DEA-C01 Data Security and Governance Practice Test 20 — 15 Questions

Question 1

A company uses AWS Lake Formation to manage data lakes on Amazon S3. The data engineer needs to grant a data analyst access to query specific columns in a table using Amazon Athena, but deny access to columns containing personally identifiable information (PII). Which Lake Formation feature should be used?

Accepted Answer

Column-level permissions in Lake Formation.. Lake Formation column-level permissions allow granting access to specific columns and denying access to others. Option A is correct. Row-level security is for rows, not columns. Cell-level is not supported. Tag-based access control is for resources, not fine-grained column access.

Answer

Row-level security filters.

Answer

Tag-based access control with Lake Formation tags.

Answer

Cell-level security with AWS Glue.

Question 2

A company is using Amazon S3 to store log files. The security team requires that all data be encrypted in transit. Which of the following ensures encryption in transit for S3?

Accepted Answer

Use HTTPS (SSL/TLS) when accessing S3 endpoints.. Encryption in transit for S3 is achieved by using HTTPS (SSL/TLS) when accessing S3 endpoints. Option B is correct. SSE-S3 is at-rest encryption. Client-side encryption is also at-rest. VPC endpoints provide private connectivity but not encryption by default; you need to use HTTPS.

Answer

Use Amazon S3 Transfer Acceleration.

Answer

Enable client-side encryption before uploading to S3.

Answer

Use server-side encryption with S3 managed keys (SSE-S3).

Question 3

An organization wants to audit all API calls made to AWS services for compliance. Which AWS service should be used to capture and store these API calls?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records API calls and stores them in S3. Option B is correct. CloudWatch Logs is for log data, not API calls. VPC Flow Logs capture network traffic. Config records resource configuration changes.

Answer

AWS Config

Answer

Amazon VPC Flow Logs

Answer

Amazon CloudWatch Logs

Question 4

A data engineer is troubleshooting an issue where an Amazon Redshift query returns an error: 'ERROR:  permission denied for relation table_name'. The user has been granted SELECT on the table. What is the most likely cause?

Accepted Answer

The user does not have USAGE permission on the schema.. In Redshift, users need usage permission on the schema to access tables within it. Option B is correct. Option A is unrelated. Option C would result in a schema not found error. Option D would be a connection timeout.

Answer

The user's session has timed out.

Answer

The user does not have CONNECT permission on the database.

Answer

The table is in a different schema than expected.

Question 5

A company is designing a data pipeline that ingests data from an on-premises database to Amazon S3. The data contains personally identifiable information (PII) that must be masked before storage. Which AWS service can be used to mask the data in transit?

Accepted Answer

AWS Glue. AWS Glue can transform and mask data during ETL jobs. Option C is correct. Kinesis is for streaming data. Data Pipeline orchestrates but does not have native masking. DMS is for migration, not masking.

Answer

AWS Database Migration Service (DMS)

Answer

AWS Data Pipeline

Answer

Amazon Kinesis Data Firehose

Question 6

A company needs to enforce encryption at rest for all data stored in Amazon S3. Which of the following are valid methods to achieve this? (Choose TWO.)

Accepted Answer

Enable default bucket encryption using SSE-S3.. Server-side encryption with S3 managed keys (SSE-S3) and client-side encryption are both methods for encryption at rest. Option A is for in transit. Option D is for data in motion. Option E is not encryption at rest. Correct: B and C.

Answer

Use Amazon S3 Transfer Acceleration.

Answer

Enable S3 Versioning.

Answer

Use SSL/TLS for all S3 API calls.

Question 7

A data engineer is configuring a VPC for an Amazon Redshift cluster. The cluster must be accessible only from a specific on-premises network via a Direct Connect connection. Which TWO actions should the engineer take to meet this requirement? (Choose TWO.)

Accepted Answer

Configure a security group to allow inbound traffic from the on-premises CIDR block.. To restrict access to Redshift, you use a security group to allow inbound traffic from the on-premises CIDR, and optionally use a network ACL for subnet-level security. Option A is incorrect because Redshift does not support VPC endpoints. Option D is incorrect because Redshift Enhanced VPC Routing is for routing traffic, not for access control. Option E is incorrect because public endpoints are not secure. Correct: B and C.

Answer

Enable Redshift Enhanced VPC Routing.

Answer

Create a VPC endpoint for Redshift.

Answer

Make the Redshift cluster publicly accessible.

Question 8

A company wants to ensure that an IAM user can only launch Amazon EC2 instances of a specific instance type. Which THREE IAM policy elements are required to define this permission? (Choose THREE.)

Accepted Answer

Action. To restrict to specific instance types, you need Effect (Allow), Action (ec2:RunInstances), and Condition (to specify instance type). Resource could be used but is not strictly required if you use Condition. Option A is needed to allow. Option C is needed for the action. Option D is needed to restrict. Option B is not required; you can use Condition to specify instance type instead of Resource. Option E is optional. Correct: A, C, D.

Answer

Principal

Answer

Resource

Question 9

Refer to the exhibit. An IAM policy is attached to an IAM user. The user is trying to download an object from the S3 bucket 'example-bucket' from an IP address 10.1.1.1, but the request is denied. What is the most likely reason?

