DEA-C01 Data Security and Governance Practice Test 25 — 15 Questions

Question 1

A data engineer is configuring an Amazon Redshift cluster to encrypt data at rest. The company policy requires that encryption keys be stored in AWS CloudHSM. Which integration should the engineer use to meet this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure Redshift to use an HSM for encryption.. Amazon Redshift supports encryption at rest using either AWS KMS or a hardware security module (HSM) via CloudHSM. When company policy mandates that encryption keys be stored in AWS CloudHSM, the engineer must configure Redshift to use an HSM connection for encryption, which is the only option that satisfies the CloudHSM key storage requirement.

Answer

Use AWS KMS with a customer managed key.

Answer

Enable encryption using the AWS Redshift SSL/TLS feature.

Answer

Use Redshift automatic key rotation.

Question 2

A company uses AWS Lake Formation to manage data lakes on Amazon S3. The data engineer needs to grant a data analyst access to query specific columns in a table using Amazon Athena, but deny access to columns containing personally identifiable information (PII). Which Lake Formation feature should be used?

Accepted Answer

Column-level permissions in Lake Formation.. Lake Formation column-level permissions allow a data engineer to grant SELECT on specific columns of a table while excluding others, which is exactly what is needed to hide PII columns from the analyst. When the analyst queries via Athena, Lake Formation enforces the column filter at query time, returning only the permitted columns. This is the native, fine-grained access control mechanism for column-level restrictions in Lake Formation.

Answer

Row-level security filters.

Answer

Tag-based access control with Lake Formation tags.

Answer

Cell-level security with AWS Glue.

Question 3

A company is using Amazon S3 to store log files. The security team requires that all data be encrypted in transit. Which of the following ensures encryption in transit for S3?

Accepted Answer

Use HTTPS (SSL/TLS) when accessing S3 endpoints.. Encryption in transit for Amazon S3 is ensured by using HTTPS (SSL/TLS) when accessing S3 endpoints. HTTPS encrypts data as it travels between the client and S3, protecting it from eavesdropping. This is the standard method to enforce encryption in transit for S3, and it can be enforced via bucket policies that deny requests not using HTTPS.

Answer

Use Amazon S3 Transfer Acceleration.

Answer

Enable client-side encryption before uploading to S3.

Answer

Use server-side encryption with S3 managed keys (SSE-S3).

Question 4

An organization wants to audit all API calls made to AWS services for compliance. Which AWS service should be used to capture and store these API calls?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records API activity across AWS services, capturing who made each call, from which IP, when, and with what parameters, and delivers the events to S3 and/or CloudWatch Logs for auditing. It is the canonical service for compliance auditing of API calls. AWS Config, VPC Flow Logs, and CloudWatch Logs serve different observability purposes.

Answer

AWS Config

Answer

Amazon VPC Flow Logs

Answer

Amazon CloudWatch Logs

Question 5

A data engineer is troubleshooting an issue where an Amazon Redshift query returns an error: 'ERROR:  permission denied for relation table_name'. The user has been granted SELECT on the table. What is the most likely cause?

Accepted Answer

The user does not have USAGE permission on the schema.. In Amazon Redshift, to access a table, a user must have USAGE permission on the schema containing the table, in addition to SELECT or other table-level permissions. Without USAGE on the schema, the user receives a 'permission denied for relation' error even if SELECT is granted. Option D is correct. Option A (session timeout) would cause a different error or disconnection. Option B (no CONNECT permission) would prevent connecting to the database. Option C (wrong schema) would result in a 'schema not found' error, not a permission denied error.

Answer

The user's session has timed out.

Answer

The user does not have CONNECT permission on the database.

Answer

The table is in a different schema than expected.

Question 6

A company needs to enforce encryption at rest for all data stored in Amazon S3. Which of the following are valid methods to achieve this? (Choose TWO.)

Accepted Answer

Enable default bucket encryption using SSE-S3.. Option B is correct because enabling default bucket encryption with SSE-S3 causes Amazon S3 to automatically encrypt every object at rest using AES-256 with S3-managed keys, satisfying the requirement without any client changes. Option D is correct because client-side encryption encrypts the data before it ever reaches S3, so the objects are stored in encrypted form and remain protected at rest regardless of server-side settings. Option A is incorrect because S3 Transfer Acceleration only speeds up uploads over AWS edge locations and does not encrypt data at rest. Option C is incorrect because S3 Versioning only preserves multiple object versions and does not provide encryption. Option E is incorrect because SSL/TLS protects data in transit between the client and S3, not data at rest in the bucket.

