DEA-C01 Data Security and Governance Practice Test 20 — 15 Questions

Question 1

A data engineer needs to grant an IAM role read-only access to Amazon DynamoDB tables in a specific AWS account. Which IAM policy element should be used to restrict access to only the 'GetItem' and 'Query' actions?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Action. The 'Action' element specifies the allowed API actions. 'Effect' is 'Allow' or 'Deny'. 'Resource' specifies the ARN. 'Condition' adds conditions. So Action is correct.

Answer

Resource

Answer

Effect

Answer

Condition

Question 2

A company stores sensitive customer data in an Amazon S3 bucket with versioning enabled. A data engineer accidentally deleted the current version of an object. What is the quickest way to restore the object to its previous state without additional data transfer costs?

Accepted Answer

Delete the delete marker that was created by the deletion.. With S3 versioning enabled, deleting an object does not permanently remove it; instead, a delete marker is placed. To restore the object to its previous state, you simply remove the delete marker, which makes the previous version the current version again. Option A is incorrect because S3 does not have a Recycle Bin; S3 Batch Operations are for bulk actions but not for restoring from a recycle bin. Option C would not restore the object properly; copying the previous version to itself would create a new version, not restore the original. Option D is incorrect because the s3 sync command synchronizes objects between locations and does not restore previous versions.

Answer

Use S3 Batch Operations to restore the object from the Recycle Bin.

Answer

Copy the previous version from the bucket to itself.

Answer

Use the S3 sync command to restore the previous version.

Question 3

A data engineer is configuring an Amazon Redshift cluster to encrypt data at rest. The company policy requires that encryption keys be stored in AWS CloudHSM. Which integration should the engineer use to meet this requirement?

Accepted Answer

Configure Redshift to use an HSM for encryption.. The correct integration is to configure Amazon Redshift to use an HSM (Hardware Security Module) for encryption. Amazon Redshift supports AWS CloudHSM as an external HSM to store encryption keys. Option A (AWS KMS with a customer managed key) is not the integration for CloudHSM; it uses KMS, not CloudHSM. Option C (SSL/TLS) is for encryption in transit, not at rest. Option D (automatic key rotation) is a feature of Redshift encryption but does not integrate with CloudHSM for key storage.

Answer

Use AWS KMS with a customer managed key.

Answer

Enable encryption using the AWS Redshift SSL/TLS feature.

Answer

Use Redshift automatic key rotation.

Question 4

A company uses AWS Lake Formation to manage data lakes on Amazon S3. The data engineer needs to grant a data analyst access to query specific columns in a table using Amazon Athena, but deny access to columns containing personally identifiable information (PII). Which Lake Formation feature should be used?

Accepted Answer

Column-level permissions in Lake Formation.. Lake Formation column-level permissions allow granting access to specific columns and denying access to others. This is the correct feature for restricting access to PII columns while allowing querying other columns. Row-level security (A) controls which rows are visible, not columns. Tag-based access control (C) is for resource categorization, not fine-grained column access. Cell-level security (D) is not a feature of Lake Formation or AWS Glue.

Answer

Row-level security filters.

Answer

Tag-based access control with Lake Formation tags.

Answer

Cell-level security with AWS Glue.

Question 5

A company is using Amazon S3 to store log files. The security team requires that all data be encrypted in transit. Which of the following ensures encryption in transit for S3?

Accepted Answer

Use HTTPS (SSL/TLS) when accessing S3 endpoints.. Encryption in transit for S3 is achieved by using HTTPS (SSL/TLS) when accessing S3 endpoints (option A). Option B (Transfer Acceleration) speeds up uploads but does not provide encryption in transit by itself. Option C (client-side encryption) protects data at rest and during transit only if combined with HTTPS. Option D (SSE-S3) is at-rest encryption. Therefore, the correct answer is A.

Answer

Use Amazon S3 Transfer Acceleration.

Answer

Enable client-side encryption before uploading to S3.

Answer

Use server-side encryption with S3 managed keys (SSE-S3).

