DEA-C01 Data Security and Governance Practice Test 2 — 15 Questions

Question 1

A healthcare company uses AWS Glue to process patient data stored in Amazon S3. The data is encrypted at rest using SSE-KMS with a customer managed key. The Glue ETL job runs on a schedule and reads from an S3 bucket, transforms the data, and writes to another S3 bucket also encrypted with the same KMS key. Recently, the security team rotated the KMS key. After the rotation, the Glue job started failing with 'AccessDenied' errors when trying to read from the source bucket. The Glue job's IAM role has permissions to use the KMS key (kms:Decrypt, kms:GenerateDataKey). The S3 bucket policies allow the role to read/write. What is the MOST likely cause of the failure?

Accepted Answer

The KMS key rotation created a new backing key, but the Glue job's IAM role does not have permission to decrypt with the old backing key.. When you rotate a customer managed KMS key, AWS KMS retains the old backing key to allow decryption of data encrypted before the rotation. However, the Glue job's IAM role must have permission to use the old backing key via the kms:Decrypt action. If the key policy or IAM policy does not explicitly allow decryption with the old backing key (or if the key policy was inadvertently updated to remove access to the old key material), the Glue job will fail with AccessDenied when reading SSE-KMS encrypted objects that were encrypted with the previous key version.

Answer

The Glue job's IAM role is missing the kms:Encrypt permission on the KMS key.

Answer

The Glue job is using the wrong encryption context when calling KMS.

Answer

The S3 bucket policy has a condition that requires the request to use the latest version of the KMS key.

Question 2

A data engineer is configuring a data lake on Amazon S3 that contains sensitive customer information. The company requires that all access to this data be logged and monitored, and that any data shared with external partners must be anonymized before leaving the S3 bucket. Which combination of AWS services should the engineer use to meet these requirements? (Choose THREE.)

Accepted Answer

AWS Lake Formation. AWS Lake Formation (B) is correct because it provides fine-grained access control and data anonymization capabilities for data lakes on Amazon S3. It allows you to define column-level and row-level security policies, and can automatically anonymize sensitive data (e.g., via masking or tokenization) before it is shared with external partners, ensuring compliance with data governance requirements.

Answer

AWS WAF

Answer

AWS Direct Connect

Question 3

Refer to the exhibit. A data engineer applies this bucket policy to an S3 bucket named my-data-bucket. The bucket contains sensitive data. The company's security team reports that data was accessed from an IP address outside the allowed range. What is the MOST likely reason that the policy failed to block the unauthorized access?

Accepted Answer

The Deny statement does not restrict access based on IP address; it only denies non-HTTPS requests.. Option C is correct because the Deny statement in the policy only denies requests that are not using HTTPS (SecureTransport: false). It does not include any condition to restrict access based on IP address. Therefore, a request made from an IP outside the allowed range but using HTTPS would not be denied by this policy, allowing unauthorized access to the sensitive data.

Answer

The Deny statement's condition on SecureTransport overrides the IP condition.

Answer

The policy has a syntax error in the Condition element.

Answer

The bucket policy does not apply to requests made from within the same AWS account.

Question 4

A financial services company uses AWS Glue ETL jobs to process credit card transaction data stored in Amazon S3. The data includes PII such as names and credit card numbers. The security team requires that all PII be masked before the data is written to the curated zone of the data lake. The data engineer has implemented a Glue job that reads from the raw zone, applies a custom transform to mask credit card numbers using a regular expression, and writes to the curated zone. However, during a recent audit, the security team discovered that some masked data still contained partial credit card numbers (e.g., showing the last four digits) when viewed by analysts who should only see masked data. The company's policy is that credit card numbers must be completely masked, showing only asterisks or a fixed string like "XXXX-XXXX-XXXX-XXXX". The Glue job uses a DynamicFrame and applies a Map transform with a Python function that replaces digits with 'X'. The data is stored in Parquet format. What should the data engineer do to ensure complete masking of credit card numbers?

Accepted Answer

Replace the custom Python Map transform with a built-in Glue Transform for data masking, such as the Mask transform available in Glue Studio.. Option C is correct because AWS Glue provides a built-in Mask transform that can be applied directly in Glue Studio or via the AWS Glue API. This transform is designed to reliably obfuscate sensitive data like credit card numbers by replacing them with a fixed string (e.g., 'XXXX-XXXX-XXXX-XXXX') or asterisks, ensuring complete masking regardless of input format. The custom Python Map transform in the current implementation is error-prone because it relies on a regular expression that may not catch all patterns or partial digits, whereas the Mask transform uses predefined logic to guarantee full masking.

Answer

Use an AWS Glue crawler to classify the data and apply a masking rule based on the classification.

Answer

Enable server-side encryption with AWS KMS on the curated S3 bucket.

Answer

Change the output format from Parquet to CSV and use a different write mode.

