DEA-C01 Data Security and Governance Practice Test 18 — 15 Questions

Question 1

A data engineer is troubleshooting an issue where an IAM role used by AWS Glue cannot read data from an S3 bucket encrypted with SSE-KMS. The bucket policy allows the role to perform s3:GetObject. What additional permission is needed?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

kms:Decrypt on the KMS key. For SSE-KMS, the IAM role needs kms:Decrypt permission on the KMS key to read encrypted objects. Option A (s3:GetObjectVersion) is not required because the bucket policy already allows s3:GetObject; versioning is not relevant here. Option C (s3:GetObjectAcl) is for access control lists, not encryption. Option D (kms:GenerateDataKey) is used for encrypting new objects, not reading existing ones. Therefore, the correct answer is B.

Answer

s3:GetObjectVersion

Answer

s3:GetObjectAcl

Answer

kms:GenerateDataKey on the KMS key

Question 2

A company uses AWS CloudTrail to log all API calls. The security team wants to ensure that log files are tamper-proof and cannot be deleted. Which TWO actions should the data engineer take? (Choose TWO.)

Accepted Answer

Enable CloudTrail log file validation. Option A is correct because enabling CloudTrail log file validation generates a digitally signed digest file for each log file, allowing you to verify that logs have not been tampered with or modified after delivery. Option B is correct because S3 Object Lock enforces WORM (Write Once Read Many) protection, preventing log files from being deleted or overwritten for a specified retention period, which directly satisfies the tamper-proof and non-deletable requirement. Option C is not correct because MFA Delete only requires multi-factor authentication for deleting objects or changing versioning state; it adds a control but does not make logs inherently tamper-proof or prevent deletion by an authorized MFA holder. Option D is not correct because S3 Versioning merely preserves prior versions of objects, so deleted or altered logs can still be removed and versioning alone does not prevent deletion. Option E is not correct because SSE-KMS encryption protects data confidentiality at rest but does not prevent log files from being modified or deleted.

Answer

Enable MFA Delete on the S3 bucket

Answer

Enable S3 Versioning on the S3 bucket

Answer

Enable SSE-KMS encryption on the S3 bucket

Question 3

A data engineer is setting up a data pipeline using AWS DMS to migrate data from an on-premises database to Amazon RDS for MySQL. The data must be encrypted in transit. Which TWO options can the engineer use? (Choose TWO.)

Accepted Answer

Enable SSL encryption on the DMS endpoint. Option B is correct because AWS DMS endpoints for MySQL support SSL/TLS, and enabling the SSL encryption setting on the source and target endpoints causes DMS to negotiate an encrypted connection to the database, satisfying the in-transit encryption requirement. Option C is correct because a VPN connection (AWS Site-to-Site VPN) creates an IPsec-encrypted tunnel between the on-premises network and the AWS VPC, protecting data in transit as it crosses the public internet to reach Amazon RDS for MySQL. Option A is not correct because VPC peering only connects AWS VPCs to each other and does not extend to an on-premises network, so it cannot secure this migration path. Option D is not correct because AWS KMS provides encryption at rest for stored data and keys, not encryption of the DMS network connection in transit. Option E is not correct because a VPC endpoint (AWS PrivateLink) provides private connectivity to AWS services within AWS, not an encrypted path from an on-premises database to RDS.

Answer

Use VPC peering between on-premises and AWS

Answer

Use KMS to encrypt the DMS connection

Answer

Use a VPC endpoint for DMS

Question 4

Refer to the exhibit. A data engineer applies the following S3 bucket policy to an S3 bucket. What does this policy enforce?

Accepted Answer

Requires that all objects uploaded to the bucket be encrypted with SSE-KMS. The bucket policy uses a Deny effect with a condition that checks if the s3:x-amz-server-side-encryption header is not 'aws:kms'. This means any PutObject request that does not use SSE-KMS will be denied. Therefore, the policy enforces that all objects uploaded must be encrypted with SSE-KMS. Option A is incorrect because the policy does not mention SSE-S3; it denies if not SSE-KMS. Option B is incorrect because it requires SSE-KMS, not SSE-S3. Option C is incorrect because the policy only allows SSE-KMS, not any type of server-side encryption. Option D is correct.