Question 6

An organization wants to audit all API calls made to AWS services for compliance. Which AWS service should be used to capture and store these API calls?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records all API calls made to AWS services and stores them in Amazon S3 for auditing and compliance. AWS Config monitors resource configurations, not API calls. Amazon VPC Flow Logs capture IP traffic information. Amazon CloudWatch Logs stores log data but does not natively capture API calls; it can receive logs from CloudTrail if integrated, but CloudTrail is the primary service for capturing API calls.

Answer

AWS Config

Answer

Amazon VPC Flow Logs

Answer

Amazon CloudWatch Logs

Question 7

A data engineer is troubleshooting an issue where an Amazon Redshift query returns an error: 'ERROR:  permission denied for relation table_name'. The user has been granted SELECT on the table. What is the most likely cause?

Accepted Answer

The user does not have USAGE permission on the schema.. In Amazon Redshift, to access a table, a user must have USAGE permission on the schema containing the table, in addition to SELECT or other table-level permissions. Without USAGE on the schema, the user receives a 'permission denied for relation' error even if SELECT is granted. Option D is correct. Option A (session timeout) would cause a different error or disconnection. Option B (no CONNECT permission) would prevent connecting to the database. Option C (wrong schema) would result in a 'schema not found' error, not a permission denied error.

Answer

The user's session has timed out.

Answer

The user does not have CONNECT permission on the database.

Answer

The table is in a different schema than expected.

Question 8

A company is designing a data pipeline that ingests data from an on-premises database to Amazon S3. The data contains personally identifiable information (PII) that must be masked before storage. Which AWS service can be used to mask the data in transit?

Accepted Answer

Amazon Kinesis Data Firehose. Amazon Kinesis Data Firehose can invoke an AWS Lambda function to transform and mask data in transit before delivering to Amazon S3. This makes it suitable for masking PII in a streaming pipeline. AWS Glue is designed for batch ETL jobs, not real-time masking during transit. AWS DMS is for database migration, and AWS Data Pipeline orchestrates workflows without native masking capabilities.

Answer

AWS Database Migration Service (DMS)

Answer

AWS Data Pipeline

Answer

AWS Glue

Question 9

A company needs to enforce encryption at rest for all data stored in Amazon S3. Which of the following are valid methods to achieve this? (Choose TWO.)

Accepted Answer

Enable default bucket encryption using SSE-S3.. Server-side encryption with S3 managed keys (SSE-S3) encrypts data at rest on the server side. Client-side encryption encrypts data before uploading, ensuring it is encrypted at rest from the client's perspective. Options A and E are for encryption in transit, and C is versioning, not encryption. Correct: B and D.

Answer

Use Amazon S3 Transfer Acceleration.

Answer

Enable S3 Versioning.

Answer

Use SSL/TLS for all S3 API calls.

Question 10

A data engineer is configuring a VPC for an Amazon Redshift cluster. The cluster must be accessible only from a specific on-premises network via a Direct Connect connection. Which TWO actions should the engineer take to meet this requirement? (Choose TWO.)

Accepted Answer

Configure a security group to allow inbound traffic from the on-premises CIDR block.. To restrict access to an Amazon Redshift cluster from a specific on-premises network via Direct Connect, the engineer should use a security group (option B) to control inbound traffic at the instance level, and a network ACL (option C) for subnet-level traffic control. Both should allow traffic from the on-premises CIDR block. Option A (Enhanced VPC Routing) is incorrect because it controls how traffic flows between the cluster and other resources, not inbound access. Option D (VPC endpoint) is incorrect because a VPC endpoint provides private connectivity from within the VPC, not from on-premises via Direct Connect. Option E (publicly accessible) is insecure and unnecessary when using Direct Connect.

Answer

Enable Redshift Enhanced VPC Routing.

Answer

Create a VPC endpoint for Redshift.

Answer

Make the Redshift cluster publicly accessible.

Question 11

A company wants to ensure that an IAM user can only launch Amazon EC2 instances of a specific instance type. Which THREE IAM policy elements are required to define this permission? (Choose THREE.)

