DEA-C01 Data Security and Governance Practice Test 18 — 15 Questions

Question 1

A data engineer is designing a data lake on Amazon S3 that must comply with a regulatory requirement to prevent any data from being overwritten or deleted for 7 years after creation. Which S3 feature should be used?

Accepted Answer

S3 Object Lock with retention mode set to COMPLIANCE. Option A is correct because S3 Object Lock with retention mode COMPLIANCE prevents any deletion or overwrite for the specified period. Option B is wrong because MFA Delete requires a token but can still be disabled. Option C is wrong because bucket policies can be changed. Option D is wrong because versioning alone does not prevent deletion; objects can still be deleted with delete markers.

Answer

S3 bucket policy that denies s3:DeleteObject

Answer

S3 bucket versioning with MFA Delete

Answer

S3 bucket versioning only

Question 2

A company wants to centrally manage access to multiple AWS accounts for its data engineers. The company already uses AWS Organizations. Which AWS service should be used to define fine-grained permissions across accounts?

Accepted Answer

AWS IAM Identity Center (AWS Single Sign-On). Option C is correct because AWS IAM Identity Center (formerly AWS SSO) allows central management of permissions across accounts. Option A is wrong because IAM is per-account. Option B is wrong because AWS RAM shares resources, not permissions. Option D is wrong because AWS KMS manages encryption keys.

Answer

AWS IAM

Answer

AWS Resource Access Manager (AWS RAM)

Answer

AWS Key Management Service (AWS KMS)

Question 3

A company uses Amazon RDS for MySQL to store financial data. A compliance requirement mandates that all database connections must be encrypted. Which configuration step is necessary?

Accepted Answer

Enable encryption for the RDS DB instance at creation time.. Option D is correct because enabling encryption for RDS instances requires using a DB instance that supports encryption and enabling it at creation. Option A is wrong because VPC security groups control network access, not encryption. Option B is wrong because RDS does not support enforcing encryption at the subnet level. Option C is wrong because RDS does not have a parameter enforce_ssl; it needs to be enabled in the DB parameter group.

Answer

Set the RDS parameter enforce_ssl to 1.

Answer

Create the RDS DB instance in a private subnet.

Answer

Configure the VPC security group to only allow traffic from certain IPs.

Question 4

A data engineer needs to share a dataset stored in an S3 bucket with a partner AWS account. The partner should be able to read the data without needing to authenticate with the engineer's account. The engineer must not share any secret keys. Which approach should be used?

Accepted Answer

Write a bucket policy that grants access to the partner account's IAM role.. Option B is correct because S3 bucket policies can grant cross-account access to a specific IAM role in the partner account. Option A is wrong because presigned URLs are temporary and need to be generated. Option C is wrong because making the bucket public violates security. Option D is wrong because sharing access keys is insecure and against best practices.

Answer

Generate presigned URLs and share them with the partner.

Answer

Make the bucket publicly readable.

Answer

Create an IAM user with access keys and share them with the partner.

Question 5

A company uses Amazon Redshift for data warehousing. The security team requires that all data in transit between the Redshift cluster and clients be encrypted. Which feature should be enabled?

Accepted Answer

SSL/TLS encryption. Option C is correct because Redshift supports SSL/TLS encryption for client connections. Option A is wrong because VPC peering does not encrypt. Option B is wrong because Redshift doesn't use a VPN. Option D is wrong because KMS encrypts data at rest.

Answer

Client-side VPN

Answer

AWS KMS key

Answer

VPC peering

Question 6

A company needs to securely store and manage database credentials used by a data pipeline. Which AWS services can be used to store and rotate secrets automatically? (Choose TWO.)

Accepted Answer

AWS Systems Manager Parameter Store. Options A and B are correct. AWS Secrets Manager can rotate secrets automatically. AWS Systems Manager Parameter Store can store secrets securely, but automatic rotation requires custom logic or integration. Option C is wrong because IAM stores certificates, not secrets. Option D is wrong because KMS is for encryption keys, not secrets. Option E is wrong because CloudHSM is for hardware security modules.

Answer

AWS IAM

Answer

AWS Key Management Service (AWS KMS)

Answer

AWS CloudHSM

Question 7

A data engineer needs to ensure that an S3 bucket policy follows the principle of least privilege. Which of the following are valid conditions to restrict access based on the requester's identity? (Choose THREE.)

Accepted Answer

aws:PrincipalOrgID. Options A, C, and D are correct. aws:SourceIp restricts based on IP address. aws:PrincipalOrgID restricts to a specific AWS Organization. aws:userId restricts to a specific IAM user ID. Option B is wrong because aws:Referer is for HTTP referrer, not identity. Option E is wrong because s3:x-amz-server-side-encryption is for encryption, not identity.

Answer

s3:x-amz-server-side-encryption

Answer

aws:Referer

Question 8

A company must comply with a regulation that requires logging all access to sensitive data stored in Amazon S3. Which AWS services can be used to capture and store access logs? (Choose TWO.)

