DEA-C01 Data Security and Governance Practice Test 17 — 15 Questions

Question 1

A company stores data in Amazon S3 with server-side encryption using AWS KMS (SSE-KMS). The data engineer needs to give a third-party auditor read-only access to the encrypted objects. The auditor has an AWS account. Which strategy should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Update the S3 bucket policy to allow access from the auditor's account and update the KMS key policy to allow the auditor's account to decrypt.. Cross-account access to SSE-KMS encrypted objects requires both an S3 bucket policy allowing the auditor's account and a KMS key policy granting the auditor's account decrypt permissions. Option A is wrong because presigned URLs don't solve the cross-account KMS issue. Option B is wrong because simply granting access to the KMS key is insufficient without S3 permissions. Option C is wrong because copying objects with SSE-S3 changes encryption and may not be allowed.

Answer

Generate a presigned URL for each object the auditor needs to access.

Answer

Copy the objects to a new bucket encrypted with SSE-S3 and share that bucket.

Answer

Grant the auditor's IAM role permission to use the KMS key.

Question 2

A company is building a data lake on AWS and must encrypt data at rest. Which services can provide server-side encryption for data stored in Amazon S3? (Choose TWO.)

Accepted Answer

SSE-S3. SSE-S3 (Option A) and SSE-KMS (Option E) are the two server-side encryption options for Amazon S3. SSE-S3 uses Amazon-managed keys, while SSE-KMS uses AWS KMS-managed keys. Option B (SSL/TLS) is encryption in transit, not at rest. Option C (AWS SDK client-side encryption) encrypts data before it reaches S3, so it is client-side, not server-side. Option D (AWS CloudHSM) is a hardware security module for managing keys, but it is not a direct server-side encryption option for S3; S3 does not natively integrate with CloudHSM for SSE.

Answer

SSL/TLS

Answer

AWS SDK client-side encryption

Answer

AWS CloudHSM

Question 3

A data engineer is configuring an Amazon Redshift cluster for compliance. The cluster must encrypt data at rest and automatically rotate the encryption key every year. Which steps should the engineer take? (Choose THREE.)

Accepted Answer

Create the Redshift cluster with encryption enabled.. The correct steps to meet the compliance requirements are A, B, and E. Option A is correct because encryption must be enabled during Redshift cluster creation; it cannot be added afterward. Option B is correct because using a customer-managed KMS key allows you to enable automatic yearly rotation of the key itself, satisfying the key rotation requirement. Option E is correct because specifying a customer-managed KMS key gives you control over the key and its rotation policy. Option C is incorrect because Redshift does not provide a native mechanism to rotate the cluster's encryption key; key rotation is handled at the KMS level. Option D is incorrect because encryption cannot be enabled on an existing unencrypted Redshift cluster; you must create a new cluster with encryption enabled.

Answer

Configure the Redshift cluster to rotate its encryption key every year.

Answer

Modify an existing unencrypted cluster to enable encryption.

Question 4

A company wants to audit API calls made to its Amazon S3 buckets. Which AWS services can be used to achieve this? (Choose TWO.)

Accepted Answer

AWS CloudTrail. Options D and E are correct. AWS CloudTrail can log API calls to S3 by enabling data events, and S3 server access logs record detailed request information. Option A is wrong because IAM Access Analyzer reviews resource policies, not API calls. Option B is wrong because AWS Config tracks configuration changes, not API calls. Option C is wrong because VPC Flow Logs capture network traffic, not API calls.

Answer

IAM Access Analyzer

Answer

AWS Config

Answer

VPC Flow Logs

Question 5

Refer to the exhibit. A data engineer applies this S3 bucket policy to an S3 bucket. What is the effect of this policy?

Accepted Answer

Allows only HTTPS requests to get and put objects, and denies HTTP requests.. The bucket policy allows GetObject and PutObject actions only when the request uses HTTPS, and explicitly denies all S3 actions when the request uses HTTP due to the condition `aws:SecureTransport=false`. Therefore, only HTTPS requests for Get and Put are permitted. Option A is incorrect because the policy does not restrict by IP addresses. Option C is incorrect because both Get and Put are allowed over HTTPS, not just Get. Option D is incorrect because the policy does not grant anonymous access; it requires secure transport and does not allow HTTP.