Answer

Use Amazon S3 Transfer Acceleration.

Answer

Enable S3 Versioning.

Answer

Use SSL/TLS for all S3 API calls.

Question 7

A data engineer is configuring a VPC for an Amazon Redshift cluster. The cluster must be accessible only from a specific on-premises network via a Direct Connect connection. Which TWO actions should the engineer take to meet this requirement? (Choose TWO.)

Accepted Answer

Configure a security group to allow inbound traffic from the on-premises CIDR block.. Option B is correct because a security group acts as the stateful firewall for the Redshift cluster, and adding an inbound rule that permits the on-premises CIDR block on the Redshift port (5439) is required to allow that specific network to reach the cluster. Option C is correct because the network ACL is the stateless subnet-level control, so it must also include an inbound rule allowing the on-premises CIDR block (and corresponding outbound return traffic) for the connection to succeed. Option A is not needed because Enhanced VPC Routing only affects how COPY/UNLOAD traffic is routed to S3 or other services, not client access from on-premises. Option D is wrong because a VPC endpoint is for private access to AWS services like S3, not for enabling on-premises clients to reach a Redshift cluster. Option E is wrong because making the cluster publicly accessible would expose it to the internet, violating the requirement to restrict access to the on-premises network only.

Answer

Enable Redshift Enhanced VPC Routing.

Answer

Create a VPC endpoint for Redshift.

Answer

Make the Redshift cluster publicly accessible.

Question 8

A company uses AWS Glue to process sensitive data stored in S3. The security team requires that all data be encrypted at rest using customer-managed KMS keys. The data engineers are encountering 'Access Denied' errors when running Glue ETL jobs. What is the most likely cause?

Accepted Answer

The Glue service role does not have kms:Decrypt and kms:Encrypt permissions for the KMS key.. To decrypt S3 objects encrypted with a customer-managed KMS key, the AWS Glue job's service role must have kms:Decrypt and kms:Encrypt permissions in its IAM policy, and the KMS key policy must grant that role access. The most likely cause of the Access Denied error is missing KMS permissions on the Glue service role (A). Option B is a possible KMS key policy denial, but it is less likely than missing IAM KMS permissions in this scenario and is not as direct. Option C is irrelevant because Data Catalog encryption uses a different key and does not prevent S3 object access. Option D would be an S3 bucket policy denial, not a KMS 'Access Denied'; the issue here is KMS permissions.

Answer

The KMS key policy does not allow the AWS Glue service to use the key.

Answer

The Glue Data Catalog is encrypted with a different KMS key.

Answer

The S3 bucket policy denies access to the Glue service role.

Question 9

A company needs to audit all API calls made in their AWS account, including actions performed by the root user. Which AWS service should be used?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records all API calls made in an AWS account, including root user actions, for auditing and compliance. Option A is incorrect because VPC Flow Logs capture network traffic metadata, not API calls. Option C is incorrect because Amazon CloudWatch Logs stores log data but does not natively capture API calls; it can ingest logs from other sources. Option D is incorrect because AWS Config tracks configuration changes to AWS resources, not API calls.

Answer

VPC Flow Logs

Answer

Amazon CloudWatch Logs

Answer

AWS Config

Question 10

A company wants to grant read-only access to an S3 bucket for a data analyst. The analyst should be able to list objects and read object content. Which IAM policy effect and action combination is correct?

Accepted Answer

Effect: Allow, Actions: s3:ListBucket, s3:GetObject. To grant read-only access to an S3 bucket, the policy must allow s3:ListBucket to list objects in the bucket and s3:GetObject to read object content. These actions are the minimum required for read-only access to a specific bucket.

Answer

Effect: Allow, Actions: s3:GetObject, s3:DeleteObject

Answer

Effect: Allow, Actions: s3:ListAllMyBuckets, s3:GetObject

Answer

Effect: Allow, Actions: s3:PutObject, s3:GetObject

Question 11

A company is using Amazon EMR with Kerberos authentication. They want to ensure that data in transit between EMR cluster nodes is encrypted. Which configuration should be applied?