Accepted Answer

AWS CloudTrail. Options B and D are correct. AWS CloudTrail logs API calls to S3. Amazon S3 server access logs provide detailed records of requests. Option A is wrong because Amazon CloudWatch Logs can receive logs but doesn't generate S3 access logs directly. Option C is wrong because AWS Config tracks configuration changes, not access. Option E is wrong because VPC Flow Logs capture network traffic, not S3 access.

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Answer

VPC Flow Logs

Question 9

Refer to the exhibit. An S3 bucket policy is shown. A data engineer using the DataEngineerRole tries to upload an object to s3://example-bucket/data/report.csv with SSE-S3 encryption. The upload fails. What is the most likely cause?

Accepted Answer

The condition requires SSE-S3 encryption header, but the upload did not include it.. Option D is correct because the condition s3:x-amz-server-side-encryption: AES256 requires SSE-S3, but the policy also requires that encryption header be present. Option A is wrong because the role has GetObject and PutObject permissions. Option B is wrong because the resource is data/*, which should match. Option C is wrong because the policy allows the role.

Answer

The resource ARN does not match the object.

Answer

The role does not have s3:PutObject permission.

Answer

The principal is not authorized.

Question 10

Refer to the exhibit. A data engineer runs the AWS CLI command shown to encrypt a file using AWS KMS. The command succeeds. Later, the engineer tries to decrypt the file using the same key but without providing an encryption context. The decryption fails. What is the most likely reason?

Accepted Answer

The encryption context must be provided during decryption.. Option C is correct because KMS encryption context is used as additional authenticated data (AAD) and must be provided for decryption. Option A is wrong because the key is not disabled. Option B is wrong because key policy does not affect decryption with the same key. Option D is wrong because the command did not fail.

Answer

The KMS key policy does not allow decryption.

Answer

The KMS key has been disabled.

Answer

The plaintext file was corrupted.

Question 11

Refer to the exhibit. An IAM policy is attached to a user. What is the security implication of this policy?

Accepted Answer

The policy grants excessive permissions, violating least privilege.. Option B is correct because the policy grants full S3 access to all resources, violating least privilege. Option A is wrong because it's too permissive. Option C is wrong because the policy is valid syntax. Option D is wrong because it grants access to all actions.

Answer

The policy only allows read access.

Answer

The policy is invalid because it uses asterisks.

Answer

The policy is too restrictive.

Question 12

A data engineer needs to ensure that an S3 bucket containing sensitive customer data is encrypted at rest. The company requires that all encryption keys be managed by AWS and rotated annually. Which encryption option meets these requirements?

Accepted Answer

Use server-side encryption with S3-managed keys (SSE-S3). SSE-S3 uses AWS-managed keys and handles key rotation automatically. SSE-KMS also uses AWS-managed keys but gives more control; however, the requirement does not specify customer-managed keys. SSE-C requires the customer to manage keys, which does not meet the requirement of AWS-managed keys. Option D is not a valid encryption type.

Answer

Use server-side encryption with AWS KMS (SSE-KMS)

Answer

Use client-side encryption with AWS KMS

Answer

Use server-side encryption with customer-provided keys (SSE-C)

Question 13

A company is using an Amazon RDS for PostgreSQL database to store personally identifiable information (PII). The security team wants to ensure that database administrators cannot view the plaintext PII data. Which solution should a data engineer implement?

Accepted Answer

Use client-side encryption with AWS KMS to encrypt PII before inserting into the database. Using AWS KMS with client-side encryption ensures that data is encrypted before being sent to RDS, so database administrators cannot read the plaintext. Dynamic data masking in RDS is not natively supported; application-level masking would be needed. RDS encryption at rest protects data on disk but DBAs with access can still query plaintext. Using IAM policies to restrict access does not prevent DBAs with database credentials from viewing data.

Answer

Use IAM policies to restrict DBA access to the RDS instance

Answer

Enable Dynamic Data Masking in RDS to obfuscate PII for all users

Answer

Enable encryption at rest for the RDS instance using AWS KMS

Question 14

A company wants to audit all changes to IAM policies in their AWS account. Which AWS service should be used to record these changes for compliance purposes?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records API calls, including IAM policy changes. AWS Config records resource configurations but not all API calls. CloudWatch Logs can store logs but does not record API calls itself. S3 is the destination for logs, not the recording service.

Answer

Amazon CloudWatch Logs

Answer

AWS Config

Answer

Amazon S3

Question 15

A data engineer is configuring an S3 bucket policy to allow cross-account access for a partner account to read objects. The bucket is encrypted with SSE-KMS using a customer-managed key. What additional configuration is needed to allow the partner account to decrypt the objects?

Accepted Answer

Update the KMS key policy to grant the partner account kms:Decrypt permission. For cross-account access with SSE-KMS, the KMS key policy must grant the partner account access to use the key. The bucket policy alone is insufficient. The partner account does not need VPC endpoints, and the bucket policy for decryption is not needed. The partner account does not need access to the S3 bucket's encryption configuration.

Answer

Add a bucket policy that grants the partner account s3:GetObject

Answer

Create a VPC endpoint for S3 and add it to the bucket policy

Answer

Add a bucket policy that grants s3:GetObject and s3:GetEncryptionConfiguration