DEA-C01 Data Security and Governance Practice Test 16 — 15 Questions

Question 1

A data engineer is tasked with implementing data masking for a non-production environment. The source data contains credit card numbers stored in an Amazon RDS for PostgreSQL database. The engineer wants to automatically mask the credit card numbers when copying data to the non-production database. Which AWS service can be used to achieve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS Database Migration Service (DMS). AWS DMS can transform data during migration using transformation rules. It can mask data by replacing columns with predefined values. Glue is for ETL, but DMS is purpose-built for database migrations with transformations. Lake Formation is for data lake permissions. Athena is for querying S3 data.

Answer

AWS Glue

Answer

AWS Lake Formation

Answer

Amazon Athena

Question 2

A company is designing a data lake on Amazon S3. The security team requires granular access control based on data classifications. Which TWO AWS services can be used together to implement attribute-based access control (ABAC) for objects in S3?

Accepted Answer

Amazon S3 object tags. IAM policies support ABAC by using condition keys based on resource tags. S3 object tags allow you to attach metadata to objects, and these tags can be referenced in IAM policy conditions to control access. This combination enables granular, attribute-based access control for S3 objects. AWS Lake Formation also supports ABAC, but it is primarily used for managing permissions on a data lake catalog, not directly on S3 objects; the most direct and commonly used services for ABAC on S3 objects are IAM and S3 object tags. AWS Secrets Manager is for managing secrets, KMS is for encryption keys, and neither provides access control based on object attributes.

Answer

AWS Secrets Manager

Answer

AWS Lake Formation

Answer

AWS Key Management Service (KMS)

Question 3

A company needs to enforce encryption at rest for all data stored in Amazon S3. The security team wants to ensure that no objects can be uploaded without encryption. Which THREE steps should be taken to meet this requirement?

Accepted Answer

Use AWS Key Management Service (KMS) to manage encryption keys. A bucket policy denying s3:PutObject without the x-amz-server-side-encryption header enforces encryption. Using SSE-S3 or SSE-KMS ensures encryption at rest. SSE-C is not recommended for most cases. Requiring HTTPS ensures encryption in transit, not at rest. CloudTrail is for auditing.

Answer

Require all clients to use AWS CloudTrail for logging

Answer

Enable Amazon S3 Transfer Acceleration

Question 4

A data engineer is setting up an Amazon Redshift cluster. Which TWO measures can be taken to secure the data at rest?

Accepted Answer

Enable encryption on the Redshift cluster using AWS KMS. Redshift supports encryption at rest using KMS or HSM. Cluster encryption can be enabled at launch. Client-side encryption before loading protects data before it reaches Redshift, but not necessarily at rest. VPC security groups control network access. IAM roles control who can access the cluster.

Answer

Encrypt data on the client side before loading into Redshift

Answer

Enable AWS IAM database authentication

Answer

Use VPC security groups to restrict network access

Question 5

Refer to the exhibit. A data engineer applies this S3 bucket policy to the bucket 'example-bucket'. What is the effect of this policy?

Accepted Answer

PutObject requests are denied unless they include the x-amz-server-side-encryption header set to AES256. The policy denies s3:PutObject if the encryption header is not set to AES256 (SSE-S3). It does not enforce a specific KMS key. It allows uploads with SSE-S3. It denies uploads without encryption or with other encryption types.

Answer

All PutObject requests are denied regardless of encryption

Answer

All PutObject requests are allowed only if they use SSE-KMS

Answer

The policy has no effect because it does not allow any action

Question 6

Refer to the exhibit. A data engineer runs this AWS CLI command to execute an Athena query. What is the purpose of the EncryptionConfiguration parameter?

Accepted Answer

It encrypts the query results stored in Amazon S3 at rest. The EncryptionConfiguration parameter in Athena specifies how the query results stored in S3 are encrypted at rest. SSE_S3 means server-side encryption with S3-managed keys. It does not encrypt the query itself, data in transit, or the source data.

Answer

It encrypts the query string in transit

Answer

It encrypts the data in the source table

Answer

It enables client-side encryption for the query output

Question 7

Refer to the exhibit. A data engineer creates this KMS key policy. An IAM role in account 123456789012 is granted decrypt access to the key. However, when the DataAnalystRole tries to decrypt an S3 object encrypted with this key, the operation fails. What is the most likely reason?

