DEA-C01 Data Security and Governance Practice Test 22 — 15 Questions

Question 1

A company stores sensitive customer data in an S3 bucket. The security team requires that all data be encrypted at rest using a customer-managed AWS KMS key. However, when a data engineer attempts to upload an object using the AWS CLI, the upload fails with an access denied error. The engineer has s3:PutObject permission on the bucket. Which additional permission is most likely missing?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

kms:GenerateDataKey. To upload an object with SSE-KMS, the IAM user or role must have kms:GenerateDataKey permission to generate a data key for encryption. Option D is correct because without it, the upload fails. Option A (kms:CreateKey) is for creating keys, not using them. Option B (kms:Decrypt) is for decryption, not upload. Option C (s3:PutObjectAcl) is for ACLs, not encryption.

Answer

kms:CreateKey

Answer

kms:Decrypt

Answer

s3:PutObjectAcl

Question 2

A data engineering team uses AWS Glue ETL jobs to process data from an S3 data lake and load it into an Amazon Redshift cluster. The security policy mandates that all data in transit between AWS Glue and Redshift must be encrypted using TLS. The team uses a JDBC connection. Currently, the connection is failing with an SSL-related error. Which configuration change should the team make to ensure encrypted connectivity?

Accepted Answer

Update the JDBC connection string to include ssl=true and sslmode=require.. To enforce TLS encryption for JDBC connections to Amazon Redshift, the connection string must include ssl=true and often sslmode=require. This is a client-side configuration that tells the JDBC driver to use SSL. Option A is incorrect because security groups control network access, not encryption. Option C is incorrect because server-side encryption on S3 secures data at rest, not data in transit. Option D is incorrect because setting require_ssl=ON in the cluster parameter group enforces SSL on the server side, but the client (Glue) must still specify ssl=true in the JDBC URL to establish an encrypted connection. Therefore, the correct change is option B.

Answer

Modify the Redshift security group to allow inbound traffic on port 5439 from the Glue subnet.

Answer

Enable server-side encryption on the S3 bucket using AWS KMS.

Answer

Set the Redshift cluster parameter group to require_ssl=ON.

Question 3

A data analytics company uses Amazon Athena to query data stored in an S3 bucket. The data contains personally identifiable information (PII). The security team wants to ensure that only authorized users can access the data through Athena, and that the data is encrypted at rest in S3. Which combination of actions should the company take? (Choose two.)

Accepted Answer

Attach an IAM policy to users that grants Athena access and S3 read access to the bucket.. Attaching an IAM policy that grants Athena access and S3 read access to the bucket ensures that only authorized users can access the data through Athena via IAM permissions. Option E is correct because enabling server-side encryption (SSE-S3) on the S3 bucket ensures data is encrypted at rest. Option B is incorrect because while Lake Formation can be used for data lake permissions, it is not required for this scenario; IAM policies are sufficient. Option C is incorrect because Kinesis is a streaming service, not used for querying data in Athena. Option D is incorrect because an S3 Access Point with a restricted policy could be used but is not necessary when IAM policies already provide the required access control.

Answer

Use AWS Lake Formation to define data lake permissions.

Answer

Use AWS Kinesis to stream data to Athena.

Answer

Create an S3 Access Point with a restricted policy.

Question 4

A company uses AWS Lake Formation to manage permissions on a data lake stored in S3. A data scientist is unable to query a table in Amazon Athena, receiving an 'Access Denied' error. The data scientist has IAM permissions to call Athena and has been granted SELECT permission on the table in Lake Formation. What is the most likely cause?

Accepted Answer

The S3 bucket containing the data is not registered as a Lake Formation location.. The most likely cause is that the S3 bucket containing the data is not registered as a Lake Formation location. Lake Formation manages permissions for registered S3 locations, but if the bucket is not registered, Lake Formation cannot enforce its permissions, and the data scientist would rely on S3 bucket policies, which may deny access. Option A is incorrect because DESCRIBE permission is not required for querying. Option B is incorrect because encryption is not mentioned as an issue. Option C is incorrect because bucket policies are not the primary issue if the bucket is registered; the error occurs because the bucket is not registered.

Answer

The data scientist does not have DESCRIBE permission on the table.

Answer

The data is encrypted with SSE-KMS and the data scientist lacks kms:Decrypt permission.

