DEA-C01 Data Security and Governance Practice Test 22 — 15 Questions

Question 1

A data engineer is setting up an Amazon RDS for MySQL database. The compliance team requires that all data at rest be encrypted. What must the engineer do to enable encryption for this database?

Accepted Answer

Specify an AWS KMS key when launching the DB instance. For Amazon RDS, encryption at rest must be enabled at the time of DB instance creation by specifying an AWS KMS key. Once the DB instance is created, you cannot enable encryption by simply modifying the instance; you would need to create an encrypted snapshot and restore it to a new encrypted instance. Therefore, the engineer must specify a KMS key when launching the DB instance to meet the compliance requirement.

Answer

Enable encryption after the DB instance is created by modifying the DB instance

Answer

Use AWS Secrets Manager to store the encryption key and attach it to the DB instance

Answer

Encrypt the underlying EBS volumes after the instance is created

Question 2

A company uses Amazon S3 to store log files. The security team notices that some objects are being accessed from an unexpected AWS account. The data engineer needs to identify which specific IAM user or role is accessing the objects. Which AWS service should be used to get this information?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records API activity in your AWS account, including S3 data events such as GetObject, PutObject, and DeleteObject. To identify the specific IAM user or role accessing S3 objects, you need to enable S3 data events in CloudTrail, which will log the identity of the caller. CloudTrail is the correct service for auditing and tracking user activity.

Answer

AWS Trusted Advisor

Answer

Amazon S3 server access logs

Answer

AWS Config

Question 3

A data engineer needs to share a dataset stored in an Amazon S3 bucket with another AWS account. The dataset must remain encrypted at rest using AWS KMS. The data engineer creates a bucket policy that grants the other account access to the bucket. However, the other account reports that objects appear encrypted and they cannot decrypt them. What is the most likely cause?

Accepted Answer

The KMS key policy does not grant the other account the kms:Decrypt permission. For cross-account access to KMS-encrypted S3 objects, both the S3 bucket policy and the KMS key policy must grant the necessary permissions. The bucket policy grants s3:GetObject, but decryption requires kms:Decrypt on the KMS key. If the key policy does not allow the other account, the objects cannot be decrypted, even with S3 access.

Answer

The bucket policy does not grant the s3:GetObject permission

Answer

The other account must use the same KMS key to upload objects

Answer

The objects are encrypted with SSE-S3, which is not supported for cross-account access

Question 4

A company uses Amazon Redshift for data warehousing. The security team requires that all data loading into Redshift be encrypted in transit. Which configuration ensures this requirement is met?

Accepted Answer

Configure the Redshift cluster to require SSL connections. Configuring the Redshift cluster to require SSL connections (require_ssl = true in the parameter group) enforces TLS for all client connections, ensuring data is encrypted in transit during loads. This is the direct configuration that satisfies the in-transit encryption requirement.

Answer

Use a VPC security group to restrict access

Answer

Use client-side encryption before loading data

Answer

Enable server-side encryption on the Redshift cluster

Question 5

A company is designing a data lake on Amazon S3. The security team requires granular access control based on data classifications. Which TWO AWS services can be used together to implement attribute-based access control (ABAC) for objects in S3?

Accepted Answer

Amazon S3 object tags. Amazon S3 object tags (C) are the attribute source in S3 ABAC: classification labels such as DataClass=Confidential are attached to objects, and IAM policies reference them via conditions like s3:ExistingObjectTag/<key>. AWS Identity and Access Management (D) is the policy engine that evaluates those tag-based conditions in identity and resource policies, granting or denying access according to the object's classification attribute. Together, S3 object tags supply the attributes and IAM enforces attribute-based access control, which is exactly the ABAC pattern required for the data lake. AWS Secrets Manager (A) stores and rotates secrets such as credentials, not access-control attributes. AWS Lake Formation (B) manages fine-grained permissions over data catalog tables and databases, not S3 object-level ABAC. AWS Key Management Service (E) provides encryption key management and cryptographic operations, not authorization decisions.

Answer

AWS Secrets Manager

Answer

AWS Lake Formation

Answer

AWS Key Management Service (KMS)

Question 6

Refer to the exhibit. A data engineer runs this AWS CLI command to execute an Athena query. What is the purpose of the EncryptionConfiguration parameter?