Accepted Answer

The S3 bucket policy does not allow the role to call s3:GetObject. KMS key policies grant access to principals. However, if the S3 bucket policy does not allow the role to call kms:Decrypt, the combination of policies might still deny. But the key policy itself grants decrypt. A common issue is that the S3 bucket policy might not allow the s3:GetObject action, or the role might not have S3 permissions. Another possibility is that the KMS key is in a different region (us-east-1) but the S3 object is in another region, causing cross-region access which is not allowed by default. However, the most likely reason based on typical exam scenarios is that the S3 bucket policy does not grant the necessary S3 permissions.

Answer

The KMS key is in a different region than the S3 bucket

Answer

The role does not have permission to call kms:DescribeKey

Answer

The KMS key policy does not grant kms:Decrypt permission to the role

Question 8

A company uses AWS Glue to catalog data in Amazon S3. The data includes personally identifiable information (PII). The security team requires that PII be masked when queried by users who are not data owners. Which AWS service should be used to enforce this requirement?

Accepted Answer

Use AWS Lake Formation to define column-level security and data masking.. AWS Lake Formation provides fine-grained access control and column-level masking for data cataloged in the Glue Data Catalog, enabling PII masking at query time. Option A is wrong because Amazon Macie discovers and classifies PII but does not automatically redact data from S3 objects. Option B is wrong because IAM policies with condition keys can restrict access but cannot perform data masking. Option D is wrong because Amazon S3 Object Lambda can transform data at the object level but not at the query level for dynamic masking.

Answer

Use Amazon Macie to automatically redact PII from S3 objects.

Answer

Use IAM policies with condition keys to restrict access based on tags.

Answer

Use Amazon S3 Object Lambda to transform data on the fly.

Question 9

A data engineer needs to ensure that an Amazon Redshift cluster encrypts data at rest using a customer-managed AWS KMS key. Which configuration step is required?

Accepted Answer

Create a new cluster and specify a customer-managed KMS key for encryption.. To use a customer-managed KMS key for encryption at rest in Amazon Redshift, you must specify the key when creating a new cluster. Encryption cannot be enabled on an existing cluster (option D is incorrect). Option A is incorrect because the default AWS managed key is not customer-managed. Option C is incorrect because AWS CloudHSM is not used for Redshift encryption; Redshift integrates directly with AWS KMS for key management.

Answer

Create a new cluster and select the default AWS managed key for encryption.

Answer

Use AWS CloudHSM to generate a key and attach it to the cluster.

Answer

Enable encryption on the existing cluster by modifying the cluster configuration.

Question 10

A company runs an Amazon EMR cluster that processes sensitive data stored in Amazon S3. The security team requires that all data in transit between the EMR cluster and S3 be encrypted. Which configuration ensures this requirement is met?

Accepted Answer

Configure the S3 endpoint to use TLS and ensure the EMR cluster uses HTTPS for S3 access.. Configuring the S3 endpoint to use TLS and ensuring the EMR cluster uses HTTPS for S3 access enforces encryption in transit between the cluster and S3. Option A is incorrect because enabling in-transit encryption within the EMR cluster using EMRFS encrypts data within the cluster, not data between the cluster and S3. Option B is incorrect because SSE-S3 encrypts data at rest on S3, not data in transit. Option D is incorrect because an S3 access point with a bucket policy denying HTTP requests does not directly configure encryption in transit from the EMR cluster; it only denies non-HTTPS requests, but the cluster could still use HTTPS, and this is a bucket-level enforcement, not a direct configuration for the cluster.

Answer

Enable in-transit encryption within the EMR cluster using EMRFS.

Answer

Enable server-side encryption with S3 managed keys (SSE-S3) on the S3 bucket.

Answer

Use an S3 access point with a bucket policy that denies HTTP requests.

Question 11

A data engineer needs to audit all access to an Amazon S3 bucket containing sensitive data. The audit must capture who accessed the bucket, from which IP address, and what actions were performed. Which AWS service should be enabled?

