DEA-C01 Data Security and Governance Practice Test 19 — 15 Questions

Question 1

A company is using an Amazon RDS for PostgreSQL database to store personally identifiable information (PII). The security team wants to ensure that database administrators cannot view the plaintext PII data. Which solution should a data engineer implement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use client-side encryption with AWS KMS to encrypt PII before inserting into the database. Using AWS KMS with client-side encryption ensures that data is encrypted before being sent to RDS, so database administrators cannot read the plaintext. Dynamic data masking in RDS is not natively supported; application-level masking would be needed. RDS encryption at rest protects data on disk but DBAs with access can still query plaintext. Using IAM policies to restrict access does not prevent DBAs with database credentials from viewing data.

Answer

Use IAM policies to restrict DBA access to the RDS instance

Answer

Enable Dynamic Data Masking in RDS to obfuscate PII for all users

Answer

Enable encryption at rest for the RDS instance using AWS KMS

Question 2

A company wants to audit all changes to IAM policies in their AWS account. Which AWS service should be used to record these changes for compliance purposes?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records API calls, including IAM policy changes. AWS Config records resource configurations but not all API calls. CloudWatch Logs can store logs but does not record API calls itself. S3 is the destination for logs, not the recording service.

Answer

Amazon CloudWatch Logs

Answer

AWS Config

Answer

Amazon S3

Question 3

A data engineer is configuring an S3 bucket policy to allow cross-account access for a partner account to read objects. The bucket is encrypted with SSE-KMS using a customer-managed key. What additional configuration is needed to allow the partner account to decrypt the objects?

Accepted Answer

Update the KMS key policy to grant the partner account kms:Decrypt permission. For cross-account access with SSE-KMS, the KMS key policy must grant the partner account access to use the key. The bucket policy alone is insufficient. The partner account does not need VPC endpoints, and the bucket policy for decryption is not needed. The partner account does not need access to the S3 bucket's encryption configuration.

Answer

Add a bucket policy that grants the partner account s3:GetObject

Answer

Create a VPC endpoint for S3 and add it to the bucket policy

Answer

Add a bucket policy that grants s3:GetObject and s3:GetEncryptionConfiguration

Question 4

A company uses AWS Lake Formation to manage data lake permissions. The data engineer notices that a user with SELECT permission on a table can also query the underlying data in Amazon S3 directly. How can the engineer enforce that access to the S3 data is only through Lake Formation?

Accepted Answer

Grant the user permissions only through Lake Formation and remove any IAM policies that allow direct S3 access to the data location. When using Lake Formation, you should grant permissions only through Lake Formation and remove any IAM policies that allow direct S3 access. This ensures that users cannot bypass Lake Formation's fine-grained access controls. Option A (S3 Access Points) can restrict access but does not inherently enforce Lake Formation-only access unless properly configured with a policy that specifically allows only Lake Formation, which is more complex and not the recommended approach. Option C (S3 Block Public Access) only prevents public access but does not prevent authorized IAM users from direct access. Option D (bucket policy denying all except Lake Formation) could work but is not the simplest or most standard method; the recommended practice is to use Lake Formation's integration and manage permissions centrally.

Answer

Use S3 Access Points with a policy that restricts access to only Lake Formation

Answer

Enable S3 Block Public Access on the bucket

Answer

Change the S3 bucket policy to deny all access except from Lake Formation

Question 5

A company wants to securely store database credentials used by a Lambda function. Which AWS service should be used to store and rotate the credentials automatically?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is designed for storing secrets and provides automatic rotation. Systems Manager Parameter Store can store secrets but does not natively support automatic rotation for database credentials. KMS is for encryption keys, not storing secrets. CloudHSM is for hardware security modules.

Answer

AWS CloudHSM

Answer

AWS Key Management Service (KMS)

Answer

AWS Systems Manager Parameter Store

Question 6

A company is using Amazon Redshift for analytics and needs to ensure that all data is encrypted at rest. The current cluster does not have encryption enabled. What is the most efficient way to enable encryption?

