DEA-C01 Data Security and Governance Practice Test 2 — 15 Questions

Question 1

A data engineer needs to ensure that an S3 bucket is not publicly accessible. Which S3 block public access setting should be applied to achieve this?

Accepted Answer

BlockPublicPolicy. The S3 Block Public Access feature includes four settings: BlockPublicAcls, IgnorePublicAcls, BlockPublicPolicy, and RestrictPublicBuckets. To prevent a bucket from being publicly accessible via bucket policies, BlockPublicPolicy must be enabled. This setting blocks public bucket policies that grant access to the bucket.

Answer

BlockPublicAcls (both new and existing)

Answer

IgnorePublicAcls

Answer

BlockPublicAcls (new ACLs)

Question 2

A data engineer is designing a data pipeline that processes PII data in AWS Glue. They need to ensure data is encrypted at rest and in transit. Which TWO actions should they take? (Choose TWO.)

Accepted Answer

Configure S3 bucket server-side encryption for job output. Option B is correct because AWS Glue writes job output to Amazon S3, and configuring S3 server-side encryption (SSE-S3, SSE-KMS, or SSE-C) ensures that the resulting data is encrypted at rest, satisfying the at-rest requirement for pipeline output. Option E is correct because enabling encryption at rest for the AWS Glue Data Catalog protects the metadata (table definitions, schemas, partition info) stored in the catalog using a KMS key, which is a required part of securing the Glue environment for PII workloads. Option A is wrong because disabling SSL would remove encryption in transit, directly violating the requirement. Option C is wrong because Glue job bookmarks store state information and are not the mechanism for encrypting PII data at rest or in transit. Option D is wrong because CloudWatch Logs is a logging service and does not provide the encryption-at-rest/in-transit guarantee for the Glue pipeline data itself.

Answer

Disable SSL for Glue connections

Answer

Use a KMS key for Glue job bookmarks

Answer

Use CloudWatch Logs for encryption

Question 3

Refer to the exhibit. A data engineer attached this S3 bucket policy to the bucket 'example-bucket'. What is the effect of this policy?

Accepted Answer

It denies PutObject requests that do not use SSE-S3. The bucket policy denies PutObject requests that do not include the x-amz-server-side-encryption header with value AES256 (SSE-S3). This means any PutObject request without SSE-S3 encryption is denied. Therefore, the correct answer is B.

Answer

It allows all PutObject requests that do not use encryption

Answer

It denies all PutObject requests unless they use SSE-KMS

Answer

It denies all PutObject requests from anonymous users

Question 4

Refer to the exhibit. The exhibit shows output from AWS CLI commands. Which key can be used to enable automatic annual rotation?

Accepted Answer

The first key (1234abcd-...). (the first key) is correct because automatic annual rotation is only configurable for customer managed keys. The first key is customer managed, allowing the user to enable or disable automatic rotation with a specified frequency (e.g., annually). The second key is AWS managed, which rotates automatically every three years without user configuration, so its rotation cannot be enabled or disabled by the user. Options A and B are incorrect because the second key (AWS managed) does not support user-controlled automatic rotation, and both keys cannot have rotation configured independently. Option C is incorrect because the first key (customer managed) does support automatic annual rotation.

Answer

The second key (5678efgh-...)

Answer

Both keys

Answer

Neither key

Question 5

Refer to the exhibit. An IAM policy includes this statement. What access does it grant?

Accepted Answer

It allows GetObject access to the bucket only from IP addresses in 10.0.0.0/8. The IAM policy statement (not shown but implied) likely has an Effect of Allow, Action of s3:GetObject, Resource of the bucket, and a Condition with aws:SourceIp of 10.0.0.0/8. Therefore, it allows GetObject access only from IP addresses in that range. Option D correctly describes this.

Answer

It denies GetObject access to the bucket from IP addresses in 10.0.0.0/8

Answer

It allows GetObject access to the bucket only from a specific VPC

Answer

It allows PutObject access to the bucket from any IP address

Question 6

A company uses AWS Glue to process sensitive customer data stored in S3. The data engineer must ensure that the Glue ETL jobs do not write any data to S3 buckets that lack encryption. Which approach meets this requirement?

Accepted Answer

Attach an S3 bucket policy that denies s3:PutObject unless the request includes the x-amz-server-side-encryption header. An S3 bucket policy with a condition key such as s3:x-amz-server-side-encryption can deny s3:PutObject requests that do not specify encryption, thereby preventing unencrypted writes. Option A is incorrect because AWS CloudTrail is an auditing service that logs API calls but does not actively prevent writes. Option C is incorrect because while S3 default encryption automatically encrypts objects at rest, it does not enforce that write requests include encryption headers; the bucket policy approach ensures encryption is explicitly requested. Option D is incorrect because an IAM role policy can also enforce encryption, but a bucket policy is more comprehensive as it applies to all principals accessing the bucket, including the Glue service role.

