DEA-C01 Data Security and Governance Practice Test 22 — 15 Questions

Question 1

A data analytics company uses Amazon Athena to query data stored in an S3 bucket. The data contains personally identifiable information (PII). The security team wants to ensure that only authorized users can access the data through Athena, and that the data is encrypted at rest in S3. Which combination of actions should the company take? (Choose two.)

Accepted Answer

Attach an IAM policy to users that grants Athena access and S3 read access to the bucket.. Option A and D are correct. Option A enables encryption at rest. Option D restricts Athena access via IAM policies and bucket policies. Option B is wrong because Lake Formation is not required for basic access control; IAM policies suffice. Option C is wrong because S3 Access Points can provide granular access but are not necessary. Option E is wrong because Athena does not support Kinesis.

Answer

Use AWS Lake Formation to define data lake permissions.

Answer

Use AWS Kinesis to stream data to Athena.

Answer

Create an S3 Access Point with a restricted policy.

Question 2

A company uses AWS Lake Formation to manage permissions on a data lake stored in S3. A data scientist is unable to query a table in Amazon Athena, receiving an 'Access Denied' error. The data scientist has IAM permissions to call Athena and has been granted SELECT permission on the table in Lake Formation. What is the most likely cause?

Accepted Answer

The S3 bucket containing the data is not registered as a Lake Formation location.. Lake Formation requires explicit S3 permission via a resource link or register location. Option B is correct because if the underlying S3 location is not registered or the IAM role does not have S3 access, the query fails. Option A is wrong because the data scientist has SELECT permission. Option C is wrong because encryption is not the issue. Option D is wrong because Lake Formation bypasses S3 bucket policies for registered locations.

Answer

The data scientist does not have DESCRIBE permission on the table.

Answer

The data is encrypted with SSE-KMS and the data scientist lacks kms:Decrypt permission.

Answer

The S3 bucket policy denies access to the data scientist's IAM role.

Question 3

A company has an AWS Glue ETL job that reads data from an S3 bucket, transforms it, and writes to another S3 bucket. The security team requires that data in transit between the Glue job and S3 be encrypted using TLS. The Glue job runs in a VPC with a VPC endpoint for S3. Which configuration ensures TLS encryption for all data transfer?

Accepted Answer

Use an S3 Gateway Endpoint and ensure the Glue job uses HTTPS.. For S3 VPC endpoints, traffic is encrypted via TLS by default when using Gateway Endpoints. Option C is correct. Option A is wrong because HTTPS is the default protocol for S3 API calls. Option B is wrong because encryption in transit is independent of KMS. Option D is wrong because interface endpoints also support TLS, but Gateway Endpoints are sufficient.

Answer

Use an S3 Gateway Endpoint and ensure the Glue job uses HTTP instead of HTTPS.

Answer

Use an S3 Interface Endpoint and disable TLS.

Answer

Enable SSE-KMS encryption on both source and destination S3 buckets.

Question 4

A data engineer needs to grant an IAM user read-only access to a specific prefix (folder) in an S3 bucket. The bucket contains sensitive data. Which S3 bucket policy statement achieves this?

Accepted Answer

{"Effect":"Allow","Principal":{"AWS":"arn:aws:iam::123456789012:user/DataEng"},"Action":"s3:GetObject","Resource":"arn:aws:s3:::mybucket/sensitive/*"}. Option B is correct because it grants s3:GetObject for the specific prefix and denies access to other prefixes implicitly. Option A is wrong because it grants access to all objects. Option C is wrong because it uses a condition that does not restrict prefix. Option D is wrong because it grants access to all objects in the bucket.