Accepted Answer

Create a snapshot of the cluster and restore it to a new cluster with encryption enabled. Redshift does not support enabling encryption on an existing cluster; a new encrypted cluster must be created and data migrated. Modifying the cluster configuration or parameter groups does not enable encryption. Creating a snapshot and restoring it to a new cluster with encryption enabled is the standard approach.

Answer

Change the cluster parameter group to enable encryption

Answer

Modify the cluster configuration to enable encryption

Answer

Use AWS DMS to migrate data to a new encrypted cluster

Question 7

A data engineer needs to grant a data scientist access to query a Glue Data Catalog database but must prevent the data scientist from seeing the underlying S3 data locations. Which approach should be used?

Accepted Answer

Use AWS Lake Formation to grant SELECT permission on the database and tables without granting S3 access. Lake Formation can be used to grant SELECT permission on the database and tables, and by using column-level and row-level filters, but to hide S3 locations, the data scientist should not have direct S3 access. Lake Formation does not require the user to see the S3 path. Granting IAM read-only access to S3 would expose locations. Using a VPC endpoint does not hide locations. Glue resource policies cannot hide S3 locations.

Answer

Use a Glue resource policy to restrict access to the database

Answer

Grant the data scientist IAM permissions to access the Glue Data Catalog and the underlying S3 data

Answer

Create a VPC endpoint for Glue and S3 to restrict network access

Question 8

A company has an S3 bucket that stores logs for compliance. The compliance team requires that objects are retained for 7 years and cannot be deleted or overwritten. Which S3 feature should be used?

Accepted Answer

Enable S3 Object Lock with retention mode COMPLIANCE and a retention period of 7 years. S3 Object Lock with retention mode COMPLIANCE prevents objects from being deleted or overwritten for the specified retention period. Versioning alone does not prevent deletion. MFA Delete prevents accidental deletion but not overwrite. Lifecycle policies can expire objects but do not prevent deletion.

Answer

Enable MFA Delete on the bucket

Answer

Configure an S3 bucket policy that denies delete and overwrite actions

Answer

Enable S3 Versioning and configure a lifecycle policy to expire objects after 7 years

Question 9

A company needs to protect sensitive data stored in Amazon S3 from unauthorized access. Which TWO actions should the data engineer take? (Choose two.)

Accepted Answer

Configure S3 bucket policies to require MFA for delete operations. S3 Block Public Access at the account level prevents any public access to S3 buckets, ensuring data is not exposed. Requiring MFA for delete operations via bucket policies adds an extra layer of security by requiring a second factor. Cross-region replication is for disaster recovery, not security. Lifecycle policies manage storage costs. Versioning protects against accidental deletion but does not prevent unauthorized access.

Answer

Enable cross-region replication for all buckets

Answer

Set up an S3 Lifecycle policy to transition objects to Glacier

Answer

Enable S3 Versioning on all buckets

Question 10

A company is using AWS KMS to encrypt data in Amazon S3. The security team wants to ensure that only specific IAM roles can decrypt the data. Which TWO steps should the data engineer take? (Choose two.)

Accepted Answer

Create a customer-managed KMS key with a key policy that grants kms:Decrypt only to the allowed IAM roles. To ensure only specific IAM roles can decrypt data in S3 using KMS, you must create a customer-managed KMS key with a key policy that grants kms:Decrypt only to those roles (C). Then, configure the S3 bucket to use SSE-KMS with that key (E). This restricts decryption to only the allowed roles because the key policy explicitly controls access. Option A uses the default AWS managed key which cannot be restricted to specific roles. Option B (SSE-S3) does not use KMS and hence cannot provide role-based decryption control. Option D, requiring MFA for decryption, adds an extra authentication factor but does not by itself restrict which roles can decrypt; it only strengthens the security of the roles that already have permission. Therefore, D is not a step to ensure only specific roles can decrypt.

Answer

Use the default AWS managed KMS key for S3 (aws/s3)

Answer

Use SSE-S3 encryption instead of KMS

Answer

Add an IAM policy to the role that requires MFA for kms:Decrypt

Question 11

A company needs to audit access to their Amazon S3 buckets. Which TWO services can be used together to achieve this? (Choose two.)

