DEA-C01 Data Security and Governance Practice Test 20 — 15 Questions

Question 1

A company wants to enforce encryption in transit for data moving between an EC2 instance and an S3 bucket. Which TWO methods can achieve this? (Choose 2)

Accepted Answer

Add a bucket policy that denies requests without the aws:SecureTransport condition.. Option A is correct because a bucket policy with a Deny effect on s3:* conditioned on "aws:SecureTransport": "false" explicitly rejects any request made over plain HTTP, thereby enforcing encryption in transit for all access to the bucket, including from EC2. Option D is correct because S3's HTTPS endpoint (https://bucket.s3.amazonaws.com or the regional equivalent) uses TLS to encrypt data in transit between the EC2 instance and S3, satisfying the encryption-in-transit requirement directly. Option B is not correct because a VPC endpoint (Gateway or Interface) only changes the network path and can be used with either HTTP or HTTPS; it does not by itself guarantee encryption in transit. Option C is not correct because SSE-S3 provides encryption at rest for objects stored in the bucket, not encryption of data moving over the network. Option E is not correct because CloudTrail only logs and monitors API activity; it is a detective control that does not encrypt traffic or prevent unencrypted requests.

Answer

Use a VPC endpoint for S3.

Answer

Enable default SSE-S3 encryption on the bucket.

Answer

Enable CloudTrail to monitor for non-encrypted requests.

Question 2

A company runs a data lake on AWS using S3 for storage and AWS Glue for ETL. The security team discovers that a contractor who left the company two months ago still has access to an S3 bucket containing sensitive data. The access was granted via an IAM user that was not deleted. The data engineer is asked to implement a solution to prevent future occurrences. The company uses AWS Organizations and has multiple accounts. The requirement is to automatically detect and remediate IAM users that have not been used for 90 days by disabling their access keys and notifying the security team. The solution must be least privilege and use AWS-native services. Which approach should the data engineer take?

Accepted Answer

Use AWS IAM Access Analyzer to generate findings for unused access and create an AWS Config custom rule with a Lambda function that automatically disables the access keys and sends a notification via SNS.. AWS IAM Access Analyzer can generate findings for unused access, and AWS Config with a custom rule can auto-remediate by invoking a Lambda function to disable keys and notify via SNS. Option A is incorrect because AWS Config managed rules cannot automatically disable access keys; they only evaluate compliance and require manual action or a custom rule with remediation. Option B is incorrect because CloudTrail and CloudWatch alarms do not automatically disable keys; they only notify for manual intervention. Option C is incorrect because Lake Formation is used for fine-grained access control on data lakes, not for managing IAM users or disabling access keys.

Answer

Use AWS IAM Access Analyzer to generate findings for unused access and create an AWS Config managed rule to automatically disable the IAM user's access keys.

Answer

Use AWS CloudTrail to monitor IAM user activity and set up a CloudWatch alarm that triggers an SNS notification to the security team to manually disable the keys.

Answer

Use AWS Lake Formation to revoke the permissions of the IAM user and set up a scheduled Lambda function to check for unused IAM users.

Question 3

A data engineer is setting up cross-account access to an encrypted S3 bucket. The bucket uses a customer-managed KMS key. The engineer has configured the bucket policy and the IAM role in the source account. The target account still gets access denied errors when trying to read objects. What is the most likely cause?

Accepted Answer

The KMS key policy does not grant the target account's IAM role the kms:Decrypt permission.. For cross-account access to an S3 bucket encrypted with a customer-managed KMS key, the KMS key policy must explicitly grant the target account's IAM role the kms:Decrypt permission. Without this, the target account will get access denied errors even if the bucket policy and IAM role are correctly configured. Option B is incorrect because Object Ownership does not affect cross-account read access. Option C is incorrect because the bucket policy only needs to allow the target account's IAM role, not the root user. Option D is incorrect because VPC Endpoint policies are not relevant to this cross-account access issue.

Answer

The S3 bucket has Object Ownership set to BucketOwnerPreferred.

Answer

The bucket policy does not allow the target account's root user.

Answer

The VPC Endpoint policy blocks access from the target account.

Question 4

A company has a data lake in Amazon S3 with millions of objects. The security team wants to enforce that all objects are encrypted with a specific customer-managed KMS key. The data engineer configures an S3 bucket policy to deny PutObject if the encryption is not set to that key. However, some existing objects are not encrypted with that key. What is the most efficient way to remediate the existing objects?

