DEA-C01 Data Security and Governance Practice Test 19 — 15 Questions

Question 1

A data engineer is designing a solution to securely store and rotate database credentials used by an application. The credentials should be automatically rotated every 90 days. Which AWS service should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is designed specifically for storing, managing, and automatically rotating secrets such as database credentials. It natively supports rotation schedules (e.g., every 90 days) using Lambda rotation functions, and integrates with RDS, Redshift, and DocumentDB for managed rotation. This directly meets the requirement for automatic rotation every 90 days.

Answer

AWS Systems Manager Parameter Store

Answer

AWS Key Management Service (KMS)

Answer

AWS Identity and Access Management (IAM)

Question 2

Which TWO actions should a data engineer take to protect sensitive data in an Amazon S3 bucket from being accessed by unauthorized users? (Select TWO.)

Accepted Answer

Add a bucket policy with a Deny effect for unauthorized principals. Option C is correct because an S3 bucket policy with an explicit Deny effect overrides any Allow in IAM or bucket policies, so it reliably blocks the specified unauthorized principals from accessing the sensitive objects. Option E is correct because S3 Block Public Access settings prevent public ACLs and public bucket policies from exposing the bucket, closing off the most common accidental data-exposure path. Options A, B, and D do not restrict access: a VPC endpoint only controls how traffic reaches S3 (not who is authorized), server access logging only records requests after they occur, and CloudTrail only provides audit logging of API activity rather than preventing unauthorized access.

Answer

Create a VPC endpoint for S3

Answer

Enable S3 server access logging

Answer

Enable AWS CloudTrail for the bucket

Question 3

Which THREE AWS services can be used to centrally manage and govern data across multiple AWS accounts? (Select THREE.)

Accepted Answer

AWS Control Tower. AWS Control Tower (B) is correct because it provides a centralized landing zone with guardrails and account provisioning that enforces governance and data management policies across multiple AWS accounts. AWS Organizations (C) is correct because it enables central management of multiple accounts through organizational units, service control policies (SCPs), and consolidated billing, which are foundational for cross-account governance. AWS Lake Formation (E) is correct because it centrally manages data lake permissions, cataloging, and fine-grained access control across accounts using AWS RAM resource shares and the Glue Data Catalog. Amazon S3 (A) is incorrect because it is an object storage service, not a cross-account governance or central management service, even though it can host data governed by other services. Amazon Redshift (D) is incorrect because it is a data warehouse service for analytics, not a service for centrally managing and governing data across multiple accounts.

Answer

Amazon S3

Answer

Amazon Redshift

Question 4

A data engineer runs the command shown to check the encryption configuration of an S3 bucket. The output shows SSEAlgorithm: AES256. What does this mean?

Accepted Answer

The bucket uses SSE-S3 with Amazon S3-managed keys. AES256 refers to SSE-S3, where Amazon S3 manages the encryption keys using AES-256. Option B (SSE-KMS) would show 'aws:kms'. Option C (SSE-C) would require the customer to provide keys. Option D (no encryption) is incorrect because encryption is enabled.

Answer

The bucket uses SSE-KMS with a customer-managed key

Answer

The bucket uses SSE-C with customer-provided keys

Answer

The bucket does not have encryption enabled

Question 5

A data engineer needs to restrict access to an Amazon S3 bucket so that only objects encrypted with a specific AWS KMS key can be uploaded. Which S3 bucket policy condition should be used?

Accepted Answer

s3:x-amz-server-side-encryption-aws-kms-key-id. The correct condition is s3:x-amz-server-side-encryption-aws-kms-key-id (option A). This condition key allows you to require that objects uploaded to the S3 bucket are encrypted with a specific AWS KMS key by checking the key ID used in the encryption header. Option B (kms:ViaService) restricts KMS key usage to specific AWS services but does not enforce a key ID on S3 objects. Option C (s3:x-amz-server-side-encryption) only checks whether server-side encryption is enabled, not the specific key. Option D (kms:EncryptionContext) is used to enforce encryption context, not the key ID.