Answer

The S3 bucket policy denies access to the data scientist's IAM role.

Question 5

A data engineer needs to grant an IAM user read-only access to a specific prefix (folder) in an S3 bucket. The bucket contains sensitive data. Which S3 bucket policy statement achieves this?

Accepted Answer

{"Effect":"Allow","Principal":{"AWS":"arn:aws:iam::123456789012:user/DataEng"},"Action":"s3:GetObject","Resource":"arn:aws:s3:::mybucket/sensitive/*"}. It grants s3:GetObject for the specific prefix and denies access to other prefixes implicitly. Option A is wrong because it grants access to all objects. Option C is wrong because it uses a condition that does not restrict prefix. Option D is wrong because it grants access to all objects in the bucket.

Answer

{"Effect":"Allow","Principal":{"AWS":"arn:aws:iam::123456789012:user/DataEng"},"Action":"s3:GetObject","Resource":"arn:aws:s3:::mybucket"}

Answer

{"Effect":"Allow","Principal":{"AWS":"arn:aws:iam::123456789012:user/DataEng"},"Action":"s3:GetObject","Resource":"arn:aws:s3:::mybucket/*","Condition":{"StringLike":{"s3:prefix":"sensitive/"}}}

Answer

{"Effect":"Allow","Principal":{"AWS":"arn:aws:iam::123456789012:user/DataEng"},"Action":"s3:GetObject","Resource":"arn:aws:s3:::mybucket/*"}

Question 6

A company is designing a data lake on AWS using S3. The security team requires that all data be encrypted at rest and that encryption keys be rotated annually. Which services can be used to meet these requirements? (Choose TWO.)

Accepted Answer

AWS Key Management Service (AWS KMS). AWS KMS (C) allows creating customer-managed keys that can be rotated annually or automatically. Amazon S3 managed keys (SSE-S3) (E) provide encryption at rest with keys that are automatically rotated by AWS. Option A (AWS Secrets Manager) is for storing secrets, not encryption keys. Option B (ACM) is for SSL/TLS certificates. Option D (CloudHSM) provides hardware security modules but does not support automatic key rotation for S3 and is not typically used for S3 encryption key management.

Answer

AWS Secrets Manager

Answer

AWS Certificate Manager (ACM)

Answer

AWS CloudHSM

Question 7

A data engineer needs to audit all access to an S3 bucket containing sensitive data. The engineer must capture who accessed the bucket, from which IP address, and what actions were performed. Which AWS services should be used together to meet this requirement? (Choose THREE.)

Accepted Answer

Amazon CloudWatch Logs. Amazon CloudWatch Logs (A) can ingest and analyze log data from various sources. Amazon S3 server access logs (C) provide detailed records of requests made to the S3 bucket, including the requester, IP address, and actions. AWS CloudTrail (D) records API calls with identity and source IP, enabling auditing of who accessed the bucket. AWS Config (B) tracks resource configuration changes, not access logs. VPC Flow Logs (E) capture network traffic, not S3 API details.

Answer

AWS Config

Answer

VPC Flow Logs

Question 8

A company uses Amazon Redshift for data warehousing. The security team requires that data be encrypted at rest using a customer-managed key (CMK) in AWS KMS, and that the key be rotated automatically every year. Additionally, the team wants to restrict access to the key to only the Redshift cluster and a security admin IAM role. Which steps should the company take? (Choose THREE.)

Accepted Answer

Add the security admin IAM role as a key user in the KMS key policy.. Options A, C, and E are correct. Option A adds the security admin IAM role as a key user in the KMS key policy. Option C enables automatic yearly rotation of the CMK. Option E creates a new Redshift cluster and specifies the CMK for encryption. Option B is wrong because you cannot enable encryption on an existing unencrypted cluster by altering it; you must create a new cluster or restore from an encrypted snapshot. Option D is wrong because it disables rotation, which conflicts with the security requirement.

Answer

Alter the existing Redshift cluster to enable encryption with the CMK.

Answer

Disable automatic key rotation to comply with security policy.

Question 9

A company is using AWS Glue to catalog data in S3. The security team wants to ensure that only authorized users can access the Glue Data Catalog and that data lineage is tracked. Which AWS services can be used together to meet these requirements? (Choose TWO.)