Accepted Answer

It encrypts the query results stored in Amazon S3 at rest. The EncryptionConfiguration parameter in Athena specifies how the query results stored in S3 are encrypted at rest. SSE_S3 means server-side encryption with S3-managed keys. It does not encrypt the query itself, data in transit, or the source data.

Answer

It encrypts the query string in transit

Answer

It encrypts the data in the source table

Answer

It enables client-side encryption for the query output

Question 7

A company uses AWS Glue to catalog data in Amazon S3. The data includes personally identifiable information (PII). The security team requires that PII be masked when queried by users who are not data owners. Which AWS service should be used to enforce this requirement?

Accepted Answer

Use AWS Lake Formation to define column-level security and data masking.. AWS Lake Formation allows you to define column-level security and data masking policies on tables cataloged in the AWS Glue Data Catalog. You can grant or deny access to specific columns and apply masking to sensitive columns like PII for users who are not data owners, enforcing the requirement at query time. This is the native AWS service for fine-grained access control on data lakes.

Answer

Use Amazon Macie to automatically redact PII from S3 objects.

Answer

Use IAM policies with condition keys to restrict access based on tags.

Answer

Use Amazon S3 Object Lambda to transform data on the fly.

Question 8

A data engineer needs to ensure that an Amazon Redshift cluster encrypts data at rest using a customer-managed AWS KMS key. Which configuration step is required?

Accepted Answer

Create a new cluster and specify a customer-managed KMS key for encryption.. To encrypt an Amazon Redshift cluster with a customer-managed KMS key, you must specify that key at cluster creation time; Redshift does not allow you to change the encryption key of an existing cluster after it is created. The customer-managed key gives you control over key rotation, grants, and audit via CloudTrail, which is required when the default AWS-managed key (aws/redshift) does not satisfy compliance.

Answer

Create a new cluster and select the default AWS managed key for encryption.

Answer

Use AWS CloudHSM to generate a key and attach it to the cluster.

Answer

Enable encryption on the existing cluster by modifying the cluster configuration.

Question 9

A data engineer needs to audit all access to an Amazon S3 bucket containing sensitive data. The audit must capture who accessed the bucket, from which IP address, and what actions were performed. Which AWS service should be enabled?

Accepted Answer

Enable AWS CloudTrail with data events for the S3 bucket.. AWS CloudTrail data events capture object-level API activity on S3 buckets, including the identity of the caller, source IP address, timestamp, and the specific action (GetObject, PutObject, DeleteObject). Enabling data events on the bucket produces an auditable record of who accessed sensitive objects and from where, which is exactly what the requirement demands. Management events alone would only show bucket-level configuration changes, not object reads/writes.

Answer

Enable S3 server access logging for the bucket.

Answer

Use AWS Config to record S3 bucket-level changes.

Answer

Configure Amazon CloudWatch Logs to monitor S3 access.

Question 10

A company uses AWS KMS to encrypt data in Amazon S3. The security team wants to ensure that the KMS key can only be used from within the company's VPC. Which policy element should be added to the KMS key policy?

Accepted Answer

Add a condition using aws:SourceVpc to allow only requests from the VPC.. The correct approach is to add a condition using the aws:SourceVpc condition key in the KMS key policy. This condition evaluates the VPC ID from which the request originates, allowing you to restrict key usage to requests that come through a VPC endpoint within your VPC. When a request is made to KMS through a VPC endpoint, the aws:SourceVpc condition key is populated with the VPC ID, enabling precise control. This ensures that the KMS key can only be used from within the specified VPC, meeting the security team's requirement.

Answer

Set the Principal element to restrict access to the VPC.

Answer

Add a condition using aws:SourceIp to allow only IP addresses from the VPC.

Answer

Add a condition using kms:ViaService to allow only via VPC endpoints.

Question 11

A data engineer is designing a data lake on Amazon S3. The compliance team requires that objects be automatically deleted after 7 years. Additionally, objects must be transitioned to Amazon S3 Glacier Instant Retrieval after 30 days to reduce costs. Which S3 lifecycle policy configuration meets these requirements?

Accepted Answer

Transition to Glacier Instant Retrieval after 30 days, then expire after 2555 days.. The requirement is to transition objects to Glacier Instant Retrieval after 30 days and delete them after 7 years. 7 years equals 2555 days (7 × 365). Option B correctly specifies transition after 30 days and expiration after 2555 days. This meets both the cost optimization and compliance retention requirements.

