DEA-C01 Data Security and Governance Practice Test 17 — 15 Questions

Question 1

A data engineer needs to audit all changes to IAM policies in an AWS account. Which AWS service should be used?

Accepted Answer

AWS CloudTrail. WS CloudTrail because it records API calls made in the account, including changes to IAM policies. AWS Config tracks resource configuration changes, not API calls. AWS Organizations is for multi-account management. Amazon CloudWatch Logs is for log storage and monitoring, not auditing API calls.

Answer

AWS Config

Answer

AWS Organizations

Answer

Amazon CloudWatch Logs

Question 2

A data engineer needs to enforce that all data in an Amazon S3 bucket is encrypted at rest. Which of the following can be used to achieve this? (Choose TWO.)

Accepted Answer

Configure a bucket policy to deny PutObject if encryption headers are missing. Option C is correct because an S3 bucket policy can include a Deny statement on s3:PutObject that uses a condition such as StringNotEquals on s3:x-amz-server-side-encryption (or its aws:kms variant), which blocks any upload request that does not carry the required encryption header, thereby enforcing encryption at rest for newly written objects. Option D is correct because enabling default bucket encryption with SSE-S3 (AES-256) causes Amazon S3 to automatically encrypt every object at rest on write, even when the request specifies no encryption headers, satisfying the requirement without relying on the client. Option A is not correct because AWS CloudTrail only records and logs API activity for auditing; it cannot prevent or enforce encryption of objects. Option B is not correct because VPC endpoints only control network access paths to S3 and have no bearing on whether objects are encrypted at rest. Option E is not correct because AWS KMS generates and manages keys, but merely having KMS keys available does not by itself enforce encryption on the bucket; enforcement requires default encryption or a bucket policy condition.

Answer

Use AWS CloudTrail to monitor for unencrypted objects

Answer

Use VPC endpoints to restrict access

Answer

Use AWS KMS to generate encryption keys for the bucket

Question 3

A company is using AWS Lake Formation to manage permissions on a data lake. Which of the following are valid ways to grant access to a user or role? (Choose THREE.)

Accepted Answer

Grant permissions to a SAML or SCIM group. Lake Formation supports granting permissions directly to IAM users and roles (option C), which is the fundamental way principals are identified in AWS. It also supports granting permissions to SAML or SCIM groups (option A), allowing federated identities to inherit Lake Formation permissions through their group membership. Additionally, Lake Formation supports tag-based access control using LF-Tags (option B), where permissions are granted on tags and then associated with resources and principals. Option D is incorrect because Lake Formation does not grant permissions to AWS Organizations units; it works with IAM principals and federated groups, not OUs directly. Option E is incorrect because S3 bucket policies are an S3-level access mechanism and do not grant Lake Formation permissions, which are managed within Lake Formation's own permission model.

Answer

Grant permissions to an AWS Organizations unit

Answer

Grant permissions via an S3 bucket policy

Question 4

A data engineer needs to audit all AWS KMS key usage in the account. Which AWS service should be used to record KMS API calls?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records API calls for KMS. Option B (AWS Config) is wrong because it records resource changes, not API calls. Option C (Amazon CloudWatch Logs) is wrong because it stores logs but does not record API calls. Option D (Amazon GuardDuty) is wrong because it is for threat detection.

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Answer

Amazon GuardDuty

Question 5

A company wants to enable automatic encryption for all new objects written to an S3 bucket. The bucket has existing objects that are unencrypted. Which solution meets these requirements with the least operational overhead?

Accepted Answer

Enable default encryption on the bucket using SSE-S3. Enabling default encryption on the bucket with SSE-S3 causes all new objects written to the bucket to be encrypted automatically without any client-side changes or bucket policy enforcement. It is a single bucket-level setting, so it has the least operational overhead. Existing unencrypted objects remain unencrypted until rewritten, but the requirement only specifies automatic encryption for new objects.