Answer

Use AWS CloudTrail to monitor and alert on unencrypted writes

Answer

Enable S3 default encryption on the bucket

Answer

Configure an IAM role for Glue with a policy that denies s3:PutObject without encryption

Question 7

A company uses AWS Lake Formation to manage access to data in a data lake. The data engineer needs to grant a user the ability to query tables in the 'sales' database using Amazon Athena, but only when the user's IP address is within the corporate network (10.0.0.0/8). Which combination of actions should the data engineer take?

Accepted Answer

Grant Lake Formation permissions on the tables and attach an IAM policy to the user with aws:SourceIp condition. Lake Formation grants table-level permissions, but IP-based restrictions must be enforced through IAM policy conditions because Lake Formation permissions alone do not evaluate network context. Attaching an IAM policy with an aws:SourceIp condition to the user ensures that Athena queries are only allowed when the request originates from the 10.0.0.0/8 range. Combining Lake Formation grants with the IAM condition satisfies both data-access and network-restriction requirements.

Answer

Grant Lake Formation permissions on the tables and attach an S3 bucket policy with aws:SourceIp condition

Answer

Use an S3 VPC endpoint and grant Lake Formation permissions on the tables

Answer

Grant Lake Formation permissions on the tables and configure a network ACL in the VPC

Question 8

A data engineer is designing a data pipeline that ingests personally identifiable information (PII) into Amazon Redshift. The engineer needs to ensure that only authorized users can view the data, and that all queries are logged for auditing. Which combination of AWS services should the engineer use?

Accepted Answer

AWS CloudTrail and Amazon CloudWatch Logs. AWS CloudTrail and Amazon CloudWatch Logs. CloudTrail logs API calls to Redshift for auditing administrative actions, while Amazon Redshift can be configured to send audit logs (including SQL queries) to Amazon CloudWatch Logs. This combination ensures both API activity and data access are logged. Option A is incorrect because Amazon Redshift audit logging is not a separate service; audit logs can be sent to CloudWatch Logs. Option B is incorrect because IAM Access Analyzer does not log queries. Option C is incorrect because S3 access logs only capture access to S3 objects, not Redshift queries.

Answer

AWS CloudTrail and Amazon Redshift audit logging

Answer

AWS IAM Access Analyzer and Amazon Redshift audit logging

Answer

Amazon S3 access logs and AWS CloudTrail

Question 9

A company uses Amazon RDS for PostgreSQL to store financial data. The security team requires that all database connections be encrypted in transit and that the database audit logs be stored in Amazon S3 for at least 7 years. Which steps should the data engineer take to meet these requirements?

Accepted Answer

Set the `rds.force_ssl` parameter to 1 in the DB parameter group, and export RDS audit logs to Amazon CloudWatch Logs with a subscription to Amazon S3. Setting rds.force_ssl=1 in the DB parameter group forces all client connections to use TLS, satisfying encryption in transit. Exporting RDS audit logs (via the PostgreSQL pgaudit extension or RDS log exports) to CloudWatch Logs and then creating a subscription to deliver them to Amazon S3 provides durable, long-term storage that can be retained for 7 years with an S3 lifecycle policy. Together these two steps meet both the in-transit encryption and long-term audit log retention requirements.

Answer

Enable encryption at rest using AWS KMS, and configure the RDS instance to publish logs to an S3 bucket with a lifecycle policy

Answer

Configure the DB security group to allow only TLS connections, and set up AWS CloudTrail to log all database queries

Answer

Use an SSL certificate from AWS Certificate Manager (ACM) and attach it to the RDS instance, and stream logs to Amazon Kinesis Data Firehose with S3 destination

Question 10

A company uses Amazon DynamoDB to store session data. The security team requires that all data be encrypted at rest using a customer-managed KMS key. The data engineer has enabled encryption with a KMS key, but discovers that old data remains encrypted with the previous AWS-managed key. How can the engineer re-encrypt all existing data with the new key?

Accepted Answer

Export the table to S3 using DynamoDB Export to S3, then import using DynamoDB Import from S3 with the new encryption key specified. Exporting the table to S3 and then importing it with a new KMS key re-encrypts all data at rest using the new key. Option A is wrong because disabling and re-enabling encryption does not re-encrypt existing data; DynamoDB does not support in-place re-encryption of existing items. Option B is wrong because AWS Backup restores the table with the original encryption; it does not allow specifying a new key for existing data. Option C is wrong because changing the encryption key only applies to new writes; there is no 'Apply to existing data' option in the DynamoDB console.

Answer

Disable and re-enable encryption with the new KMS key

Answer

Use AWS Backup to back up the table and restore it with the new encryption key

Answer

Use the DynamoDB console to change the encryption key and select 'Apply to existing data'

Question 11

A company stores sensitive data in Amazon S3. The data engineer needs to implement a solution that automatically detects and redacts PII in new objects as they are uploaded. Which TWO AWS services should be used together?