Answer

kms:ViaService

Answer

s3:x-amz-server-side-encryption

Answer

kms:EncryptionContext

Question 6

A company wants to audit all changes to IAM policies in their AWS account. Which combination of services should be used to achieve this?

Accepted Answer

AWS CloudTrail and Amazon CloudWatch Logs. AWS CloudTrail records all API calls, including IAM policy changes, and can deliver logs to Amazon CloudWatch Logs for monitoring and alerting. This combination provides a comprehensive audit trail and real-time analysis capability.

Answer

AWS Config and Amazon SNS

Answer

Amazon CloudWatch Logs and Amazon SNS

Answer

AWS CloudTrail and Amazon DynamoDB

Question 7

A data engineer needs to allow an IAM user to rotate the secret in AWS Secrets Manager for an RDS database. Which IAM action should be included in the policy?

Accepted Answer

secretsmanager:RotateSecret. The secretsmanager:RotateSecret action allows the user to initiate rotation of a secret. Option A is correct. secretsmanager:GetSecretValue only retrieves the secret value, not rotate it.

Answer

secretsmanager:PutSecretValue

Answer

secretsmanager:UpdateSecret

Answer

secretsmanager:GetSecretValue

Question 8

A company wants to ensure that all S3 buckets are encrypted using server-side encryption. Which AWS service can be used to automatically remediate non-compliant buckets?

Accepted Answer

AWS Config. AWS Config can use managed rules like s3-bucket-server-side-encryption-enabled to check compliance and trigger auto-remediation via SSM Automation or Lambda. Option D is correct.

Answer

AWS CloudTrail

Answer

Amazon Inspector

Answer

AWS Trusted Advisor

Question 9

A company needs to centralize audit logs from multiple AWS accounts into a single S3 bucket. Which service should be used to aggregate these logs?

Accepted Answer

AWS CloudTrail. AWS CloudTrail can be configured to deliver logs from multiple accounts to a single S3 bucket using a trail in the management account. Option C is correct.

Answer

AWS Config

Answer

Amazon Kinesis Data Firehose

Answer

Amazon CloudWatch Logs

Question 10

A company uses AWS Glue to process sensitive customer data stored in S3. The security team requires that all data be encrypted at rest using a customer-managed KMS key and that access to the key be auditable. Which solution meets these requirements?

Accepted Answer

Configure the S3 bucket to use SSE-KMS with a customer-managed KMS key and enable CloudTrail for KMS events.. SSE-KMS with a customer-managed KMS key provides encryption at rest and, when combined with CloudTrail logging for KMS events, offers full auditability of key usage. Option A (client-side encryption) does not encrypt data at rest within S3; it encrypts before upload. Option C (SSE-S3) uses AWS-managed keys, which do not allow customer audit of key access. Option D (SSE-C) relies on customer-provided keys that are not managed by KMS and cannot be audited via CloudTrail.

Answer

Encrypt the data client-side before uploading to S3.

Answer

Enable default SSE-S3 encryption on the S3 bucket.

Answer

Use SSE-C with a customer-provided key.

Question 11

A data engineer needs to share a dataset from an S3 bucket in Account A with users in Account B. The dataset must remain encrypted at rest with an S3-managed key. What is the MOST secure way to grant cross-account access?

Accepted Answer

Create a bucket policy that grants cross-account access to an IAM role in Account B.. A bucket policy granting access to the IAM role in Account B is the recommended secure method for cross-account access to S3 objects encrypted with S3-managed keys. Option A is insecure because it grants public access. Option C is incorrect because ACLs are legacy and less secure for cross-account scenarios. Option D is incorrect because while S3 VPC endpoints are a valid AWS feature that provides private connectivity to S3, they do not grant cross-account access; bucket policies are still required to authorize access.

Answer

Make the bucket public and use bucket policies to allow only Account B users.

Answer

Use S3 object ACLs to grant access to Account B's root user.

Answer

Use an S3 VPC endpoint to allow Account B users through private IPs.