Answer

Transition to Glacier Instant Retrieval after 30 days, then expire after 90 days.

Answer

Transition to Glacier Deep Archive after 30 days, then expire after 7 years.

Answer

Transition to S3 Standard-IA after 30 days, then expire after 7 years.

Question 12

A data engineer receives an alert that an AWS KMS key has been scheduled for deletion by mistake. What is the immediate action to prevent the key from being deleted?

Accepted Answer

Cancel the key deletion from the KMS console or API.. When a KMS key is scheduled for deletion, the deletion can be canceled from the AWS KMS console or via the CancelKeyDeletion API during the pending deletion period. This immediate action restores the key to its previous state and prevents it from being deleted. Option B is incorrect because creating a new key does not cancel the deletion of the existing key. Option C is incorrect because deleted KMS keys cannot be restored; the default waiting period of 7–30 days exists specifically to allow cancellation. Option D is incorrect because disabling the key does not affect the deletion schedule.

Answer

Create a new KMS key and re-encrypt the data.

Answer

Wait for the key to be deleted and restore it from backup.

Answer

Disable the key immediately to stop usage.

Question 13

A company stores data in Amazon S3 with server-side encryption using AWS KMS (SSE-KMS). The data engineer needs to give a third-party auditor read-only access to the encrypted objects. The auditor has an AWS account. Which strategy should be used?

Accepted Answer

Update the S3 bucket policy to allow access from the auditor's account and update the KMS key policy to allow the auditor's account to decrypt.. SSE-KMS requires two independent authorizations: the caller must have s3:GetObject on the bucket (via bucket policy or IAM) AND kms:Decrypt on the KMS key (via key policy or IAM). Because the auditor is in a separate AWS account, both the S3 bucket policy and the KMS key policy must explicitly grant the external account access. This is the only option that satisfies both layers for cross-account access.

Answer

Generate a presigned URL for each object the auditor needs to access.

Answer

Copy the objects to a new bucket encrypted with SSE-S3 and share that bucket.

Answer

Grant the auditor's IAM role permission to use the KMS key.

Question 14

A company is building a data lake on AWS and must encrypt data at rest. Which services can provide server-side encryption for data stored in Amazon S3? (Choose TWO.)

Accepted Answer

SSE-S3. SSE-S3 (Option A) is correct because Amazon S3 server-side encryption with S3-managed keys (AES-256) encrypts objects at rest automatically, with AWS managing the key material and rotation. SSE-KMS (Option E) is also correct because it performs server-side encryption at rest using AWS KMS customer master keys (CMKs), giving you control over key policies, auditing, and rotation. Both are S3 server-side encryption modes applied after data reaches S3, satisfying the data-at-rest requirement. SSL/TLS (Option B) is wrong because it only encrypts data in transit between the client and S3, not at rest. AWS SDK client-side encryption (Option C) is wrong because it encrypts data before it is sent to S3, so it is client-side, not server-side. AWS CloudHSM (Option D) is wrong because it is a dedicated hardware security module service for key storage and cryptographic operations, not an S3 server-side encryption option by itself.

Answer

SSL/TLS

Answer

AWS SDK client-side encryption

Answer

AWS CloudHSM

Question 15

A company wants to audit API calls made to its Amazon S3 buckets. Which AWS services can be used to achieve this? (Choose TWO.)

Accepted Answer

AWS CloudTrail. AWS CloudTrail (D) is correct because it records S3 data events such as GetObject, PutObject, and DeleteObject, providing an audit trail of API calls made to S3 buckets when data events are enabled. Amazon S3 server access logs (E) are also correct because they capture detailed records of requests made to a bucket, including the requester, bucket name, request time, request action, response status, and error code, which directly supports auditing API calls. IAM Access Analyzer (A) is not correct here because it identifies resource policies that grant external access, not a log of API calls. AWS Config (B) tracks resource configuration changes and compliance, not individual S3 API request activity. VPC Flow Logs (C) capture IP traffic metadata for network interfaces, not S3 API-level operations.

Answer

IAM Access Analyzer

Answer

AWS Config

Answer

VPC Flow Logs