail (with S3 data events enabled) is the authoritative service. It integrates with CloudWatch Logs and S3 for long-term retention and analysis.

Answer

AWS Config

Answer

Amazon Macie

Answer

Amazon GuardDuty

Question 2

A team is designing a data lake on S3 and needs to enforce encryption at rest. They want to use server-side encryption with a KMS key that they manage. Which encryption option should they configure on the S3 bucket?

Accepted Answer

SSE-KMS. SSE-KMS is the correct choice because it provides server-side encryption using a customer-managed KMS key. This allows the team to enforce encryption at rest with their own key, giving them control over key rotation, access policies, and audit trails via AWS CloudTrail, which aligns with the requirement to manage the encryption key themselves.

Answer

Client-side encryption

Answer

SSE-S3

Answer

SSE-C

Question 3

A company wants to grant cross-account access to an S3 bucket without using IAM roles. The data engineer needs to write a bucket policy that allows another AWS account to list objects. Which Principal should be specified in the bucket policy?

Accepted Answer

The AWS account ID of the other account. Specifying the AWS account ID of the other account as the Principal in the bucket policy grants cross-account access to all users and roles in that account, allowing them to list objects. Option A is incorrect because the owning account's ID would grant access to itself, not the other account. Option C is incorrect because specifying an IAM user ARN would restrict access to only that user, not the entire account. Option D is incorrect because the root user is a specific principal, not the account-wide access needed for cross-account delegation.

Answer

The AWS account ID that owns the bucket

Answer

The IAM user ARN in the other account

Answer

The root user of the other account

Question 4

A data engineer notices that an S3 bucket policy allows access to a user from another AWS account, but the access is being denied. What could be the reason?

Accepted Answer

The other account's IAM user does not have permissions to access the bucket. For cross-account S3 access to succeed, both the bucket policy (resource-based policy) and the IAM user policy (identity-based policy) in the other account must grant the necessary permissions. Option B is correct because even if the bucket policy allows access from the other account, the IAM user in that account must have an explicit IAM policy that permits the S3 action (e.g., s3:GetObject) on the bucket. Without this, the request is denied by the other account's own IAM evaluation.

Answer

The bucket policy does not include KMS permissions

Answer

S3 does not support cross-account access

Answer

The bucket is in a different region

Question 5

A company needs to encrypt data in transit between an EC2 instance and an S3 bucket. Which method should be used?

Accepted Answer

Use HTTPS endpoints. HTTPS endpoints encrypt data in transit between EC2 and S3 using TLS/SSL, ensuring confidentiality and integrity over the public internet. S3 supports HTTPS natively on its REST endpoints, and the AWS SDKs default to HTTPS, making this the simplest and most secure method for encrypting data in motion.

Answer

Use plain HTTP

Answer

Use an IPsec VPN

Answer

Server-side encryption (SSE)

Question 6

A company wants to implement least privilege access for its data lake on S3. Which THREE practices should be followed? (Choose THREE.)

Accepted Answer

Use S3 bucket policies for cross-account access. Option B is correct because S3 bucket policies are resource-based policies that explicitly define which principals (including cross-account identities) may perform which s3: actions on the bucket, allowing tightly scoped cross-account access instead of broad grants. Option C is correct because S3 access points provide dedicated endpoints with their own access point policies and can be restricted to a VPC via network origin controls, enforcing network-level least privilege for data lake access. Option E is correct because IAM policies attached to users and roles grant only the specific S3 actions and resources needed, which is the core mechanism for implementing least privilege. Option A is incorrect because granting s3:* violates least privilege by allowing all S3 operations. Option D is incorrect because disabling S3 Block Public Access increases exposure risk and does not support least privilege.

Answer

Grant s3:* to all users for simplicity

Answer

Disable S3 Block Public Access to allow flexibility

Question 7

A data engineer needs to audit data access in Amazon S3 for compliance. Which TWO services can be used to capture and analyze S3 access logs? (Choose TWO.)

Accepted Answer

AWS CloudTrail. AWS CloudTrail (B) is correct because it records S3 data events (object-level operations like GetObject and PutObject) and management events, delivering them to CloudTrail logs or CloudWatch Logs for auditing and analysis of who accessed what in S3. S3 server access logs (C) are correct because they provide detailed, best-effort records of every request made to a bucket, including requester, bucket, key, operation, and response codes, which can be stored and analyzed for compliance auditing. Amazon CloudWatch Logs (A) is not a log source for S3 access itself; it only stores and analyzes logs that are delivered to it by other services such as CloudTrail. Amazon Macie (D) is a data security service that discovers and classifies sensitive data in S3, not a service for capturing S3 access logs. AWS Config (E) tracks resource configuration changes and compliance against rules, not individual S3 data access events.

Answer

Amazon CloudWatch Logs

Answer

Amazon Macie

Answer

AWS Config

Question 8

A data engineer needs to ensure that all data in an S3 bucket is encrypted at rest. The bucket currently contains unencrypted objects from past uploads. Which action will encrypt these existing objects without re-uploading them?

Accepted Answer

Use S3 Batch Operations with an encryption job. S3 Batch Operations can run an encryption job across existing objects, applying SSE-S3, SSE-KMS, or SSE-C encryption without re-uploading the data. This is the only option that retroactively encrypts already-stored objects in place. Default encryption and bucket policies only affect new uploads, not existing objects.

