DEA-C01 Data Security and Governance Practice Test 24 — 15 Questions

Question 1

Refer to the exhibit. A data engineer runs the AWS CLI command shown to encrypt a file using AWS KMS. The command succeeds. Later, the engineer tries to decrypt the file using the same key but without providing an encryption context. The decryption fails. What is the most likely reason?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The encryption context must be provided during decryption.. When encrypting data with AWS KMS, an encryption context can be provided as additional authenticated data (AAD). This context must be supplied during decryption; otherwise, decryption fails. The command succeeded during encryption, so the key is not disabled (B is wrong) and the key policy is not the issue (A is wrong). File corruption would cause a different error (C is wrong).

Answer

The KMS key policy does not allow decryption.

Answer

The KMS key has been disabled.

Answer

The plaintext file was corrupted.

Question 2

Refer to the exhibit. An IAM policy is attached to a user. What is the security implication of this policy?

Accepted Answer

The policy grants excessive permissions, violating least privilege.. The policy, which grants full S3 access to all resources, violates the principle of least privilege by providing excessive permissions. Option A is incorrect because the policy does not only allow read access; it allows all actions. Option B is incorrect because the use of asterisks is valid syntax in IAM policies. Option C is incorrect because the policy is overly permissive, not restrictive.

Answer

The policy only allows read access.

Answer

The policy is invalid because it uses asterisks.

Answer

The policy is too restrictive.

Question 3

A company is using an Amazon RDS for PostgreSQL database to store personally identifiable information (PII). The security team wants to ensure that database administrators cannot view the plaintext PII data. Which solution should a data engineer implement?

Accepted Answer

Use client-side encryption with AWS KMS to encrypt PII before inserting into the database. Using AWS KMS with client-side encryption ensures that data is encrypted before being sent to RDS, so database administrators cannot read the plaintext. Dynamic data masking in RDS is not natively supported; application-level masking would be needed. RDS encryption at rest protects data on disk but DBAs with access can still query plaintext. Using IAM policies to restrict access does not prevent DBAs with database credentials from viewing data.

Answer

Use IAM policies to restrict DBA access to the RDS instance

Answer

Enable Dynamic Data Masking in RDS to obfuscate PII for all users

Answer

Enable encryption at rest for the RDS instance using AWS KMS

Question 4

A company wants to audit all changes to IAM policies in their AWS account. Which AWS service should be used to record these changes for compliance purposes?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records API calls, including IAM policy changes. AWS Config records resource configurations but not all API calls. CloudWatch Logs can store logs but does not record API calls itself. S3 is the destination for logs, not the recording service.

Answer

Amazon CloudWatch Logs

Answer

AWS Config

Answer

Amazon S3

Question 5

A data engineer is configuring an S3 bucket policy to allow cross-account access for a partner account to read objects. The bucket is encrypted with SSE-KMS using a customer-managed key. What additional configuration is needed to allow the partner account to decrypt the objects?

Accepted Answer

Update the KMS key policy to grant the partner account kms:Decrypt permission. For cross-account access with SSE-KMS, the KMS key policy must grant the partner account access to use the key. The bucket policy alone is insufficient. The partner account does not need VPC endpoints, and the bucket policy for decryption is not needed. The partner account does not need access to the S3 bucket's encryption configuration.

Answer

Add a bucket policy that grants the partner account s3:GetObject

Answer

Create a VPC endpoint for S3 and add it to the bucket policy

Answer

Add a bucket policy that grants s3:GetObject and s3:GetEncryptionConfiguration

Question 6

A company uses AWS Lake Formation to manage data lake permissions. The data engineer notices that a user with SELECT permission on a table can also query the underlying data in Amazon S3 directly. How can the engineer enforce that access to the S3 data is only through Lake Formation?

Accepted Answer

Grant the user permissions only through Lake Formation and remove any IAM policies that allow direct S3 access to the data location. Lake Formation permissions are enforced only when the caller accesses data through a Lake Formation-integrated engine (Athena, Redshift Spectrum, EMR, Glue). If the user also has IAM permissions on the underlying S3 path, they can bypass Lake Formation entirely by reading S3 directly. The fix is to remove those direct S3 IAM permissions so the only path to the data is through Lake Formation-governed services.

