DEA-C01 Data Security and Governance Practice Test 18 — 15 Questions

Question 1

A company is using AWS Glue to process data stored in Amazon S3. The data includes personally identifiable information (PII) that must be masked before being written to a separate output bucket. Which AWS service or feature can be used to automatically detect and mask sensitive data in the Glue ETL job?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use Amazon Macie to identify sensitive data and apply masking logic in the Glue job.. Amazon Macie can be integrated with AWS Glue to automatically detect sensitive data like PII and apply masking logic within a Glue ETL job. Option A is incorrect because CloudWatch Logs are for monitoring and logging, not for data masking. Option C is incorrect because IAM policies control access permissions but do not mask data. Option D is incorrect because S3 Object Lock prevents object deletion or modification, not masking.

Answer

Configure CloudWatch Logs to filter and mask PII.

Answer

Use an IAM policy to restrict access to the PII columns.

Answer

Enable S3 Object Lock on the output bucket.

Question 2

A data engineer needs to audit all AWS KMS key usage events for the past 90 days to verify compliance. Which AWS service should be used?

Accepted Answer

AWS CloudTrail. (AWS CloudTrail). AWS CloudTrail logs all API calls made to AWS KMS, including key usage events, and retains event history for the past 90 days by default, making it suitable for auditing. Option A (VPC Flow Logs) captures network traffic, not API calls. Option C (AWS Config) tracks resource configuration changes, not API calls. Option D (Amazon Inspector) performs vulnerability assessments, not API logging.

Answer

VPC Flow Logs

Answer

AWS Config

Answer

Amazon Inspector

Question 3

A company needs to enforce encryption in transit for all data moving between its Amazon S3 bucket and a fleet of Amazon EC2 instances. The data is accessed via S3 API calls over the internet. Which configuration ensures encryption in transit?

Accepted Answer

Configure the bucket policy to deny requests that do not use HTTPS.. Configuring the bucket policy to deny requests that do not use HTTPS ensures encryption in transit for S3 API calls. Option A is wrong because SSE-S3 encrypts data at rest, not in transit. Option B is wrong because S3 Transfer Acceleration uses a global network but does not enforce encryption; HTTPS must still be used. Option C is wrong because a VPC endpoint for S3 uses AWS network but does not enforce encryption; the bucket policy must explicitly require HTTPS.

Answer

Enable SSE-S3 on the bucket.

Answer

Enable S3 Transfer Acceleration.

Answer

Use a VPC endpoint for S3.

Question 4

A data engineer is designing a data lake on Amazon S3 that must comply with a regulatory requirement to prevent any data from being overwritten or deleted for 7 years after creation. Which S3 feature should be used?

Accepted Answer

S3 Object Lock with retention mode set to COMPLIANCE. S3 Object Lock with retention mode set to COMPLIANCE ensures that objects cannot be overwritten or deleted for the specified retention period (7 years). The retention period cannot be shortened or removed by any user, including the root user, making it suitable for regulatory compliance. Option A is incorrect because a bucket policy that denies s3:DeleteObject can be modified or removed, and it does not prevent overwrites. Option B is incorrect because MFA Delete requires an additional authentication factor but can still be disabled by an authorized user, and it does not enforce a retention period. Option D is incorrect because bucket versioning alone does not prevent deletion; it only creates delete markers, and objects can still be permanently deleted.

Answer

S3 bucket policy that denies s3:DeleteObject

Answer

S3 bucket versioning with MFA Delete

Answer

S3 bucket versioning only

Question 5

A company wants to centrally manage access to multiple AWS accounts for its data engineers. The company already uses AWS Organizations. Which AWS service should be used to define fine-grained permissions across accounts?

Accepted Answer

AWS IAM Identity Center (AWS Single Sign-On). AWS IAM Identity Center (formerly AWS Single Sign-On) enables centralized management of permissions across multiple AWS accounts by allowing administrators to define fine-grained permissions using permission sets. This eliminates the need to create individual IAM users in each account. Option A is incorrect because IAM is per-account and does not support cross-account permission management without additional configuration. Option C is incorrect because AWS Resource Access Manager (RAM) is used to share resources, not to define permissions. Option D is incorrect because AWS Key Management Service (KMS) is for encryption key management, not access control.