Accepted Answer

Action. To define a permission in an IAM policy, the required elements are Effect (allow/deny), Action (e.g., ec2:RunInstances), and Resource (e.g., '*'). While a Condition can further restrict the permission (e.g., to a specific instance type), it is not mandatory. Therefore, the three required elements are Effect, Action, and Resource.

Answer

Principal

Answer

Condition

Question 12

Refer to the exhibit. An IAM policy is attached to an IAM user. The user is trying to download an object from the S3 bucket 'example-bucket' from an IP address 10.1.1.1, but the request is denied. What is the most likely reason?

Accepted Answer

The user's IP address does not match the condition in the policy.. The policy includes a condition that allows s3:GetObject only if the request originates from the 10.0.0.0/16 IP range. The user's IP address 10.1.1.1 falls outside this range, so the condition is not satisfied, resulting in an implicit deny. Therefore, the most likely reason for the denial is that the user's IP address does not match the condition, making option D correct. Option A is incorrect because the policy does allow s3:GetObject. Option B is incorrect because the policy has no syntax error. Option C is incorrect because there is no explicit deny statement.

Answer

The policy does not allow the s3:GetObject action.

Answer

The policy has a syntax error.

Answer

There is an explicit deny statement elsewhere that overrides the allow.

Question 13

Refer to the exhibit. A data engineer runs a CLI command to decrypt a file and receives an access denied error. The IAM user 'DataEngineer' has the following policy attached:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "kms:Decrypt",
      "Resource": "*"
    }
  ]
}

What is the most likely cause of the error?

Accepted Answer

The key policy does not grant the IAM user permission to decrypt.. Even though the IAM policy grants kms:Decrypt on all resources, the key policy is a separate access control mechanism. The error indicates that the key policy does not include the IAM user as a principal allowed to decrypt. Therefore, option B is correct. Option A is incorrect because missing the --encryption-context parameter would cause a different error, not an access denied. Option C is incorrect because AWS managed keys can be used for decryption if the key policy grants permission; the key type is not the issue. Option D is incorrect because the IAM policy does allow kms:Decrypt on all keys; the problem is the key policy, not the IAM policy.

Answer

The CLI command is missing the --encryption-context parameter.

Answer

The key is an AWS managed key and cannot be used for decryption.

Answer

The IAM policy does not allow kms:Decrypt on the specific key.

Question 14

Refer to the exhibit. A data engineer creates an external table in AWS Glue Data Catalog pointing to an S3 bucket that contains encrypted objects (SSE-S3). The CREATE TABLE statement fails with an error. What change should be made to fix the error?

Accepted Answer

Set 'has_encrypted_data' to 'true'.. When creating an external table in AWS Glue Data Catalog that references an S3 bucket with SSE-S3 encrypted objects, you must set the table property 'has_encrypted_data' to 'true'. This allows Glue to properly read the encrypted data. Option A is unnecessary; Option B is not required for encryption; Option C is for SSE-KMS, not SSE-S3. Therefore, Option D is the correct change.

Answer

Change the SERDE to 'org.apache.hadoop.hive.serde2.lazy.LazySimpleSerDe'.

Answer

Add 'aws_iam_role' as a table property.

Answer

Include the KMS key ARN in the LOCATION.

Question 15

A company stores PII in an S3 bucket. The security team wants to use Amazon Macie to discover sensitive data. After enabling Macie, they notice that no sensitive data findings are generated. The S3 bucket is in the same account. What is the most likely reason?

Accepted Answer

The S3 bucket is in a different AWS Region than the Macie session.. Macie only scans buckets in the same AWS Region as the Macie session. If the bucket is in a different region, Macie cannot discover sensitive data in it. Option A is incorrect because Macie uses service-linked roles, not the bucket policy, to access buckets in the same account. Option B is incorrect because Macie does not require cross-account access for buckets in the same account. Option D is incorrect because Macie can read objects regardless of ACLs as long as the appropriate IAM permissions are granted.

Answer

The bucket policy blocks access from Macie's service principal.

Answer

Macie is not configured with cross-account access to the bucket.

Answer

The S3 objects have private ACLs that prevent Macie from reading them.