Answer

Use S3 Access Points with a policy that restricts access to only Lake Formation

Answer

Enable S3 Block Public Access on the bucket

Answer

Change the S3 bucket policy to deny all access except from Lake Formation

Question 7

A company wants to securely store database credentials used by a Lambda function. Which AWS service should be used to store and rotate the credentials automatically?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is purpose-built for storing, retrieving, and automatically rotating secrets such as database credentials, API keys, and OAuth tokens. It natively integrates with Amazon RDS, Redshift, and DocumentDB to rotate credentials on a schedule using Lambda rotation functions. Lambda functions can retrieve secrets at runtime via the Secrets Manager API or the AWS Parameters and Secrets Lambda Extension, avoiding hardcoded credentials.

Answer

AWS CloudHSM

Answer

AWS Key Management Service (KMS)

Answer

AWS Systems Manager Parameter Store

Question 8

A company is using Amazon Redshift for analytics and needs to ensure that all data is encrypted at rest. The current cluster does not have encryption enabled. What is the most efficient way to enable encryption?

Accepted Answer

Create a snapshot of the cluster and restore it to a new cluster with encryption enabled. Redshift does not support enabling encryption on an existing cluster; a new encrypted cluster must be created and data migrated. Modifying the cluster configuration or parameter groups does not enable encryption. Creating a snapshot and restoring it to a new cluster with encryption enabled is the standard approach.

Answer

Change the cluster parameter group to enable encryption

Answer

Modify the cluster configuration to enable encryption

Answer

Use AWS DMS to migrate data to a new encrypted cluster

Question 9

A data engineer needs to grant a data scientist access to query a Glue Data Catalog database but must prevent the data scientist from seeing the underlying S3 data locations. Which approach should be used?

Accepted Answer

Use AWS Lake Formation to grant SELECT permission on the database and tables without granting S3 access. AWS Lake Formation allows fine-grained access control at the database, table, and column level without requiring direct S3 permissions. By granting SELECT on the Glue Data Catalog database and tables through Lake Formation, the data scientist can query the data via Athena or Redshift Spectrum while Lake Formation handles credential vending to access S3 on their behalf. This meets the requirement of preventing the data scientist from seeing the underlying S3 locations.

Answer

Use a Glue resource policy to restrict access to the database

Answer

Grant the data scientist IAM permissions to access the Glue Data Catalog and the underlying S3 data

Answer

Create a VPC endpoint for Glue and S3 to restrict network access

Question 10

A company has an S3 bucket that stores logs for compliance. The compliance team requires that objects are retained for 7 years and cannot be deleted or overwritten. Which S3 feature should be used?

Accepted Answer

Enable S3 Object Lock with retention mode COMPLIANCE and a retention period of 7 years. S3 Object Lock in COMPLIANCE mode enforces a WORM (Write Once Read Many) model where no user, including the root account, can delete or overwrite the object version until the retention period expires. Setting a 7-year retention period directly satisfies the compliance requirement that objects cannot be deleted or overwritten for 7 years. COMPLIANCE mode is the strictest retention mode and is specifically designed for regulatory retention scenarios.

Answer

Enable MFA Delete on the bucket

Answer

Configure an S3 bucket policy that denies delete and overwrite actions

Answer

Enable S3 Versioning and configure a lifecycle policy to expire objects after 7 years

Question 11

A company needs to protect sensitive data stored in Amazon S3 from unauthorized access. Which TWO actions should the data engineer take? (Choose two.)

Accepted Answer

Configure S3 bucket policies to require MFA for delete operations. Option A is correct because an S3 bucket policy can include a condition such as aws:MultiFactorAuthPresent to deny s3:DeleteObject or s3:DeleteBucket unless the request is authenticated with MFA, adding a strong control against unauthorized or accidental deletion of sensitive data. Option D is correct because enabling S3 Block Public Access at the account level applies the four block-public-access settings to every bucket in the account, preventing bucket policies or ACLs from exposing objects publicly and thus blocking a major unauthorized-access vector. Option B is not correct because cross-region replication is a durability/availability and compliance feature that copies objects to another region; it does not by itself prevent unauthorized access. Option C is not correct because a Lifecycle policy transitioning objects to Glacier is a cost/storage-class management action, not an access-control mechanism. Option E is not correct because S3 Versioning preserves prior object versions for recovery but does not restrict who can read or access the data.