Accepted Answer

Use S3 Batch Operations to copy objects in the same bucket with the new encryption settings.. S3 Batch Operations is designed to perform bulk actions (like copying objects) across millions of objects efficiently, and it supports specifying new encryption settings during the copy. By copying objects in the same bucket with the desired KMS key, the existing objects are re-encrypted with the customer-managed key, satisfying the bucket policy requirement. This is the most efficient, server-side, managed approach for large-scale remediation.

Answer

Use S3 Cross-Region Replication to replicate objects to a new bucket with the correct encryption.

Answer

Write a script using the AWS SDK to iterate over all objects and re-upload them with the correct encryption.

Answer

Use S3 Object Lambda to dynamically encrypt objects on read.

Question 5

A company uses Amazon Redshift for its data warehouse and needs to enforce column-level security on sensitive columns. Which TWO approaches can achieve this?

Accepted Answer

Create views that expose only non-sensitive columns and grant access to the views.. Option B is correct because creating views that expose only non-sensitive columns and granting users access to those views (rather than the base tables) is a standard Redshift pattern for column-level security: users query the view and cannot see the restricted columns. Option D is correct because Amazon Redshift natively supports column-level access control via GRANT and REVOKE on individual columns (for example, GRANT SELECT(col1, col2) ON table TO user), which directly enforces column-level security. Option A is wrong because an S3 bucket policy governs access to objects in S3, not to columns within Redshift tables, and does not control SQL-level column visibility. Option C is wrong because Redshift Spectrum external schemas and tables do not provide a column-restriction mechanism for enforcing column-level security on Redshift data. Option E is wrong because Redshift row-level security (RLS) policies filter which rows a user can see, not which columns they can access.

Answer

Apply an S3 bucket policy to the underlying data files.

Answer

Use Redshift Spectrum to query external tables and restrict columns via the external schema.

Answer

Use Redshift row-level security policies to restrict column access.

Question 6

A company has a multi-account AWS environment with a centralized data lake in the Security account. Data producers in other accounts use AWS Glue to write data to S3 buckets in the Security account. The Security account uses AWS Lake Formation to manage permissions. The data engineer is setting up cross-account access so that users in the Producer account can query the data using Athena in their own account. The engineer has registered the S3 buckets and Data Catalog tables in Lake Formation. The IAM roles in the Producer account have the necessary permissions. However, when a user in the Producer account tries to query the table, they get an AccessDenied error. The error message indicates that the principal is not authorized to perform lakeformation:GetTable on the resource. What is the most likely cause?

Accepted Answer

The Lake Formation permissions in the Security account do not include a grant to the Producer account's IAM role.. The error explicitly states the principal is not authorized to perform lakeformation:GetTable, which is a Lake Formation permission check, not an S3, KMS, or Glue resource policy check. In Lake Formation cross-account access, the data owner (Security account) must grant table and data location permissions directly to the external IAM principal (the Producer account's role) using the Lake Formation GrantPermissions API or console. Without this explicit grant, Lake Formation denies the GetTable call before any S3 or KMS access is even attempted. Since the IAM roles already have the necessary permissions, the missing piece is the Lake Formation grant in the Security account.

Answer

The Glue Data Catalog resource policy is missing a statement to allow cross-account access.

Answer

The S3 bucket policy does not allow the Producer account's IAM role to read the data.

Answer

The KMS key policy does not allow the Producer account's IAM role to decrypt objects.

Question 7

A company uses Amazon QuickSight for data visualization. The data engineer needs to ensure that users can only see data relevant to their department. The data is stored in Amazon S3 and is accessed via SPICE. The engineer has created datasets in QuickSight and wants to implement row-level security (RLS). The dataset contains a column 'Department' that indicates which department a row belongs to. The engineer has configured RLS rules using a separate permissions dataset. However, users report that they can see all rows, not just their department's rows. What is the most likely reason?

Accepted Answer

The RLS permissions dataset is not correctly configured to map users to department values.. RLS in QuickSight works by matching the user's identity (via username or group) against rules in a permissions dataset that maps users/groups to allowed values of a column (e.g., Department). If users see all rows, the most likely cause is that the permissions dataset is not correctly mapping users to department values — for example, wrong usernames, missing group mappings, or a dataset that does not join properly to the main dataset.

