DEA-C01 Data Security and Governance Practice Test 23 — 15 Questions

Question 1

Refer to the exhibit. A data engineer applies this S3 bucket policy to an S3 bucket. What is the effect of this policy?

Accepted Answer

Allows only HTTPS requests to get and put objects, and denies HTTP requests.. The bucket policy allows GetObject and PutObject actions only when the request uses HTTPS, and explicitly denies all S3 actions when the request uses HTTP due to the condition `aws:SecureTransport=false`. Therefore, only HTTPS requests for Get and Put are permitted. Option A is incorrect because the policy does not restrict by IP addresses. Option C is incorrect because both Get and Put are allowed over HTTPS, not just Get. Option D is incorrect because the policy does not grant anonymous access; it requires secure transport and does not allow HTTP.

Answer

Allows access only from specific IP addresses.

Answer

Allows only GetObject actions over HTTPS.

Answer

Allows anonymous access to get and put objects over HTTP.

Question 2

Refer to the exhibit. A data engineer queries AWS CloudTrail to investigate a PutObject event. What does the exhibit reveal about the object sensitive.csv?

Accepted Answer

The object was uploaded with server-side encryption using AWS KMS.. The CloudTrail event contains `x-amz-server-side-encryption: aws:kms`, which confirms the object was uploaded with server-side encryption using AWS KMS (SSE-KMS). Option A is incorrect because the event shows a successful upload, not a failure. Option C is incorrect because the event indicates encryption was applied. Option D is incorrect because SSE-S3 would show `AES256`, not `aws:kms`.

Answer

The upload failed due to encryption mismatch.

Answer

The object was not encrypted at rest.

Answer

The object was encrypted with SSE-S3.

Question 3

A data engineer is troubleshooting an AWS Glue ETL job that fails with an access denied error when writing to an S3 bucket. The Glue job uses an IAM role that has an S3 bucket policy attached. The bucket policy denies access to any principal that does not use server-side encryption. What is the most likely cause of the failure?

Accepted Answer

The Glue job is not using server-side encryption when writing to S3.. If the Glue job does not set the encryption header (or the role does not have the kms:GenerateDataKey permission for SSE-KMS), the bucket policy will deny the request. Option A is wrong because Glue requires permissions on the S3 bucket and KMS key. Option B is wrong because VPC endpoints do not cause access denied errors for encryption. Option D is wrong because S3 Block Public Access does not deny write access to authorized roles.

Answer

The VPC endpoint policy for S3 is too restrictive.

Answer

The IAM role does not have s3:PutObject permission.

Answer

The S3 bucket uses S3 Block Public Access which denies all writes.

Question 4

A company wants to audit all data access events in their S3 buckets, including who accessed objects and from which IP address. Which AWS service should be used to capture these events?

Accepted Answer

AWS CloudTrail with data events enabled. AWS CloudTrail with data events enabled captures object-level S3 operations (GetObject, PutObject, DeleteObject) along with the identity of the caller and the source IP address, which is exactly what is needed for a full data access audit. Management events alone do not capture object reads/writes, so data events must be explicitly turned on.

Answer

Amazon CloudWatch Logs

Answer

AWS Config

Answer

Amazon S3 Server Access Logs

Question 5

A data engineer is configuring an S3 bucket to host sensitive data. The security policy requires that all objects be encrypted with a key that is generated and managed by the customer, and that the key be stored in AWS KMS. Which encryption option should be used?

Accepted Answer

Server-Side Encryption with AWS KMS-Managed Keys (SSE-KMS). SSE-KMS allows you to use customer-managed keys stored in AWS KMS, meeting the requirement for customer-generated and managed keys. Option A is incorrect because SSE-S3 uses AWS-managed keys, not customer-managed. Option B is incorrect because client-side encryption encrypts data outside S3, not using S3 server-side encryption. Option C is incorrect because SSE-C uses customer-provided keys that you manage yourself, but they are not stored in AWS KMS—you must provide them with each request.