Answer

{"Effect":"Allow","Principal":{"AWS":"arn:aws:iam::123456789012:user/DataEng"},"Action":"s3:GetObject","Resource":"arn:aws:s3:::mybucket"}

Answer

{"Effect":"Allow","Principal":{"AWS":"arn:aws:iam::123456789012:user/DataEng"},"Action":"s3:GetObject","Resource":"arn:aws:s3:::mybucket/*","Condition":{"StringLike":{"s3:prefix":"sensitive/"}}}

Answer

{"Effect":"Allow","Principal":{"AWS":"arn:aws:iam::123456789012:user/DataEng"},"Action":"s3:GetObject","Resource":"arn:aws:s3:::mybucket/*"}

Question 5

A company is designing a data lake on AWS using S3. The security team requires that all data be encrypted at rest and that encryption keys be rotated annually. Which services can be used to meet these requirements? (Choose TWO.)

Accepted Answer

AWS Key Management Service (AWS KMS). Option A and D are correct. SSE-S3 provides encryption at rest with Amazon-managed keys that are rotated automatically. AWS KMS allows customer-managed keys with manual rotation or automatic yearly rotation. Option B is wrong because CloudHSM provides hardware security modules but is not directly integrated with S3 for automatic key rotation. Option C is wrong because ACM is for TLS certificates. Option E is wrong because Secrets Manager is for secrets, not encryption keys.

Answer

AWS Secrets Manager

Answer

AWS Certificate Manager (ACM)

Answer

AWS CloudHSM

Question 6

A data engineer needs to audit all access to an S3 bucket containing sensitive data. The engineer must capture who accessed the bucket, from which IP address, and what actions were performed. Which AWS services should be used together to meet this requirement? (Choose THREE.)

Accepted Answer

Amazon CloudWatch Logs. Options A, B, and D are correct. S3 server access logs record detailed information about requests. CloudTrail records API calls with identity and source IP. CloudWatch Logs can ingest and analyze logs. Option C is wrong because VPC Flow Logs capture network traffic but not S3 API details. Option E is wrong because Config records resource configuration changes, not access.

Answer

AWS Config

Answer

VPC Flow Logs

Question 7

A company uses Amazon Redshift for data warehousing. The security team requires that data be encrypted at rest using a customer-managed key (CMK) in AWS KMS, and that the key be rotated automatically every year. Additionally, the team wants to restrict access to the key to only the Redshift cluster and a security admin IAM role. Which steps should the company take? (Choose THREE.)

Accepted Answer

Add the security admin IAM role as a key user in the KMS key policy.. Options A, C, and E are correct. Option A enables encryption with a CMK. Option C enables automatic yearly rotation. Option E adds the security admin to the key policy. Option B is wrong because enabling encryption on an existing encrypted cluster requires creating a new snapshot and restoring, not just altering. Option D is wrong because disabling rotation prevents automatic rotation.

Answer

Alter the existing Redshift cluster to enable encryption with the CMK.

Answer

Disable automatic key rotation to comply with security policy.

Question 8

A company is using AWS Glue to catalog data in S3. The security team wants to ensure that only authorized users can access the Glue Data Catalog and that data lineage is tracked. Which AWS services can be used together to meet these requirements? (Choose TWO.)

Accepted Answer

AWS Glue DataBrew. Options A and D are correct. AWS Lake Formation provides fine-grained access control for the Data Catalog. AWS Glue DataBrew provides data lineage visualization. Option B is wrong because Athena is a query service, not for access control or lineage. Option C is wrong because CloudTrail logs API calls but does not manage permissions. Option E is wrong because Kinesis is for streaming.

Answer

AWS CloudTrail

Answer

Amazon Athena

Answer

Amazon Kinesis

Question 9

A data engineer is configuring an S3 bucket policy to allow cross-account access for a partner organization to write data to a specific prefix. The partner's AWS account ID is 111111111111. The engineer wants to ensure that only the partner can write, and that the partner cannot read or delete objects. Which policy statements should be included? (Choose TWO.)

Accepted Answer

{"Effect":"Allow","Principal":{"AWS":"111111111111"},"Action":"s3:PutObject","Resource":"arn:aws:s3:::mybucket/partner/*"}. Options A and C are correct. Option A grants s3:PutObject for the prefix. Option C explicitly denies all other actions. Option B is wrong because it grants read and delete. Option D is wrong because the principal should be the partner's account root. Option E is wrong because using a condition without explicit deny may not block all actions.