Answer

Denies all uploads unless SSE-S3 is used

Answer

Allows only SSE-S3 encrypted uploads

Answer

Allows any type of server-side encryption

Question 5

A data engineer needs to share an S3 bucket with another AWS account. They want to ensure that the objects in the bucket remain encrypted with SSE-KMS using a customer managed key. What additional step is required for cross-account access?

Accepted Answer

Modify the KMS key policy to grant the target account kms:Decrypt permission. When using SSE-KMS with a customer managed key, cross-account access requires the KMS key policy to grant the target account's IAM role or user the necessary KMS permissions (kms:Decrypt, and optionally kms:GenerateDataKey). The S3 bucket policy must also grant s3:GetObject, and the target account's IAM policy must allow kms:Decrypt. However, the key policy is the additional step specific to KMS that is not covered by S3 policies alone. Without it, the target account cannot use the key. Option A is correct because modifying the key policy is essential. Option B is insufficient because the target account's IAM policy cannot override the key policy. Option C is unnecessary and breaks encryption. Option D provides S3 access but not KMS access.

Answer

Add an IAM policy in the target account to allow kms:Decrypt

Answer

Disable SSE-KMS encryption on the bucket

Answer

Add a bucket policy that grants the target account s3:GetObject

Question 6

A company wants to enforce that all data in Amazon S3 is encrypted at rest. They want to automatically reject any PUT request that does not include encryption headers. What S3 feature should they use?

Accepted Answer

Bucket policy with a condition for encryption headers. An S3 bucket policy with a condition such as s3:x-amz-server-side-encryption or s3:x-amz-server-side-encryption-aws-kms-key-id can explicitly deny any PutObject request that lacks the required encryption headers. This enforces encryption at rest by rejecting unencrypted uploads at the API level, which is exactly the requirement. Default encryption alone does not reject unencrypted PUTs — it only encrypts them automatically.

Answer

Default encryption

Answer

MFA Delete

Answer

S3 Block Public Access

Question 7

A company needs to monitor and record all changes to IAM policies in their AWS account. Which AWS service should be used?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records API activity in an AWS account, including all IAM policy changes (CreatePolicy, AttachRolePolicy, PutRolePolicy, etc.), capturing who made the change, when, from which IP, and with what parameters. It is the authoritative audit service for governance, compliance, and security analysis of control-plane actions. CloudWatch Logs, GuardDuty, and IAM Access Analyzer serve monitoring, threat detection, and permission analysis—not comprehensive API change recording.

Answer

Amazon CloudWatch Logs

Answer

Amazon GuardDuty

Answer

AWS IAM Access Analyzer

Question 8

A data engineer wants to ensure that only users with a specific tag (e.g., "Department": "DataEngineering") can access an S3 bucket. How can this be enforced?

Accepted Answer

Use a bucket policy with aws:PrincipalTag condition. S3 bucket policies support condition keys like aws:PrincipalTag, which allow access control based on tags attached to IAM principals (users or roles). Option A is correct because it uses aws:PrincipalTag in the bucket policy to restrict access to users with the specific tag. Option B is incorrect because S3 object tags are for objects, not principals, and cannot be used to filter users. Option C is incorrect because attaching an IAM policy to each user is less scalable and does not leverage the bucket policy's centralized control. Option D is incorrect because S3 Object Lambda is for modifying data during retrieval, not for access control decisions.

Answer

Use S3 object tags and a bucket policy condition

Answer

Attach an IAM policy to each user with the tag

Answer

Use S3 Object Lambda to check user tags

Question 9

A data engineer needs to securely store database credentials for an RDS instance. Which TWO AWS services can be used?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager (B) is correct because it is purpose-built to store, rotate, and retrieve secrets such as RDS database credentials, and it natively integrates with RDS for automatic credential rotation. AWS Systems Manager Parameter Store (E) is also correct because it can store database credentials as SecureString parameters, which are encrypted with AWS KMS, allowing the data engineer to retrieve them securely at runtime. AWS KMS (A) only provides encryption keys and cryptographic operations; it does not itself store credentials or secrets. AWS IAM (C) manages identities, roles, and permissions, not secret values. AWS CloudFormation (D) is an infrastructure-as-code provisioning service and is not designed to store or retrieve database credentials.