Answer

Enable cross-region replication for all buckets

Answer

Set up an S3 Lifecycle policy to transition objects to Glacier

Answer

Enable S3 Versioning on all buckets

Question 12

A company is using AWS KMS to encrypt data in Amazon S3. The security team wants to ensure that only specific IAM roles can decrypt the data. Which TWO steps should the data engineer take? (Choose two.)

Accepted Answer

Create a customer-managed KMS key with a key policy that grants kms:Decrypt only to the allowed IAM roles. Option C is correct because a customer-managed KMS key allows you to define a key policy that explicitly grants kms:Decrypt only to the specific IAM roles, which is the core mechanism for restricting decryption permissions in KMS. Option E is correct because the S3 bucket must be configured to use SSE-KMS with that customer-managed key; otherwise, S3 would use a different key (such as the default aws/s3 key) and the key policy restriction would not apply to the objects. Option A is incorrect because the default AWS managed key aws/s3 has a key policy managed by AWS that grants broad permissions to the account, so it cannot be scoped to only specific IAM roles. Option B is incorrect because SSE-S3 uses AES-256 with S3-managed keys and does not involve KMS or IAM role-based decrypt permissions at all. Option D is incorrect because requiring MFA for kms:Decrypt adds an authentication condition but does not by itself limit decryption to specific IAM roles, and MFA is not the mechanism that enforces role-level restriction.

Answer

Use the default AWS managed KMS key for S3 (aws/s3)

Answer

Use SSE-S3 encryption instead of KMS

Answer

Add an IAM policy to the role that requires MFA for kms:Decrypt

Question 13

Refer to the exhibit. A data engineer checks the versioning status of an S3 bucket and sees the above output. The bucket contains critical logs that must not be permanently deleted. What should the engineer do to enhance protection against accidental or malicious deletion?

Accepted Answer

Enable MFA Delete on the bucket. Enabling MFA Delete on the bucket adds an extra layer of protection by requiring multi-factor authentication for permanently deleting object versions or changing the versioning state. Since the bucket already has versioning enabled (as shown in the exhibit), MFA Delete is the appropriate enhancement to prevent accidental or malicious permanent deletion.

Answer

Enable versioning on the bucket

Answer

Enable cross-region replication

Answer

Configure a lifecycle policy to expire noncurrent versions

Question 14

A data engineer needs to grant an IAM role read-only access to Amazon DynamoDB tables in a specific AWS account. Which IAM policy element should be used to restrict access to only the 'GetItem' and 'Query' actions?

Accepted Answer

Action. The Action element in an IAM policy specifies the AWS API operations that the policy allows or denies. To restrict access to only 'GetItem' and 'Query' on DynamoDB tables, you list these actions in the Action element, e.g., 'dynamodb:GetItem' and 'dynamodb:Query'. This directly controls which operations the role can perform, making it the correct choice for limiting permissions to specific actions.

Answer

Resource

Answer

Effect

Answer

Condition

Question 15

A company stores sensitive customer data in an Amazon S3 bucket with versioning enabled. A data engineer accidentally deleted the current version of an object. What is the quickest way to restore the object to its previous state without additional data transfer costs?

Accepted Answer

Delete the delete marker that was created by the deletion.. With S3 versioning enabled, deleting an object does not permanently remove it; instead, a delete marker is placed. To restore the object to its previous state, you simply remove the delete marker, which makes the previous version the current version again. Option A is incorrect because S3 does not have a Recycle Bin; S3 Batch Operations are for bulk actions but not for restoring from a recycle bin. Option C would not restore the object properly; copying the previous version to itself would create a new version, not restore the original. Option D is incorrect because the s3 sync command synchronizes objects between locations and does not restore previous versions.

Answer

Use S3 Batch Operations to restore the object from the Recycle Bin.

Answer

Copy the previous version from the bucket to itself.

Answer

Use the S3 sync command to restore the previous version.