Answer

Server-Side Encryption with S3-Managed Keys (SSE-S3)

Answer

Client-Side Encryption

Answer

Server-Side Encryption with Customer-Provided Keys (SSE-C)

Question 6

A data engineer is troubleshooting an ETL job that reads from an S3 bucket encrypted with SSE-KMS. The job is failing with an error indicating that the IAM role does not have permission to decrypt the data. What is the most likely missing permission?

Accepted Answer

kms:Decrypt. When an S3 object is encrypted with SSE-KMS, reading the object requires two sets of permissions: s3:GetObject on the object and kms:Decrypt on the KMS key used to encrypt it. The error explicitly states the IAM role lacks permission to decrypt, so the missing permission is kms:Decrypt. Without it, S3 cannot call KMS to decrypt the data key, and the GetObject call fails with AccessDenied.

Answer

kms:GenerateDataKey

Answer

s3:ListBucket

Answer

s3:GetObject

Question 7

A data engineering team needs to encrypt data at rest in an Amazon S3 bucket that stores sensitive customer information. The team must use an AWS Key Management Service (AWS KMS) customer managed key with automatic rotation enabled. Which configuration meets these requirements?

Accepted Answer

Use default encryption with SSE-KMS and specify the customer managed key ID.. It enables SSE-KMS with a customer managed key that supports automatic key rotation, meeting the requirement for a customer managed key with automatic rotation. Option B is incorrect because SSE-S3 uses AWS managed keys that are not customer-controlled and do not support automatic rotation. Option C is incorrect because SSE-C requires the customer to provide and manage their own keys, and does not support automatic rotation. Option D is incorrect because leaving the key ID empty defaults to the AWS managed KMS key, which is not a customer managed key and does not support automatic rotation.

Answer

Use default encryption with SSE-S3.

Answer

Use default encryption with SSE-C and provide a customer-provided key.

Answer

Use default encryption with SSE-KMS and leave the key ID empty to use the AWS managed key.

Question 8

A data engineer needs to audit all AWS KMS key usage events for the past 90 days to verify compliance. Which AWS service should be used?

Accepted Answer

AWS CloudTrail. (AWS CloudTrail). AWS CloudTrail logs all API calls made to AWS KMS, including key usage events, and retains event history for the past 90 days by default, making it suitable for auditing. Option A (VPC Flow Logs) captures network traffic, not API calls. Option C (AWS Config) tracks resource configuration changes, not API calls. Option D (Amazon Inspector) performs vulnerability assessments, not API logging.

Answer

VPC Flow Logs

Answer

AWS Config

Answer

Amazon Inspector

Question 9

A company needs to enforce encryption in transit for all data moving between its Amazon S3 bucket and a fleet of Amazon EC2 instances. The data is accessed via S3 API calls over the internet. Which configuration ensures encryption in transit?

Accepted Answer

Configure the bucket policy to deny requests that do not use HTTPS.. Configuring the bucket policy to deny requests that do not use HTTPS ensures encryption in transit for S3 API calls. Option A is wrong because SSE-S3 encrypts data at rest, not in transit. Option B is wrong because S3 Transfer Acceleration uses a global network but does not enforce encryption; HTTPS must still be used. Option C is wrong because a VPC endpoint for S3 uses AWS network but does not enforce encryption; the bucket policy must explicitly require HTTPS.

Answer

Enable SSE-S3 on the bucket.

Answer

Enable S3 Transfer Acceleration.

Answer

Use a VPC endpoint for S3.

Question 10

A data engineer is designing a data lake on Amazon S3 that must comply with a regulatory requirement to prevent any data from being overwritten or deleted for 7 years after creation. Which S3 feature should be used?

Accepted Answer

S3 Object Lock with retention mode set to COMPLIANCE. S3 Object Lock with retention mode set to COMPLIANCE ensures that objects cannot be overwritten or deleted for the specified retention period (7 years). The retention period cannot be shortened or removed by any user, including the root user, making it suitable for regulatory compliance. Option A is incorrect because a bucket policy that denies s3:DeleteObject can be modified or removed, and it does not prevent overwrites. Option B is incorrect because MFA Delete requires an additional authentication factor but can still be disabled by an authorized user, and it does not enforce a retention period. Option D is incorrect because bucket versioning alone does not prevent deletion; it only creates delete markers, and objects can still be permanently deleted.