Accepted Answer

Amazon CloudWatch Logs. CloudTrail records S3 API calls, and CloudWatch Logs can be used to store and monitor those logs. Config records configuration changes, not data access. S3 server access logs record object-level access, but the question asks for auditing access; CloudTrail with CloudWatch Logs is a common solution. S3 Inventory provides metadata, not access logs.

Answer

Amazon Macie

Answer

Amazon S3 Inventory

Answer

AWS Config

Question 12

Refer to the exhibit. A data engineer has attached this KMS key policy to a customer-managed key. The policy is intended to allow the DataEngineer role to decrypt objects in S3 only when the request comes through S3. However, the role is unable to decrypt objects stored in an S3 bucket in the us-west-2 region. What is the most likely cause?

Accepted Answer

The condition restricts the permission to the us-east-1 region only. The condition in the policy restricts the permission to requests coming through S3 in us-east-1 only (s3.us-east-1.amazonaws.com). For buckets in us-west-2, the viaService would be s3.us-west-2.amazonaws.com, so the condition fails. The key policy does not allow decrypt from other services, but the issue is region mismatch.

Answer

The key policy does not allow the role to use GenerateDataKey

Answer

The role does not have an IAM policy that allows kms:Decrypt

Answer

The role does not have permission to decrypt from S3

Question 13

Refer to the exhibit. A data engineer runs the above command and sees that the DataLakeAdmin role has the AmazonS3FullAccess and AWSLakeFormationDataAdmin policies attached. The engineer wants to ensure that the role can only access S3 data through Lake Formation. What should the engineer do?

Accepted Answer

Detach the AmazonS3FullAccess policy from the role. To enforce that access is only through Lake Formation, the engineer should detach the AmazonS3FullAccess policy because it allows direct S3 access, bypassing Lake Formation. The LakeFormationAdmin policy is needed for Lake Formation administration. Changing the S3 bucket policy to deny all access except from Lake Formation is not straightforward because Lake Formation uses the principal's IAM role. Creating a new policy that denies S3 access would be redundant if the full access policy is removed.

Answer

Create a new IAM policy that explicitly denies s3:GetObject and attach it to the role

Answer

Detach the AWSLakeFormationDataAdmin policy from the role

Answer

Modify the S3 bucket policy to deny all access except from Lake Formation

Question 14

Refer to the exhibit. A data engineer checks the versioning status of an S3 bucket and sees the above output. The bucket contains critical logs that must not be permanently deleted. What should the engineer do to enhance protection against accidental or malicious deletion?

Accepted Answer

Enable MFA Delete on the bucket. Enabling MFA Delete on the bucket requires multi-factor authentication to delete object versions, which adds protection. Versioning is already enabled, so that is not needed. Enabling Object Lock with retention mode is another option, but the question asks for enhancement using the current setup; MFA Delete is a direct enhancement. A lifecycle policy does not prevent deletion. Cross-region replication is for disaster recovery, not deletion protection.

Answer

Enable versioning on the bucket

Answer

Enable cross-region replication

Answer

Configure a lifecycle policy to expire noncurrent versions

Question 15

A company uses AWS KMS to encrypt data at rest in Amazon S3. The security team requires that all encryption keys be automatically rotated every year. Which key type should be used to meet this requirement without manual intervention?

Accepted Answer

Use a customer managed key with automatic rotation enabled.. AWS customer managed keys (CMKs) with automatic rotation enabled rotate every year, meeting the requirement of annual rotation. While enabling automatic rotation requires a one-time manual configuration, after that no further manual intervention is needed, and the rotation occurs automatically. AWS managed keys (aws/s3) rotate automatically every three years, not annually, so they do not satisfy the yearly rotation requirement. Imported key material cannot be rotated, and S3 does not generate a KMS key per upload. Therefore, option A is correct.

Answer

Use an imported key material because it supports automatic rotation.

Answer

Use a KMS key generated by S3 on each object upload.

Answer

Use an AWS managed key (aws/s3).