Answer

The 'Department' column is not included in the dataset.

Answer

The users have been granted admin access to the QuickSight dashboard.

Answer

The SPICE dataset does not support row-level security.

Question 8

A financial services company uses AWS Glue ETL jobs to process sensitive customer data stored in Amazon S3. The data is encrypted at rest with SSE-KMS using a customer-managed key. Recently, the security team discovered that the Glue job's IAM role has an overly permissive policy that allows the 'kms:Decrypt' action for all KMS keys in the account. The company wants to follow the principle of least privilege. The Glue job runs on a schedule and reads from a specific S3 bucket. The security team needs to update the IAM policy to restrict KMS decryption to only the specific key used for that bucket. What should they do?

Accepted Answer

Update the policy to allow 'kms:Decrypt' only for the specific KMS key ARN used by the S3 bucket containing the customer data.. To follow least privilege, the IAM role for the Glue job should only have access to decrypt using the specific KMS key that encrypts the S3 bucket containing the customer data. This is done by allowing 'kms:Decrypt' with a resource set to the exact ARN of that key, not a wildcard or all keys. Option A is incorrect because using a wildcard in the key ARN (key/*) still grants access to all keys under that key hierarchy, which is overly permissive. Option B is incorrect because allowing 'kms:Decrypt' with resource '*' would grant access to all keys in the account, violating least privilege. Option D is incorrect because removing 'kms:Decrypt' from the IAM policy would prevent the Glue job from decrypting the data; the job's IAM role needs the permission, and relying solely on S3 bucket policies cannot grant decryption permissions cross-account or for IAM roles.

Answer

Update the policy to allow 'kms:Decrypt' with a resource of 'arn:aws:kms:us-east-1:123456789012:key/*' to cover all keys in the account.

Answer

Update the policy to allow 'kms:Decrypt' with a resource of '*' to ensure the job can always decrypt data.

Answer

Remove the 'kms:Decrypt' action from the policy and rely on S3 bucket policies to grant decryption permissions.

Question 9

A media company stores video files in an Amazon S3 bucket. The bucket policy allows access only from a specific VPC. The company has enabled S3 Server Access Logs to monitor access. Recently, the security team found that some requests were coming from an IP address outside the allowed VPC. They suspect that the bucket policy may have an incorrect condition. What should they check first?

Accepted Answer

Verify that the bucket policy uses the 'aws:SourceVpc' condition key with the correct VPC ID.. The first thing to check is the bucket policy condition key. The 'aws:SourceVpc' condition key is used to restrict access to a specific VPC, but if it is misconfigured (e.g., wrong VPC ID or incorrect condition operator), requests from outside the VPC might be allowed. Verifying this key ensures the policy is correctly enforcing the VPC restriction.

Answer

Review the S3 Server Access Logs to identify the source IP addresses.

Answer

Ensure that the IAM role used by the application has the correct permissions.

Answer

Check if the bucket policy allows public access.

Question 10

A company uses Amazon RDS for MySQL to store transactional data. The database contains sensitive financial information. The company's security policy requires that all data at rest be encrypted using a customer-managed KMS key. The database was originally launched without encryption at rest. The security team now needs to enable encryption without significant downtime. What should they do?

Accepted Answer

Create a snapshot of the database, copy the snapshot with encryption enabled, and restore a new DB instance from the encrypted snapshot.. RDS for MySQL does not support enabling encryption at rest on an existing unencrypted DB instance. The only supported method is to take a snapshot, copy the snapshot with encryption enabled using a customer-managed KMS key, and then restore a new DB instance from that encrypted snapshot. This approach requires a brief downtime during the switchover but avoids a full data migration.

Answer

Enable encryption by modifying the DB instance's storage type to 'encrypted'.

Answer

Use the AWS DMS (Database Migration Service) to migrate data to a new encrypted RDS instance.

Answer

Modify the DB instance and enable encryption under the 'Storage' settings.

Question 11

A company uses AWS Lake Formation to manage access to data in a data lake. A new data engineer has been granted SELECT permission on a table but receives an 'AccessDeniedException' when querying via Amazon Athena. The table is registered in Lake Formation and the data is encrypted with SSE-KMS. Which of the following is the MOST likely cause?

