DEA-C01 Data Security and Governance Practice Test 19 — 15 Questions

Question 1

A company uses AWS Lake Formation to manage data lake permissions. The data engineer notices that a user with SELECT permission on a table can also query the underlying data in Amazon S3 directly. How can the engineer enforce that access to the S3 data is only through Lake Formation?

Accepted Answer

Grant the user permissions only through Lake Formation and remove any IAM policies that allow direct S3 access to the data location. Registering the S3 location with Lake Formation and using the 'Lake Formation managed' option ensures that IAM policies do not grant direct S3 access. Lake Formation provides fine-grained access control, and by granting only Lake Formation permissions and revoking direct S3 bucket permissions, users cannot bypass Lake Formation. Option B and D do not prevent direct S3 access. Option C suggests Lake Formation does not control S3 access, which is incorrect.

Answer

Use S3 Access Points with a policy that restricts access to only Lake Formation

Answer

Enable S3 Block Public Access on the bucket

Answer

Change the S3 bucket policy to deny all access except from Lake Formation

Question 2

A company wants to securely store database credentials used by a Lambda function. Which AWS service should be used to store and rotate the credentials automatically?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is designed for storing secrets and provides automatic rotation. Systems Manager Parameter Store can store secrets but does not natively support automatic rotation for database credentials. KMS is for encryption keys, not storing secrets. CloudHSM is for hardware security modules.

Answer

AWS CloudHSM

Answer

AWS Key Management Service (KMS)

Answer

AWS Systems Manager Parameter Store

Question 3

A company is using Amazon Redshift for analytics and needs to ensure that all data is encrypted at rest. The current cluster does not have encryption enabled. What is the most efficient way to enable encryption?

Accepted Answer

Create a snapshot of the cluster and restore it to a new cluster with encryption enabled. Redshift does not support enabling encryption on an existing cluster; a new encrypted cluster must be created and data migrated. Modifying the cluster configuration or parameter groups does not enable encryption. Creating a snapshot and restoring it to a new cluster with encryption enabled is the standard approach.

Answer

Change the cluster parameter group to enable encryption

Answer

Modify the cluster configuration to enable encryption

Answer

Use AWS DMS to migrate data to a new encrypted cluster

Question 4

A data engineer needs to grant a data scientist access to query a Glue Data Catalog database but must prevent the data scientist from seeing the underlying S3 data locations. Which approach should be used?

Accepted Answer

Use AWS Lake Formation to grant SELECT permission on the database and tables without granting S3 access. Lake Formation can be used to grant SELECT permission on the database and tables, and by using column-level and row-level filters, but to hide S3 locations, the data scientist should not have direct S3 access. Lake Formation does not require the user to see the S3 path. Granting IAM read-only access to S3 would expose locations. Using a VPC endpoint does not hide locations. Glue resource policies cannot hide S3 locations.

Answer

Use a Glue resource policy to restrict access to the database

Answer

Grant the data scientist IAM permissions to access the Glue Data Catalog and the underlying S3 data

Answer

Create a VPC endpoint for Glue and S3 to restrict network access

Question 5

A company has an S3 bucket that stores logs for compliance. The compliance team requires that objects are retained for 7 years and cannot be deleted or overwritten. Which S3 feature should be used?

Accepted Answer

Enable S3 Object Lock with retention mode COMPLIANCE and a retention period of 7 years. S3 Object Lock with retention mode COMPLIANCE prevents objects from being deleted or overwritten for the specified retention period. Versioning alone does not prevent deletion. MFA Delete prevents accidental deletion but not overwrite. Lifecycle policies can expire objects but do not prevent deletion.

Answer

Enable MFA Delete on the bucket

Answer

Configure an S3 bucket policy that denies delete and overwrite actions

Answer

Enable S3 Versioning and configure a lifecycle policy to expire objects after 7 years

Question 6

A company needs to protect sensitive data stored in Amazon S3 from unauthorized access. Which TWO actions should the data engineer take? (Choose two.)

Accepted Answer

Configure S3 bucket policies to require MFA for delete operations. Enabling S3 Block Public Access at the account level prevents any public access. Using bucket policies with conditions to require MFA adds an extra layer of security. Versioning does not prevent unauthorized access. Lifecycle policies manage storage, not security. Cross-region replication is for disaster recovery, not security.

Answer

Enable cross-region replication for all buckets

Answer

Set up an S3 Lifecycle policy to transition objects to Glacier

Answer

Enable S3 Versioning on all buckets

Question 7

A company is using AWS KMS to encrypt data in Amazon S3. The security team wants to ensure that only specific IAM roles can decrypt the data. Which THREE steps should the data engineer take? (Choose three.)

Accepted Answer

Create a customer-managed KMS key with a key policy that grants kms:Decrypt only to the allowed IAM roles. To restrict decryption to specific roles, you need to create a customer-managed key, configure the key policy to allow only those roles to use kms:Decrypt, and use SSE-KMS when writing objects. Using the default KMS key does not allow custom policies. SSE-S3 uses different keys. Requiring MFA for API calls does not restrict decryption to specific roles.

Answer

Use the default AWS managed KMS key for S3 (aws/s3)

Answer

Use SSE-S3 encryption instead of KMS

Answer

Add an IAM policy to the role that requires MFA for kms:Decrypt

Question 8

A company needs to audit access to their Amazon S3 buckets. Which TWO services can be used together to achieve this? (Choose two.)

Accepted Answer

Amazon CloudWatch Logs. CloudTrail records S3 API calls, and CloudWatch Logs can be used to store and monitor those logs. Config records configuration changes, not data access. S3 server access logs record object-level access, but the question asks for auditing access; CloudTrail with CloudWatch Logs is a common solution. S3 Inventory provides metadata, not access logs.