Question 5

Order the steps to migrate an on-premises database to Amazon RDS using AWS DMS.

Question 6

Arrange the steps to implement data encryption at rest for an Amazon Redshift cluster using AWS KMS.

Question 7

Match each AWS storage class to its description.

Question 8

Match each AWS networking concept to its definition.

Question 9

A data engineer is configuring S3 bucket policies to restrict access to a specific VPC. Which condition key should be used in the bucket policy to enforce that requests originate only from the desired VPC?

Accepted Answer

aws:SourceVpc. Option C is correct because aws:SourceVpc is the condition key used to restrict access to a specific VPC. Option A is wrong because aws:SourceIp is for IP addresses. Option B is wrong because aws:VpcSourceIp is not a valid key. Option D is wrong because aws:RequestedRegion is for region restriction.

Answer

aws:VpcSourceIp

Answer

aws:RequestedRegion

Answer

aws:SourceIp

Question 10

A company uses AWS KMS to encrypt sensitive data stored in S3. To meet compliance requirements, they need to ensure that the encryption keys are automatically rotated every year. Which type of KMS key should they use?

Accepted Answer

Customer managed key with automatic rotation enabled. Option A is correct because AWS managed keys with automatic rotation are rotated annually. Option B is wrong because customer managed keys can have automatic rotation but it is not mandatory. Option C is wrong because custom key stores do not support automatic rotation. Option D is wrong because AWS managed keys are not created by the customer.

Answer

Customer managed key with manual rotation

Answer

AWS managed key

Answer

Custom key store (CloudHSM) key

Question 11

A data engineer needs to audit data access events in Amazon S3. Which AWS service should be used to record and monitor API calls for S3 buckets?

Accepted Answer

AWS CloudTrail. Option D is correct because AWS CloudTrail records API calls for auditing. Option A is wrong because Amazon GuardDuty is a threat detection service. Option B is wrong because AWS Config tracks resource configuration changes. Option C is wrong because Amazon Macie discovers sensitive data.

Answer

AWS Config

Answer

Amazon Macie

Answer

Amazon GuardDuty

Question 12

A team is designing a data lake on S3 and needs to enforce encryption at rest. They want to use server-side encryption with a KMS key that they manage. Which encryption option should they configure on the S3 bucket?

Accepted Answer

SSE-KMS. SSE-KMS is the correct choice because it provides server-side encryption using a customer-managed KMS key. This allows the team to enforce encryption at rest with their own key, giving them control over key rotation, access policies, and audit trails via AWS CloudTrail, which aligns with the requirement to manage the encryption key themselves.

Answer

Client-side encryption

Answer

SSE-S3

Answer

SSE-C

Question 13

A company stores sensitive data in S3 and uses VPC endpoints to access the bucket. They need to ensure that only traffic from their VPC can access the data, and that the traffic cannot leave the AWS network. Which combination of bucket policy and endpoint policy should they use?

Accepted Answer

Use an S3 VPC Gateway endpoint and add a bucket policy with aws:SourceVpc condition. Option A is correct because using an S3 VPC Gateway endpoint and a bucket policy with aws:SourceVpc condition restricts traffic to the VPC and keeps it within AWS network. Option B is wrong because Interface endpoints still use public internet. Option C is wrong because bucket policies alone cannot restrict to VPC. Option D is wrong because aws:SourceIp does not restrict to VPC.

Answer

Use only a bucket policy with aws:SourceIp condition

Answer

Use an S3 VPC Interface endpoint and add a bucket policy with aws:SourceVpce condition

Answer

Use an S3 VPC Gateway endpoint with no bucket policy

Question 14

A data engineer needs to ensure that an S3 bucket is not publicly accessible. Which S3 block public access setting should be applied to achieve this?

Accepted Answer

BlockPublicAcls (both new and existing). Option B is correct because BlockPublicAcls prevents public ACLs on the bucket. Option A is wrong because it only applies to new ACLs. Option C is wrong because it blocks public bucket policies. Option D is wrong because it blocks public cross-account access. The combination of all four is recommended, but the question asks for a single setting.

Answer

IgnorePublicAcls

Answer

BlockPublicAcls (new ACLs)

Answer

BlockPublicPolicy

Question 15

A company wants to grant cross-account access to an S3 bucket without using IAM roles. The data engineer needs to write a bucket policy that allows another AWS account to list objects. Which Principal should be specified in the bucket policy?

Accepted Answer

The AWS account ID of the other account. Option D is correct because the Principal should be the AWS account ID of the other account. Option A is wrong because a specific IAM user ARN would grant access only to that user. Option B is wrong because the root user is not best practice. Option C is wrong because the bucket policy is on the resource side.

Answer

The AWS account ID that owns the bucket

Answer

The IAM user ARN in the other account

Answer

The root user of the other account