Answer

Allows access only from specific IP addresses.

Answer

Allows only GetObject actions over HTTPS.

Answer

Allows anonymous access to get and put objects over HTTP.

Question 6

Refer to the exhibit. A data engineer runs the commands shown. What can be determined about the key with ID 1234abcd-12ab-34cd-56ef-1234567890ab?

Accepted Answer

It is an AWS managed key.. The command output shows that the key's KeyManager is 'AWS', indicating it is an AWS managed key, which corresponds to option D. Option A is incorrect because the key state is 'Enabled', not 'PendingDeletion'. Option B is incorrect because the ARN does not specify a region; the key was created in us-east-1 by default. Option C is incorrect because AWS managed keys have KeyManager set to 'AWS', not 'CUSTOMER'.

Answer

It is pending deletion.

Answer

It was created in us-west-2.

Answer

It is a customer managed key.

Question 7

Refer to the exhibit. A data engineer queries AWS CloudTrail to investigate a PutObject event. What does the exhibit reveal about the object sensitive.csv?

Accepted Answer

The object was uploaded with server-side encryption using AWS KMS.. The CloudTrail event contains `x-amz-server-side-encryption: aws:kms`, which confirms the object was uploaded with server-side encryption using AWS KMS (SSE-KMS). Option A is incorrect because the event shows a successful upload, not a failure. Option C is incorrect because the event indicates encryption was applied. Option D is incorrect because SSE-S3 would show `AES256`, not `aws:kms`.

Answer

The upload failed due to encryption mismatch.

Answer

The object was not encrypted at rest.

Answer

The object was encrypted with SSE-S3.

Question 8

A data engineer needs to ensure that all data in an S3 bucket is encrypted at rest. The bucket contains objects uploaded by various applications. What is the simplest method to enforce encryption for all new objects?

Accepted Answer

Configure an S3 bucket policy that denies PutObject requests without the x-amz-server-side-encryption header.. An S3 bucket policy can deny PutObject requests that do not include the x-amz-server-side-encryption header, thereby enforcing encryption for all new objects. Option A is wrong because S3 Block Public Access does not enforce encryption. Option B is wrong because default encryption applies only if the upload request does not specify encryption headers; it does not enforce encryption for requests that specify 'None'. Option C is wrong because S3 Object Lock prevents deletion but does not enforce encryption.

Answer

Enable S3 Block Public Access to block public access to the bucket.

Answer

Enable default encryption on the S3 bucket using S3-Managed Keys (SSE-S3).

Answer

Enable S3 Object Lock on the bucket.

Question 9

A company uses AWS KMS to encrypt sensitive data in S3. The security team requires that the KMS key must be rotated automatically every year. Which key type should be used?

Accepted Answer

Customer managed key with automatic rotation enabled. Customer managed keys can be configured with automatic rotation every year, meeting the security team's requirement. Option B is incorrect because AWS managed keys (aws/s3) rotate automatically every 3 years, not annually. Option A is incorrect because asymmetric keys do not support automatic rotation. Option C is incorrect because custom key stores backed by CloudHSM do not offer automatic rotation.

Answer

Asymmetric customer managed key

Answer

AWS managed key (aws/s3)

Answer

Custom key store backed by CloudHSM

Question 10

A company wants to audit all data access events in their S3 buckets, including who accessed objects and from which IP address. Which AWS service should be used to capture these events?

Accepted Answer

AWS CloudTrail with data events enabled. AWS CloudTrail can log S3 API calls such as GetObject, PutObject, and ListObjects when data events are enabled, capturing details like who accessed an object and from which IP address. Option D is incorrect because S3 Server Access Logs provide object-level logs but do not include IAM user or role details. Option B is incorrect because Amazon CloudWatch Logs can store and monitor logs but does not capture S3 data events directly. Option C is incorrect because AWS Config records resource configuration changes, not data access events.

Answer

Amazon CloudWatch Logs

Answer

AWS Config

Answer

Amazon S3 Server Access Logs

Question 11

A data engineer needs to allow a Lambda function to read data from an S3 bucket in the same account. The Lambda function's execution role has the required permissions, but access is denied. The S3 bucket has a bucket policy that explicitly denies access to any principal that is not from the organization. What is the most likely issue?