Accepted Answer

AWS Glue DataBrew. Options B and D are correct. AWS Lake Formation provides fine-grained access control for the Glue Data Catalog, and AWS Glue DataBrew offers data lineage visualization. Option A is incorrect because CloudTrail logs API calls but does not manage permissions or access control. Option C is incorrect because Athena is a query service, not for access control or lineage. Option E is incorrect because Kinesis is for streaming data.

Answer

AWS CloudTrail

Answer

Amazon Athena

Answer

Amazon Kinesis

Question 10

A data engineer is configuring an S3 bucket policy to allow cross-account access for a partner organization to write data to a specific prefix. The partner's AWS account ID is 111111111111. The engineer wants to ensure that only the partner can write, and that the partner cannot read or delete objects. Which policy statements should be included? (Choose TWO.)

Accepted Answer

{"Effect":"Allow","Principal":{"AWS":"111111111111"},"Action":"s3:PutObject","Resource":"arn:aws:s3:::mybucket/partner/*"}. The correct answers are C and E. Option C allows the partner account to perform s3:PutObject on the specified prefix, granting write access. Option E explicitly denies all actions except s3:PutObject, ensuring the partner cannot read or delete objects. Option A is incorrect because it specifies a user ARN instead of the account ARN, which would not allow all users in the partner account. Option B grants access to any principal with a condition, but the condition uses aws:SourceAccount which is not appropriate for cross-account access via bucket policy. Option D grants read and delete, which violates the requirement.

Answer

{"Effect":"Allow","Principal":{"AWS":"arn:aws:iam::111111111111:user/PartnerUser"},"Action":"s3:PutObject","Resource":"arn:aws:s3:::mybucket/partner/*"}

Answer

{"Effect":"Allow","Principal":"*","Action":"s3:PutObject","Resource":"arn:aws:s3:::mybucket/partner/*","Condition":{"StringEquals":{"aws:SourceAccount":"111111111111"}}}

Answer

{"Effect":"Allow","Principal":{"AWS":"111111111111"},"Action":["s3:GetObject","s3:DeleteObject"],"Resource":"arn:aws:s3:::mybucket/partner/*"}

Question 11

A healthcare company stores patient records in an S3 bucket encrypted with SSE-S3. The data engineering team uses AWS Glue ETL jobs to process this data and load it into an Amazon Redshift cluster for analytics. Recently, the security team mandated that all sensitive data must be encrypted at rest using customer-managed keys (CMK) in AWS KMS, and that the keys must be rotated automatically every year. The team updated the S3 bucket to use SSE-KMS with a CMK and enabled automatic key rotation. However, after the change, the Glue ETL jobs that read from the S3 bucket started failing with 'Access Denied' errors. The Glue job uses an IAM role named 'GlueETLRole' that has the following permissions: s3:GetObject on the bucket, kms:Decrypt and kms:GenerateDataKey on the CMK, and all necessary Glue permissions. The Redshift cluster is also encrypted with a different CMK, and the Glue role has kms:Decrypt on that key as well. What is the most likely cause of the failure?

Accepted Answer

The KMS key policy for the CMK used for S3 encryption does not grant 'GlueETLRole' permission to use the key.. The issue is that while the IAM role 'GlueETLRole' has the necessary KMS permissions (kms:Decrypt and kms:GenerateDataKey) via IAM policies, the key policy for the CMK used for S3 encryption must also explicitly grant the role (or the principal) permission to use the key. Without this key policy grant, the role's IAM permissions are insufficient, resulting in 'Access Denied' errors. Option A correctly identifies this as the most likely cause.

Answer

The IAM role 'GlueETLRole' does not have kms:Decrypt permission on the CMK used for S3 encryption.

Answer

The Glue job requires kms:Encrypt permission to read encrypted data from S3.

Answer

The S3 VPC endpoint policy does not allow the Glue job to access the KMS key.

Question 12

A financial services company uses Amazon Athena to query a data lake in S3. The data lake contains sensitive financial transactions. The security team has implemented row-level security using views in AWS Glue Data Catalog. Each view is defined with a WHERE clause that filters rows based on the user's IAM role using a custom tag. However, when a data analyst runs a SELECT * FROM view_name in Athena, the query returns all rows, ignoring the row-level filter. The analyst's IAM role has the tag 'department=analytics'. The view was created with a filter condition 'department = current_user_department()', where current_user_department() is a user-defined function that extracts the department tag from the caller's IAM role. The function is defined in the Glue Data Catalog. What is the most likely reason the filter is not applied?