Accepted Answer

Amazon Macie. Amazon Macie is a fully managed data security and data privacy service that uses machine learning and pattern matching to discover and protect sensitive data in Amazon S3. Amazon Comprehend is a natural language processing (NLP) service that can be used to detect and redact PII entities from text. Together, they enable automated detection and redaction of PII in newly uploaded S3 objects by triggering Macie to identify sensitive data and then using Comprehend to redact the PII.

Answer

AWS Glue ETL

Answer

Amazon DynamoDB

Answer

AWS Glue Data Catalog

Question 12

A company uses AWS KMS to encrypt data in Amazon Redshift. The data engineer needs to rotate the customer-managed KMS key annually. Which TWO actions must be taken to successfully rotate the key without data loss?

Accepted Answer

Create a new KMS key and update the Redshift cluster to use the new key. Option A is correct because AWS KMS does not support automatic rotation for customer-managed keys used by Redshift in a way that re-encrypts existing data; to rotate the key, you must create a new KMS key and update the Redshift cluster to use the new key for future encryption operations. Option B is correct because existing data encrypted with the old key remains encrypted under that old key, so the old KMS key must remain enabled to allow decryption of that data; disabling or deleting it would cause data loss. Option C is not required for the rotation itself; CloudTrail can audit KMS API calls but does not perform or validate rotation. Option D is incorrect because KMS keys are never exported or stored in S3; the key material is managed by AWS KMS. Option E is incorrect because enabling automatic rotation on the existing key rotates the key material but does not change the key ID or re-encrypt existing Redshift data, so it does not satisfy the requirement to rotate the customer-managed key as described.

Answer

Use AWS CloudTrail to verify the key rotation was successful

Answer

Store the new key in Amazon S3 for backup

Answer

Enable automatic KMS key rotation on the existing key

Question 13

A data engineer is designing a data lake on Amazon S3 that must comply with GDPR. The engineer needs to ensure that individuals can request deletion of their personal data. Which THREE AWS services can be used together to automate the deletion of specific records?

Accepted Answer

AWS Lambda. AWS Lambda (A) is correct because it provides the serverless compute needed to run custom logic that identifies and processes the specific records matching a data subject's deletion request, and it can be triggered on demand or via API Gateway/Step Functions to orchestrate the workflow. Amazon S3 Batch Operations (C) is correct because it can run a Lambda function or a batch job across a large list of objects, enabling scalable, automated deletion or rewriting of objects that contain the individual's personal data. Amazon S3 Select (D) is correct because it lets you query and filter data inside individual S3 objects using SQL, so the Lambda function can locate the exact records belonging to the data subject before deleting or rewriting them. AWS Glue (B) is not the right fit here because it is a managed ETL/catalog service for bulk data processing rather than a mechanism for targeted, request-driven record deletion. Amazon DynamoDB (E) is not appropriate because it is a NoSQL database service, not an S3 data-lake deletion tool, and the scenario is specifically about automating deletion of records stored in S3.

Answer

AWS Glue

Answer

Amazon DynamoDB

Question 14

Refer to the exhibit. A data engineer attaches this bucket policy to an S3 bucket. A developer tries to upload an object to the bucket using the AWS CLI with the command: `aws s3 cp file.txt s3://my-bucket/`. The upload fails. What is the most likely reason?

Accepted Answer

The CLI command does not specify the encryption header, so the request is denied by the policy. The correct answer. The bucket policy condition `aws:SecureTransport` or similar encryption requirement (e.g., `s3:x-amz-server-side-encryption`) denies requests that do not include the required encryption header. The `aws s3 cp` CLI command does not automatically include the `x-amz-server-side-encryption` header; it uses SSE-S3 by default without setting the header explicitly. Therefore, the request is denied because the header is missing. Option B is incorrect because the policy does not depend on region. Option C is incorrect because the policy does not require a specific KMS key ID; it only requires the encryption header. Option D is incorrect because the IAM user likely has `s3:PutObject` permission, but the bucket policy explicitly denies the request due to missing encryption header.

Answer

The developer used the wrong AWS region

Answer

The CLI command does not include the required KMS key ID

Answer

The IAM user does not have s3:PutObject permission

Question 15

Refer to the exhibit. A data engineer reviews an Amazon S3 server access log entry for an object upload. The log shows a status of 200 and encryption status "AES256". The company policy requires that all data be encrypted with SSE-KMS. Which action should the engineer take to enforce this policy?

Accepted Answer

Attach an S3 bucket policy that denies s3:PutObject unless the request includes x-amz-server-side-encryption: aws:kms. To enforce that all uploads use SSE-KMS, the engineer must attach a bucket policy that explicitly denies s3:PutObject requests that do not include the x-amz-server-side-encryption: aws:kms header. This policy-level control prevents any upload using AES256 or no encryption, ensuring compliance with the company policy.

Answer

Revoke the IAM role's s3:PutObject permission

Answer

Enable AWS CloudTrail data events to monitor future uploads

Answer

Enable S3 default encryption with SSE-KMS on the bucket