Answer

Attach a bucket policy requiring SSE-S3

Answer

Enable default encryption on the bucket

Answer

Use the S3 console to select all objects and apply encryption

Question 9

A company wants to enforce that all data written to an S3 bucket is encrypted with a customer-managed AWS KMS key. The data engineer has created the KMS key and attached an S3 bucket policy. However, users are still able to upload objects without specifying the KMS key. What is the most likely cause?

Accepted Answer

The S3 bucket policy does not include a condition that denies s3:PutObject without the correct encryption. The most likely cause is that the S3 bucket policy does not include a condition that denies s3:PutObject requests unless the correct encryption (e.g., aws:kms with the specific key) is specified. Without an explicit deny condition, users can still upload objects using the default encryption or no encryption if their IAM permissions allow it. The bucket policy must enforce the encryption requirement by denying non-compliant uploads.

Answer

The S3 bucket has default encryption enabled with SSE-S3

Answer

The KMS key policy does not grant the users kms:Encrypt permission

Answer

The IAM role for the users does not have s3:PutObject permission

Question 10

A data engineer is troubleshooting an issue where an AWS Glue ETL job fails when trying to read data from an S3 bucket encrypted with SSE-KMS. The job has an IAM role that includes `kms:Decrypt` permission. What is the most likely reason for the failure?

Accepted Answer

The KMS key policy does not allow the Glue job to use the key. Even if the IAM role has `kms:Decrypt` permission, the KMS key policy must also allow the Glue job's role to use the key. KMS key policies are resource-based policies that control access to the key, and if they do not explicitly grant permission to the Glue job's role, the decrypt operation will fail. This is a common oversight when using SSE-KMS with services like AWS Glue.

Answer

The IAM role does not have s3:GetObject permission

Answer

The S3 bucket is in a different AWS region than the Glue job

Answer

The Glue job is not configured to use the KMS key for decryption

Question 11

A data engineer needs to grant an IAM user access to query a specific table in Amazon Athena, but the user should not be able to view other tables in the same database. Which method should the engineer use?

Accepted Answer

Use AWS Lake Formation to grant SELECT permission on the specific table to the user. AWS Lake Formation provides fine-grained access control at the table and column level, so granting SELECT permission on the specific table to the IAM user restricts them to that table while denying access to others in the same database. This is the intended service for table-level Athena permissions. It integrates with the Glue Data Catalog to enforce permissions at query time.

Answer

Attach an IAM policy that allows athena:StartQueryExecution and restrict the query by table name

Answer

Apply an S3 bucket policy that restricts access to the table's underlying data

Answer

Create a separate Athena workgroup with a query limit that only allows queries on that table

Question 12

A data engineer needs to encrypt data in transit between an Amazon RDS for MySQL instance and an application. Which solution should be used?

Accepted Answer

Use SSL/TLS to connect to the RDS instance. Encryption in transit for an RDS for MySQL instance is achieved by connecting with SSL/TLS, which encrypts the wire protocol between the application and the database. RDS MySQL supports TLS and provides an rds-ca certificate that the client uses to verify the server. Enabling SSL/TLS on the connection is the direct, correct answer for data in transit.

Answer

Enable encryption at rest using AWS KMS

Answer

Store the data in Amazon S3 with server-side encryption

Answer

Use AWS CloudHSM to generate and store encryption keys

Question 13

A data engineer is designing a data pipeline that ingests data from an on-premises system into Amazon S3 using AWS Transfer Family. The data must be encrypted at rest using a customer-managed key in AWS KMS. The S3 bucket policy must allow only encrypted connections. Which policy condition should be used?

Accepted Answer

aws:SecureTransport. The correct condition is 'aws:SecureTransport' because it ensures that requests to the S3 bucket are made over HTTPS (TLS), thereby enforcing encrypted connections. This condition key is a boolean that indicates whether the request used SSL/TLS. Setting it to 'true' in a bucket policy denies any non-encrypted (HTTP) requests.

Answer

kms:EncryptionContext

Answer

s3:x-amz-server-side-encryption-aws-kms-key-id

Answer

s3:x-amz-server-side-encryption

Question 14

A data engineer needs to share a dataset stored in Amazon S3 with another AWS account. The bucket policy currently grants access only to the owning account. What is the simplest way to grant cross-account access?

Accepted Answer

Add a bucket policy that grants access to the other account's IAM role. A bucket policy is the simplest and most direct way to grant cross-account access because it is a resource-based policy attached to the S3 bucket that can explicitly name the other account's IAM role or account ID as a principal. This avoids the need to create roles or modify ACLs, and it works even when ACLs are disabled (the default for new buckets).

Answer

Set the object ACL to public-read

Answer

Use an S3 access control list (ACL) to grant access to the other account

Answer

Create an IAM role in the other account and attach a policy to it

Question 15

An organization is using AWS Glue to process sensitive data. The data is stored in S3 with server-side encryption using AWS KMS (SSE-KMS). The Glue job fails with an error indicating that it cannot read the data. The IAM role used by Glue has the following policy. What is missing?

Accepted Answer

The kms:Decrypt permission on the KMS key. The Glue job fails because the IAM role lacks the kms:Decrypt permission on the KMS key used for SSE-KMS encryption. When S3 objects are encrypted with SSE-KMS, any principal reading the object must have both s3:GetObject on the object and kms:Decrypt on the KMS key. Without kms:Decrypt, S3 returns an AccessDenied error even though the s3:GetObject permission is present.

Answer

The s3:GetObject permission on the bucket

Answer

The kms:GenerateDataKey permission on the KMS key

Answer

The kms:ReEncrypt permission on the KMS key