Answer

AWS IAM

Answer

AWS Resource Access Manager (AWS RAM)

Answer

AWS Key Management Service (AWS KMS)

Question 6

A company uses Amazon RDS for MySQL to store financial data. A compliance requirement mandates that all database connections must be encrypted. Which configuration step is necessary?

Accepted Answer

Set the RDS parameter require_secure_transport to 1.. To enforce encrypted connections in transit for RDS MySQL, you need to configure the DB parameter group to require SSL/TLS. Setting the parameter 'require_secure_transport' to 1 forces all connections to use encryption. Option C is incorrect because enabling encryption at rest (at creation time) encrypts stored data, not connections in transit, which does not satisfy the compliance requirement for encrypted connections.

Answer

Create the RDS DB instance in a private subnet.

Answer

Enable encryption for the RDS DB instance at creation time.

Answer

Configure the VPC security group to only allow traffic from certain IPs.

Question 7

A data engineer needs to share a dataset stored in an S3 bucket with a partner AWS account. The partner should be able to read the data without needing to authenticate with the engineer's account. The engineer must not share any secret keys. Which approach should be used?

Accepted Answer

Write a bucket policy that grants access to the partner account's IAM role.. S3 bucket policies can grant cross-account access to a specific IAM role in the partner account, allowing the partner to read data without authentication or shared secrets. Option B is wrong because presigned URLs are temporary and require ongoing generation for each access, not a persistent solution. Option C is wrong because making the bucket public violates security principles and exposes data to everyone. Option D is wrong because sharing access keys is insecure and against best practices; keys should never be shared.

Answer

Generate presigned URLs and share them with the partner.

Answer

Make the bucket publicly readable.

Answer

Create an IAM user with access keys and share them with the partner.

Question 8

A company uses Amazon Redshift for data warehousing. The security team requires that all data in transit between the Redshift cluster and clients be encrypted. Which feature should be enabled?

Accepted Answer

SSL/TLS encryption. Amazon Redshift supports SSL/TLS encryption for client connections to ensure data in transit is encrypted. Option A (Client-side VPN) is not a Redshift feature for encrypting client connections. Option C (AWS KMS key) is used for encrypting data at rest, not in transit. Option D (VPC peering) does not provide encryption of data in transit between the cluster and clients.

Answer

Client-side VPN

Answer

AWS KMS key

Answer

VPC peering

Question 9

A company needs to securely store and manage database credentials used by a data pipeline. Which AWS services can be used to store and rotate secrets automatically? (Choose TWO.)

Accepted Answer

AWS Systems Manager Parameter Store. AWS Systems Manager Parameter Store (A) can securely store secrets and, when using the Advanced tier, supports automatic rotation via AWS Lambda. AWS Secrets Manager (E) provides native automatic rotation for database credentials and other secrets. B (IAM) is for identity and access management, not secret storage. C (KMS) manages encryption keys, not secrets. D (CloudHSM) provides hardware security modules for key management, not secret storage. Therefore, the correct answers are A and E.

Answer

AWS IAM

Answer

AWS Key Management Service (AWS KMS)

Answer

AWS CloudHSM

Question 10

A data engineer needs to ensure that an S3 bucket policy follows the principle of least privilege. Which of the following are valid conditions to restrict access based on the requester's identity? (Choose TWO.)

Accepted Answer

aws:PrincipalOrgID. Options A and E are correct. aws:PrincipalOrgID restricts access to IAM principals within a specific AWS Organization, directly tied to the requester's identity. aws:userId restricts access to a specific IAM user ID, also an identity attribute. Option D (aws:SourceIp) is a network condition based on IP address, not the requester's identity, so it does not meet the requirement. Options B (s3:x-amz-server-side-encryption) and C (aws:Referer) are not identity-based conditions.