Accepted Answer

The IAM role used by Athena does not have kms:Decrypt permission on the KMS key.. The IAM role used by Athena does not have kms:Decrypt permission on the KMS key. When data is encrypted with SSE-KMS, Athena's IAM role requires kms:Decrypt to read the data from S3. Even if Lake Formation grants SELECT permission, the query fails without KMS access. Option A is incorrect because Lake Formation does not use resource-based policies on tables; it uses LF-Tags or resource links to grant permissions. Option B is incorrect because while an S3 bucket policy could block access, the most likely issue with encrypted data is missing KMS permissions. Option C is incorrect because the Glue Data Catalog does not enforce data access; Lake Formation is the service that manages fine-grained access.

Answer

The table's resource-based policy does not include the engineer's IAM role.

Answer

The S3 bucket policy denies access to the engineer's IAM role.

Answer

The AWS Glue Data Catalog has not been granted permission to the engineer's role.

Question 12

A data engineer needs to securely store database credentials used by a Lambda function. The solution must automatically rotate the credentials every 90 days. Which AWS service should the engineer use?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is purpose-built for storing and managing secrets such as database credentials, API keys, and tokens. It natively supports automatic rotation via Lambda rotation functions on a schedule (e.g., every 90 days), and integrates with RDS, Redshift, and DocumentDB for managed rotation. This directly satisfies both the secure storage and automatic 90-day rotation requirements.

Answer

AWS CloudHSM

Answer

AWS Systems Manager Parameter Store

Answer

IAM Roles for Lambda

Question 13

A company wants to monitor and alert on unauthorized API calls in their AWS account. Which AWS service should be used to detect and notify on such events?

Accepted Answer

AWS CloudTrail and Amazon CloudWatch Events. D is correct because AWS CloudTrail records all API calls in the AWS account, and Amazon CloudWatch Events (or EventBridge) can be configured with rules to detect specific API calls (e.g., unauthorized actions) and trigger notifications. Option A is incorrect because Amazon GuardDuty and AWS Security Hub are threat detection and security management services, not primarily for monitoring all API calls. Option B is incorrect because Amazon VPC Flow Logs capture network traffic metadata, not API calls. Option C is incorrect because AWS Config monitors resource configuration changes, not API calls.

Answer

Amazon GuardDuty and AWS Security Hub

Answer

Amazon VPC Flow Logs and Amazon CloudWatch Logs

Answer

AWS Config and AWS Systems Manager

Question 14

A data engineer is troubleshooting an Amazon Redshift cluster that is not allowing connections from a specific IP range. The engineer verified that the cluster's security group allows inbound traffic from the IP range. What is the next step to resolve the issue?

Accepted Answer

Check the network ACL (NACL) associated with the Redshift cluster's subnet.. Even if the security group allows inbound traffic from a specific IP range, the network ACL (NACL) associated with the Redshift cluster's subnet can block traffic at the subnet level. NACLs are stateless and can override security group rules. Option A is incorrect because modifying the cluster parameter group does not control network-level access; public accessibility is a separate setting. Option B is incorrect because the engineer already verified the security group, but even if it is correctly attached, the NACL could still block traffic. Option C is incorrect because IAM roles control authentication and authorization, not network connectivity.

Answer

Modify the Redshift cluster parameter group to enable public accessibility.

Answer

Verify that the cluster's security group is attached to the Redshift cluster.

Answer

Check the IAM role associated with the Redshift cluster.

Question 15

A company uses AWS Glue to run ETL jobs on data stored in S3. The data is encrypted with SSE-KMS. The Glue job fails with an 'AccessDenied' error when trying to read the data. What is the MOST likely cause?

Accepted Answer

The IAM role used by Glue does not have kms:Decrypt permission on the KMS key.. When S3 data is encrypted with SSE-KMS, any principal reading the object must have both s3:GetObject on the bucket and kms:Decrypt on the KMS key. The Glue job's IAM role is the principal making the read, so if it lacks kms:Decrypt, S3 returns AccessDenied even though the bucket policy may allow access. This is the most common cause of this specific error pattern.

Answer

The S3 bucket policy denies access to the Glue service role.

Answer

The AWS Glue Data Catalog does not have permission to the table.

Answer

The Glue job's connection does not have the necessary permissions.