Accepted Answer

Configure the EMR cluster to use in-transit encryption.. In-transit encryption on Amazon EMR is enabled through a security configuration that specifies a PEM certificate and, optionally, a TLS certificate provider, which encrypts traffic between cluster nodes and to the EMR service. This is the only option that directly addresses data in transit between nodes.

Answer

Use VPC peering to connect the cluster nodes.

Answer

Enable S3 server-side encryption for the cluster's output data.

Answer

Enable EBS encryption on the cluster instances.

Question 12

A data engineer needs to store sensitive data in Amazon S3 and automatically classify the data using a managed service. The data is uploaded via an S3 bucket. Which AWS service can automatically detect and classify sensitive data?

Accepted Answer

Amazon Macie. Amazon Macie is a fully managed data security and data privacy service that uses machine learning and pattern matching to automatically discover, classify, and protect sensitive data stored in Amazon S3. It continuously evaluates S3 buckets and identifies sensitive content such as PII, credentials, and financial data, generating findings that can be routed to EventBridge or Security Hub. This directly matches the requirement to automatically detect and classify sensitive data in S3.

Answer

AWS WAF

Answer

Amazon Inspector

Answer

AWS Shield

Question 13

A company is using AWS Lake Formation to manage permissions on a data lake. They want to grant a data scientist the ability to query tables in the 'analytics' database using Amazon Athena, but prevent them from accessing the underlying S3 data directly. What is the best way to achieve this?

Accepted Answer

Grant SELECT permission on the 'analytics' database tables in Lake Formation.. Lake Formation grants SELECT permission on named database tables, which allows querying via Athena without granting direct S3 access. Option A is incorrect because granting s3:GetObject on the entire bucket would allow the data scientist to bypass Lake Formation and access the data directly. Option C is incorrect because a policy that allows Athena queries only does not grant the necessary permissions to access the database tables. Option D is incorrect because adding the user to a data lake location with read access is too broad and would also grant direct S3 access, which does not meet the requirement of preventing direct S3 access.

Answer

Grant the data scientist an IAM policy with s3:GetObject on the S3 bucket.

Answer

Create an IAM policy that allows Athena queries only.

Answer

Add the data scientist to a Lake Formation data lake location with read access.

Question 14

A company is designing a data pipeline using Amazon Kinesis Data Streams. The data includes personally identifiable information (PII). The security team requires that data be encrypted at rest using a customer-managed KMS key. How should the data engineer configure the Kinesis stream?

Accepted Answer

Enable server-side encryption on the Kinesis stream and specify the customer-managed KMS key.. Amazon Kinesis Data Streams supports server-side encryption (SSE) with AWS KMS, and you can choose either an AWS-managed key (aws/kinesis) or a customer-managed KMS key. To meet the requirement of encryption at rest with a customer-managed key, you enable SSE on the stream and specify the customer-managed KMS key, which Kinesis uses to encrypt data as it is written to storage.

Answer

Configure the Kinesis stream to use AWS CloudHSM for encryption.

Answer

Store the encrypted data in S3 and use Kinesis to stream the S3 object keys.

Answer

Use client-side encryption in the producer application to encrypt data before sending to Kinesis.

Question 15

A company is using Amazon Redshift for data warehousing. They need to ensure that data is encrypted at rest and in transit. Which TWO configurations are required to meet these requirements?

Accepted Answer

Enable encryption on the Redshift cluster using AWS KMS.. Option A is correct because enabling encryption on the Redshift cluster using AWS KMS provides encryption at rest — Redshift uses KMS customer master keys to encrypt the cluster's data blocks and system metadata on disk. Option B is correct because configuring the Redshift cluster to require SSL connections (via the require_ssl parameter set to true in the cluster's parameter group) enforces encryption in transit for all client and JDBC/ODBC connections to the cluster. Option C is not required because Redshift's at-rest encryption is natively managed through AWS KMS, not CloudHSM, and CloudHSM is not a prerequisite for meeting these requirements. Option D is incorrect because VPC Flow Logs capture IP traffic metadata for network monitoring and do not encrypt data at rest or in transit. Option E is incorrect because Redshift manages its own storage encryption at the cluster level; enabling EBS encryption on cluster nodes is neither a supported nor a required configuration for Redshift data encryption.

Answer

Use AWS CloudHSM to manage encryption keys for Redshift.

Answer

Enable VPC Flow Logs on the Redshift subnet.

Answer

Enable EBS encryption on the Redshift cluster nodes.