Answer

S3 bucket policy that denies s3:DeleteObject

Answer

S3 bucket versioning with MFA Delete

Answer

S3 bucket versioning only

Question 11

A company wants to centrally manage access to multiple AWS accounts for its data engineers. The company already uses AWS Organizations. Which AWS service should be used to define fine-grained permissions across accounts?

Accepted Answer

AWS IAM Identity Center (AWS Single Sign-On). AWS IAM Identity Center (formerly AWS Single Sign-On) is designed to centrally manage access to multiple AWS accounts within AWS Organizations. It allows you to define fine-grained permissions using permission sets and assign them to users or groups across accounts.

Answer

AWS IAM

Answer

AWS Resource Access Manager (AWS RAM)

Answer

AWS Key Management Service (AWS KMS)

Question 12

A company uses Amazon RDS for MySQL to store financial data. A compliance requirement mandates that all database connections must be encrypted. Which configuration step is necessary?

Accepted Answer

Set the RDS parameter require_secure_transport to 1.. For Amazon RDS for MySQL, the parameter require_secure_transport controls whether the DB instance accepts only SSL/TLS-encrypted connections. Setting it to 1 enforces encryption for all client connections, satisfying the compliance mandate. This is the direct, database-level control for connection encryption, distinct from storage encryption or network isolation.

Answer

Create the RDS DB instance in a private subnet.

Answer

Enable encryption for the RDS DB instance at creation time.

Answer

Configure the VPC security group to only allow traffic from certain IPs.

Question 13

A data engineer needs to share a dataset stored in an S3 bucket with a partner AWS account. The partner should be able to read the data without needing to authenticate with the engineer's account. The engineer must not share any secret keys. Which approach should be used?

Accepted Answer

Write a bucket policy that grants access to the partner account's IAM role.. A bucket policy granting read access to the partner account's IAM role is the correct approach because it enables cross-account access without sharing credentials. The partner's IAM role assumes its own identity, and the bucket policy explicitly authorizes that principal, so no secret keys are exchanged. This is the standard AWS cross-account access pattern for S3 data sharing.

Answer

Generate presigned URLs and share them with the partner.

Answer

Make the bucket publicly readable.

Answer

Create an IAM user with access keys and share them with the partner.

Question 14

A company uses Amazon Redshift for data warehousing. The security team requires that all data in transit between the Redshift cluster and clients be encrypted. Which feature should be enabled?

Accepted Answer

SSL/TLS encryption. Amazon Redshift supports SSL/TLS encryption for client connections to ensure data in transit is encrypted. Option A (Client-side VPN) is not a Redshift feature for encrypting client connections. Option C (AWS KMS key) is used for encrypting data at rest, not in transit. Option D (VPC peering) does not provide encryption of data in transit between the cluster and clients.

Answer

Client-side VPN

Answer

AWS KMS key

Answer

VPC peering

Question 15

A company must comply with a regulation that requires logging all access to sensitive data stored in Amazon S3. Which AWS services can be used to capture and store access logs? (Choose TWO.)

Accepted Answer

AWS CloudTrail. AWS CloudTrail (C) is correct because it records S3 data events (GetObject, PutObject, DeleteObject) for object-level access to sensitive data, delivering an audit trail of every API call to the S3 bucket. Amazon S3 server access logs (D) are also correct because they capture detailed, object-level records of every request made to a bucket, including requester, operation, and response status, and can be stored in a target bucket for compliance. AWS Config (A) evaluates resource configuration and compliance over time but does not log individual data access requests. Amazon CloudWatch Logs (B) stores and monitors log data but does not itself capture S3 access events. VPC Flow Logs (E) capture IP traffic metadata at the ENI/subnet level and cannot record S3 object-level access.

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Answer

VPC Flow Logs