Answer

AWS KMS

Answer

AWS IAM

Answer

AWS CloudFormation

Question 10

A data engineer is configuring an S3 bucket for storing sensitive customer data. The bucket must be encrypted at rest using an AWS Key Management Service (KMS) key that is managed by the data engineering team. The team wants to ensure that only users with explicit permission can decrypt the data. Which S3 encryption option should be used?

Accepted Answer

SSE-KMS. SSE-KMS is the correct option because it uses a customer-managed AWS KMS key, allowing the data engineering team to control access and permissions for decryption. Client-side encryption is not an S3 server-side encryption option and does not use KMS. SSE-S3 uses Amazon S3-managed keys, which do not provide customer-controlled access. SSE-C requires the customer to manage their own encryption keys and does not use KMS, nor does it allow the same level of access control as a CMK.

Answer

Client-side encryption

Answer

SSE-S3

Answer

SSE-C

Question 11

A data engineer needs to ensure that data in transit between an Amazon RDS for PostgreSQL database and an application is encrypted. Which configuration should be used?

Accepted Answer

Enable SSL/TLS for the database connection. Enabling SSL/TLS for the database connection encrypts the data in transit between the application and the RDS PostgreSQL instance, ensuring confidentiality. Option A (VPC peering) provides network connectivity but does not encrypt traffic. Option C (encryption at rest) protects data stored on disk, not in transit. Option D (IAM database authentication) controls access but does not encrypt the connection.

Answer

Use VPC peering to connect the application to the database

Answer

Enable encryption at rest for the RDS instance

Answer

Use IAM database authentication

Question 12

An organization needs to audit all access to their S3 buckets for compliance purposes. They want to log both successful and failed API calls. Which AWS service should be used?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records all API calls made to S3, including both successful and failed requests, and delivers log files to an S3 bucket for auditing and compliance. CloudTrail captures management events (e.g., CreateBucket) and, when enabled, data events (e.g., GetObject, PutObject) for S3, providing a complete audit trail of access.

Answer

Amazon CloudWatch Logs

Answer

AWS Config

Answer

VPC Flow Logs

Question 13

A company has multiple AWS accounts and wants to centrally manage permissions and access to data lakes. They have enabled AWS Organizations and want to use a single set of policies that apply to all accounts. Which policy type should be used at the organization level?

Accepted Answer

Service control policies (SCPs). Service Control Policies (SCPs) are used in AWS Organizations to centrally manage permissions across accounts. Option A (IAM policies) are attached to IAM users/roles within an account, not across accounts. Option B (KMS key policies) control access to KMS keys. Option C (S3 bucket policies) are specific to S3 buckets.

Answer

IAM policies

Answer

KMS key policies

Answer

S3 bucket policies

Question 14

A data engineer needs to ensure that data stored in Amazon S3 is automatically deleted after 30 days. Which S3 feature should be used?

Accepted Answer

S3 Lifecycle policy. S3 Lifecycle policies can automatically delete objects after a specified time period, such as 30 days. Option B (MFA Delete) requires multi-factor authentication for deletion but does not automate deletion. Option C (Versioning) keeps multiple versions but does not delete. Option D (Object Lock) prevents deletion or modification but does not schedule automatic deletion.

Answer

S3 MFA Delete

Answer

S3 Versioning

Answer

S3 Object Lock

Question 15

A company is using AWS Lake Formation to manage access to a data lake in S3. They want to grant a data analyst access to specific columns in a table, but not to the entire table. Which Lake Formation feature should be used?

Accepted Answer

Column-level filtering. Lake Formation column-level filtering allows granting access to specific columns in a table without granting access to the entire table. Option A (row-level security) controls access to rows, not columns. Option B (IAM policies on the S3 bucket) would grant access to the entire dataset or bucket, not specific columns. Option D (tag-based access control) uses tags to manage permissions but does not provide column-level granularity.

Answer

Row-level security (cell-level filtering)

Answer

IAM policies on the S3 bucket

Answer

Tag-based access control (TBAC)