Accepted Answer

Enable AWS CloudTrail with data events for the S3 bucket.. AWS CloudTrail logs all API calls to S3, including the caller identity, source IP, and actions. Option A is wrong because S3 server access logs provide similar info but are not as detailed or centralized. Option C is wrong because CloudWatch Logs can store logs but does not generate them. Option D is wrong because AWS Config tracks resource configuration changes, not API calls.

Answer

Enable S3 server access logging for the bucket.

Answer

Use AWS Config to record S3 bucket-level changes.

Answer

Configure Amazon CloudWatch Logs to monitor S3 access.

Question 12

A company uses AWS KMS to encrypt data in Amazon S3. The security team wants to ensure that the KMS key can only be used from within the company's VPC. Which policy element should be added to the KMS key policy?

Accepted Answer

Add a condition using aws:SourceVpc to allow only requests from the VPC.. Using a condition with aws:SourceVpc restricts key usage to requests originating from a specific VPC. Option A is wrong because the Principal element specifies who can use the key, not where. Option B is wrong because aws:SourceIp is for IP addresses, not VPC. Option D is wrong because kms:ViaService restricts usage to specific AWS services, not network location.

Answer

Set the Principal element to restrict access to the VPC.

Answer

Add a condition using aws:SourceIp to allow only IP addresses from the VPC.

Answer

Add a condition using kms:ViaService to allow only via VPC endpoints.

Question 13

A data engineer is designing a data lake on Amazon S3. The compliance team requires that objects be automatically deleted after 7 years. Additionally, objects must be transitioned to Amazon S3 Glacier Instant Retrieval after 30 days to reduce costs. Which S3 lifecycle policy configuration meets these requirements?

Accepted Answer

Transition to Glacier Instant Retrieval after 30 days, then expire after 2555 days.. It transitions objects to S3 Glacier Instant Retrieval after 30 days and then expires (permanently deletes) them after 2555 days, which is approximately 7 years (365 * 7 = 2555). This meets both the cost-saving and deletion requirements. Option A is incorrect because it expires after 90 days, not 7 years. Option C is incorrect because it uses Glacier Deep Archive instead of Glacier Instant Retrieval. Option D is incorrect because it uses S3 Standard-IA instead of Glacier Instant Retrieval.

Answer

Transition to Glacier Instant Retrieval after 30 days, then expire after 90 days.

Answer

Transition to Glacier Deep Archive after 30 days, then expire after 7 years.

Answer

Transition to S3 Standard-IA after 30 days, then expire after 7 years.

Question 14

A company uses AWS Glue DataBrew to clean and normalize data. The data contains sensitive columns that must be masked before being written to the output. Which DataBrew action should be applied?

Accepted Answer

Apply a Mask transform to the sensitive columns.. DataBrew provides a built-in 'Mask' transform that obfuscates sensitive data by applying masking patterns. Option A is incorrect because the Hash transform produces a hash value, which is not true masking as it can be reversed via brute force. Option B is incorrect because Encrypt is not a DataBrew transform; encryption is handled at the storage layer (e.g., S3 SSE). Option C is incorrect because Delete removes the column entirely, which may not be desired if the column is needed for analysis but just needs sensitive data hidden.

Answer

Apply a Hash transform to the sensitive columns.

Answer

Apply an Encrypt transform to the sensitive columns.

Answer

Apply a Delete transform to remove the sensitive columns.

Question 15

A data engineer receives an alert that an AWS KMS key has been scheduled for deletion by mistake. What is the immediate action to prevent the key from being deleted?

Accepted Answer

Cancel the key deletion from the KMS console or API.. When a KMS key is scheduled for deletion, the deletion can be canceled from the AWS KMS console or via the CancelKeyDeletion API during the pending deletion period. This immediate action restores the key to its previous state and prevents it from being deleted. Option B is incorrect because creating a new key does not cancel the deletion of the existing key. Option C is incorrect because deleted KMS keys cannot be restored; the default waiting period of 7–30 days exists specifically to allow cancellation. Option D is incorrect because disabling the key does not affect the deletion schedule.

Answer

Create a new KMS key and re-encrypt the data.

Answer

Wait for the key to be deleted and restore it from backup.

Answer

Disable the key immediately to stop usage.