Accepted Answer

The view is not defined with the filter condition properly; the function current_user_department() may not be invoked correctly in the view definition.. The most likely reason is that the user-defined function current_user_department() is not invoked correctly in the view definition. In Athena, views store the SQL logic, and when queried, the filter condition is evaluated. If the function is not registered properly or is not supported in view filters, the query may ignore it. Option A is incorrect because the function is already defined in the Glue Data Catalog. Option B is incorrect because Athena does support user-defined functions in views. Option C is incorrect because the analyst's role does have the tag.

Answer

The user-defined function current_user_department() is not registered in the Glue Data Catalog.

Answer

Athena does not support user-defined functions in views.

Answer

The IAM role does not have the tag 'department=analytics'.

Question 13

A company uses Amazon RDS for MySQL to store application data. The database contains personally identifiable information (PII). The security team requires that all data be encrypted at rest using AWS KMS. The database is currently unencrypted. The data engineer needs to enable encryption without significant downtime. Which approach should the data engineer take?

Accepted Answer

Take a snapshot of the database, copy it with encryption enabled, and restore from the encrypted snapshot.. To enable encryption on an existing unencrypted RDS instance, you must take a snapshot of the database, copy it with encryption enabled (using AWS KMS), and restore from the encrypted snapshot. This process involves downtime during the restore but is the only supported method. Option A is incorrect because AWS DMS can migrate data to a new encrypted RDS instance, but that adds complexity and is not the simplest approach. Option C is incorrect because read replicas cannot be promoted to primary if encryption is enabled on the replica but not on the source; also, the source must be encrypted. Option D is incorrect because you cannot modify an existing RDS instance to enable encryption directly; encryption can only be enabled when creating a new instance from an encrypted snapshot.

Answer

Use AWS DMS to migrate data to a new encrypted RDS instance continuously.

Answer

Create a read replica with encryption enabled and promote it to primary.

Answer

Modify the RDS instance and enable encryption in the configuration.

Question 14

A multinational corporation uses AWS Organizations to manage multiple accounts. The data engineering team has a central data lake account that stores all data in S3. The security team requires that all cross-account access to the data lake be logged and that any access from outside the organization be blocked. The team has enabled S3 server access logs and AWS CloudTrail. However, they notice that some requests from an external AWS account are still able to read data from the data lake. The bucket policy currently allows cross-account access to a specific partner account for data exchange. What additional step should the team take to block access from all other external accounts?

Accepted Answer

Add a Deny statement to the bucket policy that denies access to any principal not in the organization or the partner account.. To block access from all external accounts except the allowed partner, you can add a Deny statement with a condition that checks if the account is not in the organization and not the partner account. Option A is wrong because disabling cross-account access would block the partner. Option B is wrong because the bucket policy already allows the partner. Option D is wrong because S3 Access Points do not inherently block external accounts unless explicitly configured.

Answer

Add a condition to the existing Allow statement to require that the source account be in the organization.

Answer

Remove the cross-account access statement from the bucket policy.

Answer

Use S3 Access Points to restrict access to only the partner account.

Question 15

A financial services company uses a multi-account AWS Organization with hundreds of accounts. The data engineering team needs to enable cross-account access to an encrypted S3 bucket in the data lake account (account ID 111111111111) for a Glue ETL job running in the analytics account (account ID 222222222222). The S3 bucket uses AWS KMS customer managed key (CMK) for server-side encryption (SSE-KMS). The Glue job fails with an AccessDenied error when trying to read data from the bucket. The IAM roles in both accounts have the necessary S3 permissions and the bucket policy allows access from the analytics account. What is the most likely cause of the failure?

Accepted Answer

The KMS key policy does not grant the analytics account's IAM role permission to use the key for decryption.. The Glue job fails because the KMS key policy does not grant the analytics account's IAM role permission to use the key for decryption. S3 permissions alone are insufficient when SSE-KMS is used; the key policy must explicitly allow the decrypt action for the cross-account principal.

Answer

The S3 bucket is in a different region than the Glue job.

Answer

The Glue job does not have an IAM role assigned.

Answer

The S3 bucket policy does not allow the s3:GetObject action for the analytics account's IAM role.