Answer

Amazon Macie

Answer

Amazon S3 Inventory

Answer

AWS Config

Question 9

Refer to the exhibit. A data engineer has attached this KMS key policy to a customer-managed key. The policy is intended to allow the DataEngineer role to decrypt objects in S3 only when the request comes through S3. However, the role is unable to decrypt objects stored in an S3 bucket in the us-west-2 region. What is the most likely cause?

Accepted Answer

The condition restricts the permission to the us-east-1 region only. The condition in the policy restricts the permission to requests coming through S3 in us-east-1 only (s3.us-east-1.amazonaws.com). For buckets in us-west-2, the viaService would be s3.us-west-2.amazonaws.com, so the condition fails. The key policy does not allow decrypt from other services, but the issue is region mismatch.

Answer

The key policy does not allow the role to use GenerateDataKey

Answer

The role does not have an IAM policy that allows kms:Decrypt

Answer

The role does not have permission to decrypt from S3

Question 10

Refer to the exhibit. A data engineer runs the above command and sees that the DataLakeAdmin role has the AmazonS3FullAccess and AWSLakeFormationDataAdmin policies attached. The engineer wants to ensure that the role can only access S3 data through Lake Formation. What should the engineer do?

Accepted Answer

Detach the AmazonS3FullAccess policy from the role. To enforce that access is only through Lake Formation, the engineer should detach the AmazonS3FullAccess policy because it allows direct S3 access, bypassing Lake Formation. The LakeFormationAdmin policy is needed for Lake Formation administration. Changing the S3 bucket policy to deny all access except from Lake Formation is not straightforward because Lake Formation uses the principal's IAM role. Creating a new policy that denies S3 access would be redundant if the full access policy is removed.

Answer

Create a new IAM policy that explicitly denies s3:GetObject and attach it to the role

Answer

Detach the AWSLakeFormationDataAdmin policy from the role

Answer

Modify the S3 bucket policy to deny all access except from Lake Formation

Question 11

Refer to the exhibit. A data engineer checks the versioning status of an S3 bucket and sees the above output. The bucket contains critical logs that must not be permanently deleted. What should the engineer do to enhance protection against accidental or malicious deletion?

Accepted Answer

Enable MFA Delete on the bucket. Enabling MFA Delete on the bucket requires multi-factor authentication to delete object versions, which adds protection. Versioning is already enabled, so that is not needed. Enabling Object Lock with retention mode is another option, but the question asks for enhancement using the current setup; MFA Delete is a direct enhancement. A lifecycle policy does not prevent deletion. Cross-region replication is for disaster recovery, not deletion protection.

Answer

Enable versioning on the bucket

Answer

Enable cross-region replication

Answer

Configure a lifecycle policy to expire noncurrent versions

Question 12

A company uses AWS KMS to encrypt data at rest in Amazon S3. The security team requires that all encryption keys be automatically rotated every year. Which key type should be used to meet this requirement without manual intervention?

Accepted Answer

Use an AWS managed key (aws/s3).. AWS managed keys (AWS_KMS) are automatically rotated annually. Customer managed keys (CMK) support automatic rotation but require manual enablement; however, the question specifies 'without manual intervention'. AWS managed keys are rotated automatically every year. Option A is wrong because customer managed keys require manual enablement of rotation. Option B is wrong because imported key material cannot be rotated. Option C is correct as described. Option D is wrong because KMS does not generate keys on demand for S3; S3 uses a bucket key or CMK.

Answer

Use a customer managed key with automatic rotation enabled.

Answer

Use an imported key material because it supports automatic rotation.

Answer

Use a KMS key generated by S3 on each object upload.

Question 13

A data engineer needs to grant an IAM role read-only access to Amazon DynamoDB tables in a specific AWS account. Which IAM policy element should be used to restrict access to only the 'GetItem' and 'Query' actions?

Accepted Answer

Action. The 'Action' element specifies the allowed API actions. 'Effect' is 'Allow' or 'Deny'. 'Resource' specifies the ARN. 'Condition' adds conditions. So Action is correct.

Answer

Resource

Answer

Effect

Answer

Condition

Question 14

A company stores sensitive customer data in an Amazon S3 bucket with versioning enabled. A data engineer accidentally deleted the current version of an object. What is the quickest way to restore the object to its previous state without additional data transfer costs?

Accepted Answer

Delete the delete marker that was created by the deletion.. With versioning enabled, deleted objects become delete markers. To restore, you delete the delete marker, which makes the previous version current again. Option A is correct. Option B costs data transfer. Option C restores to a different bucket. Option D is not a valid operation.

Answer

Use S3 Batch Operations to restore the object from the Recycle Bin.

Answer

Copy the previous version from the bucket to itself.

Answer

Use the S3 sync command to restore the previous version.

Question 15

A data engineer is configuring an Amazon Redshift cluster to encrypt data at rest. The company policy requires that encryption keys be stored in AWS CloudHSM. Which integration should the engineer use to meet this requirement?

Accepted Answer

Configure Redshift to use an HSM for encryption.. Amazon Redshift supports AWS CloudHSM for encryption key management. The integration is done via the Hardware Security Module (HSM) integration. Option A is correct. Option B is for KMS. Option C is for database encryption, not key storage. Option D is for key rotation.

Answer

Use AWS KMS with a customer managed key.

Answer

Enable encryption using the AWS Redshift SSL/TLS feature.

Answer

Use Redshift automatic key rotation.