Accepted Answer

The user's IP address does not match the condition in the policy.. The policy uses a condition to allow access only from the 10.0.0.0/16 IP range. The user's IP 10.1.1.1 is outside that range, so the condition fails and access is denied (implicit deny). Option B is correct. Option A is wrong because the policy allows GetObject. Option C is wrong because there is no explicit deny. Option D is wrong because the policy is valid.

Answer

The policy does not allow the s3:GetObject action.

Answer

The policy has a syntax error.

Answer

There is an explicit deny statement elsewhere that overrides the allow.

Question 10

Refer to the exhibit. A data engineer runs a CLI command to decrypt a file and receives an access denied error. The IAM user 'DataEngineer' has the following policy attached:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "kms:Decrypt",
      "Resource": "*"
    }
  ]
}

What is the most likely cause of the error?

Accepted Answer

The key policy does not grant the IAM user permission to decrypt.. Even with an Allow on kms:Decrypt for all resources, the key policy must also grant the user access. The error indicates that the key policy does not allow the user. Option C is correct. Option A is wrong because the IAM policy allows all keys. Option B is wrong because AWS managed keys are not used. Option D is wrong because the CLI command is correct.

Answer

The CLI command is missing the --encryption-context parameter.

Answer

The key is an AWS managed key and cannot be used for decryption.

Answer

The IAM policy does not allow kms:Decrypt on the specific key.

Question 11

Refer to the exhibit. A data engineer creates an external table in AWS Glue Data Catalog pointing to an S3 bucket that contains encrypted objects (SSE-S3). The CREATE TABLE statement fails with an error. What change should be made to fix the error?

Accepted Answer

Set 'has_encrypted_data' to 'true'.. If the data is encrypted with SSE-S3, the table property 'has_encrypted_data' should be set to 'true'. Option C is correct. Option A is unnecessary. Option B is not the cause. Option D is not required for SSE-S3.

Answer

Change the SERDE to 'org.apache.hadoop.hive.serde2.lazy.LazySimpleSerDe'.

Answer

Add 'aws_iam_role' as a table property.

Answer

Include the KMS key ARN in the LOCATION.

Question 12

A company uses AWS Glue to process sensitive data stored in S3. The security team requires that all data be encrypted at rest using customer-managed KMS keys. The data engineers are encountering 'Access Denied' errors when running Glue ETL jobs. What is the most likely cause?

Accepted Answer

The Glue service role does not have kms:Decrypt and kms:Encrypt permissions for the KMS key.. Option A is correct because Glue service role must have kms:Decrypt and kms:Encrypt permissions for the KMS key to read/write encrypted data from S3. Option B is incorrect because S3 bucket policies can restrict access but the error is likely due to missing KMS permissions. Option C is incorrect because KMS key policies or IAM policies can grant access to Glue role. Option D is incorrect because the issue is not about cross-account access.

Answer

The KMS key policy does not allow the AWS Glue service to use the key.

Answer

The Glue Data Catalog is encrypted with a different KMS key.

Answer

The S3 bucket policy denies access to the Glue service role.

Question 13

A company stores PII in an S3 bucket. The security team wants to use Amazon Macie to discover sensitive data. After enabling Macie, they notice that no sensitive data findings are generated. The S3 bucket is in the same account. What is the most likely reason?

Accepted Answer

The S3 bucket is in a different AWS Region than the Macie session.. Option D is correct because Macie requires the bucket to be in the same AWS Region as the Macie session. Option A is incorrect because Macie can access buckets in the same account without cross-account roles. Option B is incorrect because Macie uses service-linked roles, not object ACLs. Option C is incorrect because Macie does not require public access; it reads objects via IAM.

Answer

The bucket policy blocks access from Macie's service principal.

Answer

Macie is not configured with cross-account access to the bucket.

Answer

The S3 objects have private ACLs that prevent Macie from reading them.

Question 14

A company needs to audit all API calls made in their AWS account, including actions performed by the root user. Which AWS service should be used?

Accepted Answer

AWS CloudTrail. Option B is correct because AWS CloudTrail records all API calls for auditing. Option A is incorrect because CloudWatch Logs stores logs but does not capture API calls natively. Option C is incorrect because AWS Config tracks resource configuration changes, not API calls. Option D is incorrect because VPC Flow Logs capture network traffic, not API calls.

Answer

VPC Flow Logs

Answer

Amazon CloudWatch Logs

Answer

AWS Config

Question 15

A data engineer needs to encrypt data at rest in an Amazon Redshift cluster. The company requires that the encryption key be managed by the customer and rotated annually. Which solution meets these requirements?

Accepted Answer

Use AWS CloudHSM to create and manage the encryption key, and configure Redshift to use it.. Option C is correct because AWS CloudHSM provides dedicated hardware security modules for key management, allowing customer-managed keys with rotation. Option A is incorrect because Redshift cannot use Secrets Manager for encryption keys. Option B is incorrect because AWS KMS with automatic rotation meets the rotation requirement but the key is AWS-managed unless using customer-managed KMS keys; however, CloudHSM is more appropriate for dedicated control. Option D is incorrect because S3 server-side encryption is not applicable to Redshift.

Answer

Use S3 server-side encryption with customer-provided keys (SSE-C).

Answer

Use AWS Secrets Manager to store the encryption key and configure Redshift to reference it.

Answer

Use AWS KMS with automatic key rotation enabled.