Answer

{"Effect":"Allow","Principal":{"AWS":"arn:aws:iam::111111111111:user/PartnerUser"},"Action":"s3:PutObject","Resource":"arn:aws:s3:::mybucket/partner/*"}

Answer

{"Effect":"Allow","Principal":"*","Action":"s3:PutObject","Resource":"arn:aws:s3:::mybucket/partner/*","Condition":{"StringEquals":{"aws:SourceAccount":"111111111111"}}}

Answer

{"Effect":"Allow","Principal":{"AWS":"111111111111"},"Action":["s3:GetObject","s3:DeleteObject"],"Resource":"arn:aws:s3:::mybucket/partner/*"}

Question 10

A healthcare company stores patient records in an S3 bucket encrypted with SSE-S3. The data engineering team uses AWS Glue ETL jobs to process this data and load it into an Amazon Redshift cluster for analytics. Recently, the security team mandated that all sensitive data must be encrypted at rest using customer-managed keys (CMK) in AWS KMS, and that the keys must be rotated automatically every year. The team updated the S3 bucket to use SSE-KMS with a CMK and enabled automatic key rotation. However, after the change, the Glue ETL jobs that read from the S3 bucket started failing with 'Access Denied' errors. The Glue job uses an IAM role named 'GlueETLRole' that has the following permissions: s3:GetObject on the bucket, kms:Decrypt and kms:GenerateDataKey on the CMK, and all necessary Glue permissions. The Redshift cluster is also encrypted with a different CMK, and the Glue role has kms:Decrypt on that key as well. What is the most likely cause of the failure?

Accepted Answer

The KMS key policy for the CMK used for S3 encryption does not grant 'GlueETLRole' permission to use the key.. Option B is correct. When using SSE-KMS, the Glue job needs to call kms:Decrypt to decrypt the data, but the S3 GET request also requires kms:Decrypt permission. The role has kms:Decrypt, but the key policy of the CMK must also grant the role permission. Option A is wrong because the role has the required KMS permissions. Option C is wrong because Glue does not need kms:Encrypt for reading. Option D is wrong because VPC endpoint policy may block but is less likely.

Answer

The IAM role 'GlueETLRole' does not have kms:Decrypt permission on the CMK used for S3 encryption.

Answer

The Glue job requires kms:Encrypt permission to read encrypted data from S3.

Answer

The S3 VPC endpoint policy does not allow the Glue job to access the KMS key.

Question 11

A financial services company uses Amazon Athena to query a data lake in S3. The data lake contains sensitive financial transactions. The security team has implemented row-level security using views in AWS Glue Data Catalog. Each view is defined with a WHERE clause that filters rows based on the user's IAM role using a custom tag. However, when a data analyst runs a SELECT * FROM view_name in Athena, the query returns all rows, ignoring the row-level filter. The analyst's IAM role has the tag 'department=analytics'. The view was created with a filter condition 'department = current_user_department()', where current_user_department() is a user-defined function that extracts the department tag from the caller's IAM role. The function is defined in the Glue Data Catalog. What is the most likely reason the filter is not applied?

Accepted Answer

The view is not defined with the filter condition properly; the function current_user_department() may not be invoked correctly in the view definition.. Option A is correct. Views in Athena do not automatically enforce row-level security; the filter must be applied via the view definition. Option B is wrong because the function exists. Option C is wrong because Athena executes the view's SQL. Option D is wrong because the tag is present.

Answer

The user-defined function current_user_department() is not registered in the Glue Data Catalog.

Answer

Athena does not support user-defined functions in views.

Answer

The IAM role does not have the tag 'department=analytics'.

Question 12

A company uses Amazon RDS for MySQL to store application data. The database contains personally identifiable information (PII). The security team requires that all data be encrypted at rest using AWS KMS. The database is currently unencrypted. The data engineer needs to enable encryption without significant downtime. Which approach should the data engineer take?