Question 12

A data engineer is designing a data lake on S3 with sensitive data. The security policy mandates that data must be encrypted at rest and in transit, and that an inventory of all objects must be maintained for compliance. Which actions should be taken?

Accepted Answer

Enforce HTTPS via bucket policy, enable default SSE-S3 encryption, and enable S3 Inventory.. It covers all requirements: encryption in transit (HTTPS enforcement via bucket policy), encryption at rest (default SSE-S3), and compliance inventory (S3 Inventory). Option B uses SSE-KMS which is not required and lacks inventory. Option C includes at-rest encryption and inventory but misses in-transit encryption. Option D includes in-transit encryption but lacks at-rest encryption and compliance inventory.

Answer

Use SSE-KMS encryption and enable CloudTrail for S3 events.

Answer

Enable S3 default encryption using SSE-S3 and enable S3 Inventory.

Answer

Enforce HTTPS using bucket policy and enable S3 Server Access Logging.

Question 13

A company has an AWS Glue ETL job that reads from an RDS MySQL instance and writes to S3. The security team requires that the connection to RDS be encrypted and that credentials be rotated automatically. Which configuration should be used?

Accepted Answer

Store the password in AWS Secrets Manager with automatic rotation enabled and configure Glue to use SSL for the connection.. AWS Secrets Manager provides automatic rotation of RDS credentials, and AWS Glue can be configured to use SSL for an encrypted connection to RDS MySQL. Option A (Systems Manager Parameter Store) stores encrypted parameters but does not natively support automatic rotation of RDS credentials. Option B (IAM database authentication) provides authentication but does not encrypt the connection itself; SSL is still required for encryption. Option C (encrypted S3 bucket) is not a service designed for dynamic credential management and lacks automatic rotation.

Answer

Store the database password in an encrypted parameter in Systems Manager Parameter Store and enable SSL for the connection.

Answer

Use IAM database authentication for RDS and store credentials in Glue connection properties.

Answer

Store the password in a text file in an encrypted S3 bucket and use SSL.

Question 14

A data engineer needs to ensure that an S3 bucket can only be accessed from a specific VPC. Which policy element should be used?

Accepted Answer

Use the condition key aws:SourceVpc in the bucket policy.. The condition key aws:SourceVpc restricts requests to originate from a specific VPC. Option C (aws:SourceVpce) limits access to a VPC endpoint, not the VPC itself. Option B (aws:SourceIp) restricts by IP address, not VPC. Option A (aws:VpcSourceIp) is not a valid condition key.

Answer

Use the condition key aws:VpcSourceIp in the bucket policy.

Answer

Use the condition key aws:SourceIp in the bucket policy.

Answer

Use the condition key aws:SourceVpce in the bucket policy.

Question 15

A data engineer is designing a data pipeline that processes PII data using AWS Glue and stores results in S3. Which TWO actions should be taken to protect the data? (Choose 2)

Accepted Answer

Store database credentials in AWS Secrets Manager and reference them in Glue connections.. Option B is correct because storing database credentials in AWS Secrets Manager and referencing them from Glue connections avoids hardcoding secrets in scripts or job parameters, enabling secure, auditable, and rotatable credential management for PII pipelines. Option D is correct because configuring AWS Glue to use a customer-managed KMS key for encrypting data written to S3 provides encryption at rest with control over key policies, rotation, and access auditing, which is appropriate for sensitive PII. Option A is not the best choice because SSE-S3 uses AWS-managed keys with less control and auditability than a KMS key, and the question asks for protective actions beyond default encryption. Option C is incorrect because S3 object deletion protection via retention policies (Object Lock) addresses immutability/deletion, not the confidentiality of PII data being processed. Option E is not selected because HTTPS protects data in transit, but Glue-to-S3 traffic within AWS is already encrypted in transit by default, so it is not one of the two required protective actions for this scenario.

Answer

Use S3 default encryption with SSE-S3 for the output bucket.

Answer

Enable S3 object deletion protection by setting a retention policy.

Answer

Use HTTPS for all data transfer between Glue and S3.