Answer

Configure a lifecycle policy to transition objects to a new bucket with encryption

Answer

Use S3 server-side encryption with S3 managed keys (SSE-S3) and apply a bucket policy that denies writes without encryption

Answer

Use S3 Batch Operations to copy existing objects with SSE-S3

Question 6

A data engineer is troubleshooting an Amazon Redshift cluster that is not responding to queries. The engineer suspects that the cluster may have been accidentally deleted. Which AWS service should be used to investigate the deletion?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records API activity in an AWS account, including the DeleteCluster API call that would be logged when a Redshift cluster is deleted. By querying CloudTrail event history or a trail's logs, the engineer can identify who deleted the cluster, when, and from which source IP. This makes CloudTrail the correct service for investigating the deletion event itself.

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Answer

AWS Trusted Advisor

Question 7

A company needs to share a dataset stored in an S3 bucket with a partner account. The dataset contains sensitive information, so the company wants to ensure that the partner account can only access the data using a specific VPC endpoint in the partner's account. Which S3 bucket policy condition key should be used?

Accepted Answer

aws:SourceVpce. The aws:SourceVpce condition key restricts access to a specific VPC endpoint, ensuring the partner can only access the data through that endpoint. Option A is wrong because aws:SourceVpc restricts to a VPC, not a VPC endpoint. Option B is wrong because aws:SourceArn restricts to a resource ARN, not a network endpoint. Option C is wrong because aws:SourceIp restricts to an IP address, which does not meet the requirement.

Answer

aws:SourceVpc

Answer

aws:SourceArn

Answer

aws:SourceIp

Question 8

A data engineer needs to grant an IAM user the ability to view Amazon CloudWatch Logs log groups and stream log events from a specific log group. Which IAM policy action should be used?

Accepted Answer

logs:DescribeLogGroups and logs:GetLogEvents. Viewing log groups requires logs:DescribeLogGroups, and reading/streaming log events from a specific group requires logs:GetLogEvents (or logs:FilterLogEvents for filtered reads). Together these two actions satisfy the read-only requirement. They map directly to the CloudWatch Logs API calls DescribeLogGroups and GetLogEvents.

Answer

logs:PutLogEvents

Answer

logs:CreateLogGroup

Answer

logs:DeleteLogGroup

Question 9

A company uses S3 to store sensitive data. Which TWO S3 features can be used to protect data at rest?

Accepted Answer

Server-Side Encryption with S3 Managed Keys (SSE-S3). SSE-S3 (option B) is correct because it encrypts objects at rest using AES-256 with keys fully managed by Amazon S3, directly protecting stored data without any customer key management. SSE-KMS (option C) is also correct because it encrypts objects at rest using AWS KMS customer master keys, adding key control, audit trails via CloudTrail, and separation of duties. S3 Versioning (A) only keeps multiple variants of an object to aid recovery; it does not encrypt data. S3 Transfer Acceleration (D) speeds up uploads/downloads over AWS edge locations and is a transfer optimization, not encryption at rest. S3 Object Lock (E) enforces WORM retention to prevent deletion or modification, which is immutability, not encryption.

Answer

S3 Versioning

Answer

S3 Transfer Acceleration

Answer

S3 Object Lock

Question 10

Refer to the exhibit. The S3 bucket policy above is applied to the bucket "example-bucket". An IAM user attempts to upload an object to the bucket without specifying any encryption header. What is the outcome?

Accepted Answer

The upload fails with an Access Denied error. The bucket policy shown requires that any PutObject request include server-side encryption headers (e.g., x-amz-server-side-encryption). Since the IAM user uploads without specifying an encryption header, the condition in the policy is not met, and the request is denied with an Access Denied error. This is the standard behavior of a deny-by-default encryption-enforcement policy.

Answer

The upload succeeds but the object is not encrypted

Answer

The upload fails because GetObject requires encryption

Answer

The object is uploaded successfully with SSE-S3 encryption by default

Question 11

Refer to the exhibit. An IAM policy includes the above statement to allow decryption of a KMS key under specific conditions. What does this policy allow?