Accepted Answer

Take a snapshot of the database, copy it with encryption enabled, and restore from the encrypted snapshot.. Option D is correct. To enable encryption on an existing RDS instance, you must take a snapshot, copy it with encryption, and restore from the encrypted snapshot. This process involves some downtime but is the only way. Option A is wrong because you cannot modify the instance to enable encryption directly. Option B is wrong because you cannot enable encryption on the existing instance via modification. Option C is wrong because DMS requires source and target, and the target can be encrypted, but it's more complex.

Answer

Use AWS DMS to migrate data to a new encrypted RDS instance continuously.

Answer

Create a read replica with encryption enabled and promote it to primary.

Answer

Modify the RDS instance and enable encryption in the configuration.

Question 13

A data engineering team uses AWS Lambda functions to process streaming data from Amazon Kinesis Data Streams and write the results to an S3 bucket. The S3 bucket is encrypted with SSE-KMS using a customer-managed key (CMK). The Lambda function's IAM role has permissions for kms:Decrypt and kms:GenerateDataKey on the CMK. However, the Lambda function fails with an 'Access Denied' error when writing to S3. The S3 bucket policy allows s3:PutObject from the Lambda function's IAM role. What is the most likely cause?

Accepted Answer

The Lambda function's IAM role is missing the kms:Encrypt permission on the CMK.. Option A is correct. When writing to S3 with SSE-KMS, the Lambda function needs kms:Encrypt permission to encrypt the data. The role only has kms:Decrypt and kms:GenerateDataKey, missing kms:Encrypt. Option B is wrong because Kinesis encryption is separate. Option C is wrong because the bucket policy allows PutObject. Option D is wrong because Lambda has permissions, but missing kms:Encrypt.

Answer

The Lambda function's execution role does not have permission to invoke the function.

Answer

The S3 bucket policy denies s3:PutObject from the Lambda function.

Answer

The Kinesis data stream is not encrypted, causing the Lambda function to fail.

Question 14

A multinational corporation uses AWS Organizations to manage multiple accounts. The data engineering team has a central data lake account that stores all data in S3. The security team requires that all cross-account access to the data lake be logged and that any access from outside the organization be blocked. The team has enabled S3 server access logs and AWS CloudTrail. However, they notice that some requests from an external AWS account are still able to read data from the data lake. The bucket policy currently allows cross-account access to a specific partner account for data exchange. What additional step should the team take to block access from all other external accounts?

Accepted Answer

Add a Deny statement to the bucket policy that denies access to any principal not in the organization or the partner account.. Option C is correct. To block access from all external accounts except the allowed partner, you can add a Deny statement with a condition that checks if the account is not in the organization and not the partner account. Option A is wrong because disabling cross-account access would block the partner. Option B is wrong because the bucket policy already allows the partner. Option D is wrong because S3 Access Points do not inherently block external accounts unless explicitly configured.

Answer

Add a condition to the existing Allow statement to require that the source account be in the organization.

Answer

Remove the cross-account access statement from the bucket policy.

Answer

Use S3 Access Points to restrict access to only the partner account.

Question 15

A financial services company uses a multi-account AWS Organization with hundreds of accounts. The data engineering team needs to enable cross-account access to an encrypted S3 bucket in the data lake account (account ID 111111111111) for a Glue ETL job running in the analytics account (account ID 222222222222). The S3 bucket uses AWS KMS customer managed key (CMK) for server-side encryption (SSE-KMS). The Glue job fails with an AccessDenied error when trying to read data from the bucket. The IAM roles in both accounts have the necessary S3 permissions and the bucket policy allows access from the analytics account. What is the most likely cause of the failure?

Accepted Answer

The KMS key policy does not grant the analytics account's IAM role permission to use the key for decryption.. The Glue job fails because the KMS key policy does not grant the analytics account's IAM role permission to use the key for decryption. S3 permissions alone are insufficient when SSE-KMS is used; the key policy must explicitly allow the decrypt action for the cross-account principal.

Answer

The S3 bucket is in a different region than the Glue job.

Answer

The Glue job does not have an IAM role assigned.

Answer

The S3 bucket policy does not allow the s3:GetObject action for the analytics account's IAM role.