Accepted Answer

The Lambda execution role is not part of the AWS organization.. The bucket policy explicitly denies access to any principal that is not from the AWS organization. Since the Lambda execution role is not part of the organization, the explicit deny overrides any allow permissions granted to the role. Option B is incorrect because the VPC endpoint policy is not mentioned in the scenario. Option C is incorrect because the bucket is in the same account. Option D is incorrect because KMS permissions are not relevant to this access denial.

Answer

The Lambda function is in a VPC without an S3 VPC endpoint.

Answer

The S3 bucket is in a different AWS account.

Answer

The Lambda function does not have kms:Decrypt permission.

Question 12

A company wants to ensure that only encrypted connections are used when data is transferred to S3. Which policy condition should be used in an S3 bucket policy?

Accepted Answer

Condition: { Bool: { aws:SecureTransport: false } }. The condition `aws:SecureTransport: false` is used to deny requests that are not sent over SSL/TLS, ensuring encrypted connections for data transfer to S3. Option A (`s3:x-amz-server-side-encryption`) controls encryption at rest, not in transit. Option B (`s3:signatureversion`) checks the signature version used for request authentication, not encryption. Option C (`aws:SourceIp`) filters by source IP address, which is unrelated to encryption.

Answer

Condition: { Null: { s3:x-amz-server-side-encryption: true } }

Answer

Condition: { StringEquals: { s3:signatureversion: ["AWS4-HMAC-SHA256"] } }

Answer

Condition: { StringNotEquals: { aws:SourceIp: ["0.0.0.0/0"] } }

Question 13

A data engineer is configuring an S3 bucket to host sensitive data. The security policy requires that all objects be encrypted with a key that is generated and managed by the customer, and that the key be stored in AWS KMS. Which encryption option should be used?

Accepted Answer

Server-Side Encryption with AWS KMS-Managed Keys (SSE-KMS). SSE-KMS allows you to use customer-managed keys stored in AWS KMS, meeting the requirement for customer-generated and managed keys. Option A is incorrect because SSE-S3 uses AWS-managed keys, not customer-managed. Option B is incorrect because client-side encryption encrypts data outside S3, not using S3 server-side encryption. Option C is incorrect because SSE-C uses customer-provided keys that you manage yourself, but they are not stored in AWS KMS—you must provide them with each request.

Answer

Server-Side Encryption with S3-Managed Keys (SSE-S3)

Answer

Client-Side Encryption

Answer

Server-Side Encryption with Customer-Provided Keys (SSE-C)

Question 14

A data engineer is troubleshooting an ETL job that reads from an S3 bucket encrypted with SSE-KMS. The job is failing with an error indicating that the IAM role does not have permission to decrypt the data. What is the most likely missing permission?

Accepted Answer

kms:Decrypt. Kms:Decrypt. When an S3 object is encrypted with SSE-KMS, the IAM role must have the kms:Decrypt permission to decrypt the object before reading it. Option A (kms:GenerateDataKey) is used for encryption, not decryption, so it is incorrect. Option B (s3:ListBucket) only allows listing objects in the bucket, not reading or decrypting them. Option D (s3:GetObject) allows reading the object, but without kms:Decrypt, the encrypted object cannot be decrypted, so the read fails.

Answer

kms:GenerateDataKey

Answer

s3:ListBucket

Answer

s3:GetObject

Question 15

A data engineering team needs to encrypt data at rest in an Amazon S3 bucket that stores sensitive customer information. The team must use an AWS Key Management Service (AWS KMS) customer managed key with automatic rotation enabled. Which configuration meets these requirements?

Accepted Answer

Use default encryption with SSE-KMS and specify the customer managed key ID.. It enables SSE-KMS with a customer managed key that supports automatic key rotation, meeting the requirement for a customer managed key with automatic rotation. Option B is incorrect because SSE-S3 uses AWS managed keys that are not customer-controlled and do not support automatic rotation. Option C is incorrect because SSE-C requires the customer to provide and manage their own keys, and does not support automatic rotation. Option D is incorrect because leaving the key ID empty defaults to the AWS managed KMS key, which is not a customer managed key and does not support automatic rotation.

Answer

Use default encryption with SSE-S3.

Answer

Use default encryption with SSE-C and provide a customer-provided key.

Answer

Use default encryption with SSE-KMS and leave the key ID empty to use the AWS managed key.