Answer

s3:x-amz-server-side-encryption

Answer

aws:Referer

Answer

aws:SourceIp

Question 11

A company must comply with a regulation that requires logging all access to sensitive data stored in Amazon S3. Which AWS services can be used to capture and store access logs? (Choose TWO.)

Accepted Answer

AWS CloudTrail. Options C and D are correct. AWS CloudTrail can be configured to log API calls to S3, including data events for object-level access. Amazon S3 server access logs provide detailed records of requests made to an S3 bucket. Option A is wrong because AWS Config records configuration changes, not data access logs. Option B is wrong because Amazon CloudWatch Logs can store logs but does not generate S3 access logs directly. Option E is wrong because VPC Flow Logs capture IP traffic metadata, not S3 object-level access.

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Answer

VPC Flow Logs

Question 12

Refer to the exhibit. An S3 bucket policy is shown. A data engineer using the DataEngineerRole tries to upload an object to s3://example-bucket/data/report.csv with SSE-S3 encryption. The upload fails. What is the most likely cause?

Accepted Answer

The condition requires SSE-S3 encryption header, but the upload did not include it.. The bucket policy includes a condition that the request must include the `x-amz-server-side-encryption` header with value `AES256` (SSE-S3). The upload did not include this header, so the policy condition was not met, resulting in a failed upload. Option A is incorrect because the resource ARN matches the object path. Option B is incorrect because the role has the `s3:PutObject` permission. Option D is incorrect because the principal (DataEngineerRole) is allowed by the policy.

Answer

The resource ARN does not match the object.

Answer

The role does not have s3:PutObject permission.

Answer

The principal is not authorized.

Question 13

Refer to the exhibit. A data engineer runs the AWS CLI command shown to encrypt a file using AWS KMS. The command succeeds. Later, the engineer tries to decrypt the file using the same key but without providing an encryption context. The decryption fails. What is the most likely reason?

Accepted Answer

The encryption context must be provided during decryption.. When encrypting data with AWS KMS, an encryption context can be provided as additional authenticated data (AAD). This context must be supplied during decryption; otherwise, decryption fails. The command succeeded during encryption, so the key is not disabled (B is wrong) and the key policy is not the issue (A is wrong). File corruption would cause a different error (C is wrong).

Answer

The KMS key policy does not allow decryption.

Answer

The KMS key has been disabled.

Answer

The plaintext file was corrupted.

Question 14

Refer to the exhibit. An IAM policy is attached to a user. What is the security implication of this policy?

Accepted Answer

The policy grants excessive permissions, violating least privilege.. The policy, which grants full S3 access to all resources, violates the principle of least privilege by providing excessive permissions. Option A is incorrect because the policy does not only allow read access; it allows all actions. Option B is incorrect because the use of asterisks is valid syntax in IAM policies. Option C is incorrect because the policy is overly permissive, not restrictive.

Answer

The policy only allows read access.

Answer

The policy is invalid because it uses asterisks.

Answer

The policy is too restrictive.

Question 15

A data engineer needs to ensure that an S3 bucket containing sensitive customer data is encrypted at rest. The company requires that all encryption keys be managed by AWS and rotated annually. Which encryption option meets these requirements?

Accepted Answer

Use server-side encryption with S3-managed keys (SSE-S3). SSE-S3 uses AWS-managed keys and automatically handles annual key rotation, meeting both requirements of encryption at rest and AWS-managed keys with rotation. SSE-KMS also uses AWS-managed keys but does not automatically rotate keys (unless using a custom KMS key with rotation enabled, but the question implies automatic rotation without extra configuration). SSE-C requires customer-provided keys, which violates the requirement that AWS manages the keys. Client-side encryption (B) is not server-side and also involves customer management. Thus, only SSE-S3 fully satisfies the requirements.

Answer

Use server-side encryption with AWS KMS (SSE-KMS)

Answer

Use client-side encryption with AWS KMS

Answer

Use server-side encryption with customer-provided keys (SSE-C)