Accepted Answer

Decrypt data that was encrypted with the encryption context {"aws:pi":"db-123"}. The policy allows the kms:Decrypt action only when the encryption context matches the specified key-value pair. The condition likely uses the StringEquals condition operator on the kms:EncryptionContext:aws:pi key with value db-123. This means decryption is permitted only for ciphertext that was encrypted with that exact encryption context.

Answer

Decrypt any data encrypted with any KMS key

Answer

Encrypt data with the KMS key using the specified encryption context

Answer

Decrypt data encrypted with the KMS key without any encryption context

Question 12

A data engineer is designing a data lake on S3 and needs to ensure that data is encrypted at rest using customer-managed KMS keys. The engineer also needs to audit all access to the KMS keys. Which combination of services should be used?

Accepted Answer

SSE-KMS with AWS CloudTrail. SSE-KMS allows customer-managed KMS keys, and AWS CloudTrail logs all KMS API calls (e.g., Decrypt, GenerateDataKey), enabling auditing. Option B is incorrect because SSE-C uses customer-provided encryption keys, not KMS, and CloudWatch Logs is for application logs, not KMS access. Option C is incorrect because S3 Inventory provides object metadata but does not audit KMS access. Option D is incorrect because SSE-S3 uses AWS-managed keys, not customer-managed, and S3 server access logs do not capture KMS API calls.

Answer

SSE-C with CloudWatch Logs

Answer

SSE-KMS with S3 Inventory

Answer

SSE-S3 with S3 server access logs

Question 13

A data engineer needs to share a dataset from an S3 bucket in Account A with another AWS account (Account B). The data must remain encrypted at rest with KMS. Which steps are required?

Accepted Answer

Update the S3 bucket policy and the KMS key policy to allow Account B. The correct steps are to update both the S3 bucket policy to grant Account B access to the objects and the KMS key policy to grant Account B the necessary decrypt permissions. Option A is insufficient because it only updates the KMS key policy; the bucket policy must also be updated to allow Account B's access to the S3 objects. Option B is also insufficient because creating an IAM role alone does not grant KMS decrypt permissions; the KMS key policy must be updated. Option C is correct as it includes both. Option D is insufficient because it only updates the bucket policy, not the KMS key policy.

Answer

Update the KMS key policy to allow Account B's root user

Answer

Create an IAM role in Account A and grant cross-account access

Answer

Update the S3 bucket policy to allow Account B's root user

Question 14

A company has a requirement to store audit logs for 7 years for compliance. The logs are stored in S3 and must be immutable. Which S3 feature should be used?

Accepted Answer

Enable S3 Object Lock in compliance mode. S3 Object Lock in compliance mode prevents objects from being deleted or overwritten for a specified retention period, ensuring immutability for compliance. Option A is wrong because a bucket policy denying s3:DeleteObject does not prevent overwrites or other actions that could modify the object. Option B is wrong because MFA Delete adds a protection layer but can be bypassed by the root user and does not prevent overwrites. Option C is wrong because versioning and lifecycle policies do not inherently prevent deletion or overwrite of all versions; they only manage object versions and transitions. Option D is correct.

Answer

Use a bucket policy that denies s3:DeleteObject

Answer

Enable MFA Delete on the bucket

Answer

Enable S3 Versioning and set a lifecycle policy

Question 15

A company uses Amazon Redshift for data warehousing. The security team requires that all data stored in Redshift be encrypted at rest using a customer-managed KMS key. How should the data engineer configure this?

Accepted Answer

Enable encryption using a KMS key when creating the Redshift cluster. Redshift encryption at rest with a customer-managed KMS key must be specified at cluster creation time via the 'Encrypted' and 'KmsKeyId' parameters (console: 'KMS' encryption option). Once a cluster is created unencrypted, it cannot be converted in place — you must create a new encrypted cluster and migrate data. This satisfies the security team's requirement of a CMK rather than the default AWS-managed key.

Answer

Configure S3 SSE-KMS on the underlying S3 storage

Answer

Use the AWS KMS console to encrypt the Redshift cluster after creation

Answer

Set a cluster parameter group with encryption enabled