DEA-C01 Data Security and Governance Practice Test 27 — 15 Questions

Question 1

A data engineer is building an AWS Glue job that reads from a JDBC source and must retrieve the database password at runtime without hardcoding it in the script or job parameters in plaintext. The company already stores the password in AWS Secrets Manager. Which action should the engineer take?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Grant the Glue job role secretsmanager:GetSecretValue on the secret ARN and retrieve the secret in the job using the Glue Secrets Manager connection property.. AWS Glue connections support a secretId property that fetches credentials from Secrets Manager at runtime. Granting the job role GetSecretValue on the specific secret keeps access narrow and avoids plaintext credentials in scripts or parameters, while also enabling rotation and audit through Secrets Manager.

Answer

Embed the password directly in the Glue ETL script and restrict access to the script in Amazon S3.

Answer

Use an IAM database authentication token for the JDBC connection instead of a password.

Answer

Store the password in an AWS Glue job parameter and mark it as encrypted using a KMS key.

Question 2

A data engineer is building an AWS Lambda function that processes records from an Amazon Kinesis data stream. The Lambda function needs to read from the stream and write processed data to an Amazon S3 bucket. The security team requires that all data in transit be encrypted using TLS, and that the Lambda function authenticate to Kinesis and S3 using temporary credentials. Which combination of configurations should the engineer use?

Accepted Answer

Assign an IAM role to the Lambda function with permissions for Kinesis and S3, and use the AWS SDK for Python (Boto3) to read and write data, relying on the SDK's default TLS.. AWS Lambda functions use an IAM role to obtain temporary credentials automatically. The AWS SDKs, such as Boto3, use TLS for all API calls by default, ensuring encryption in transit. This combination satisfies both the authentication and encryption requirements without manual key management. Other options either use long-term credentials, confuse encryption at rest with in transit, or use an inappropriate identity service.

Answer

Store long-term IAM user access keys in Lambda environment variables, and use them to sign requests to Kinesis and S3 over HTTPS.

Answer

Configure the Lambda function to use AWS KMS to encrypt the data before sending it to Kinesis and S3, and use an IAM role for authentication.

Answer

Use Amazon Cognito identity pools to provide temporary credentials to the Lambda function, and enable TLS on the Kinesis and S3 clients.

Question 3

A data engineer is using AWS Lake Formation to manage access to a data lake stored in Amazon S3. The engineer needs to grant a data analyst read access to specific columns in a table registered in the AWS Glue Data Catalog, while hiding other columns that contain personally identifiable information. The analyst uses Amazon Athena to query the table. Which Lake Formation feature should the engineer use?

Accepted Answer

Use Lake Formation column-level permissions to grant SELECT on only the allowed columns.. Lake Formation column-level permissions allow granular control over which columns a principal can access. By granting SELECT only on specific columns, the analyst can query the table via Athena but will receive errors or filtered results for unauthorized columns. This is the intended feature for hiding PII while enabling access to other data.

Answer

Use AWS Glue Studio to create an ETL job that copies only the allowed columns to a new table and grant access to that table.

Answer

Create a resource link to the table and grant SELECT on the link.

Answer

Apply an IAM policy to the analyst that allows s3:GetObject on the S3 path of the table.

Question 4

A data engineer is managing an AWS Glue Data Catalog that contains metadata for tables in Amazon S3. The security team requires that access to the Data Catalog be restricted based on the user's department, and that users can only see tables that belong to their department. The Data Catalog tables are tagged with a 'Department' key. Which AWS feature should the engineer use to enforce this requirement?

Accepted Answer

AWS Lake Formation tag-based access control (LF-TBAC) with tags on Data Catalog resources and matching IAM principals.. AWS Lake Formation tag-based access control (LF-TBAC) allows you to define permissions using tags on Data Catalog resources and IAM principals. This enables attribute-based access control, so users can only access tables with matching tags. This is the recommended way to implement fine-grained, scalable access control for the Glue Data Catalog. Other options either do not support tag-based filtering for the catalog or address the wrong resource.

Answer

Amazon S3 bucket policies that restrict access to objects based on the 'Department' tag on the S3 objects.

Answer

AWS Glue resource policies that allow or deny access based on the 'Department' tag.

Answer

IAM policies with condition keys that match the 'Department' tag on the Data Catalog tables.

Question 5

A data engineer manages an AWS Lake Formation governed data lake. Analysts in the finance department must query only the rows in a shared Amazon S3 table where the region column equals 'EMEA', while analysts in the marketing department must see all rows but must not see the customer_email column. Which TWO Lake Formation configurations should the data engineer implement to meet these requirements? (Choose two.)

Accepted Answer

Create a data filter on the table that excludes the customer_email column and grant SELECT on the table with that data filter to the marketing analyst role.. Lake Formation data filters are the native mechanism for row-level and column-level security. A data filter with a row expression scopes which rows a principal can read, and a data filter with an included column list scopes which columns are visible. Granting SELECT with the appropriate data filter to each analyst role enforces both requirements across integrated engines without copying or duplicating the underlying S3 objects.

Answer

Define an AWS Glue Data Catalog table property named column.filter with the value customer_email and a table property row.filter with the value region='EMEA', then grant DESCRIBE to both roles.

Answer

Register the S3 location with Lake Formation in hybrid access mode and grant the analysts ALL permissions so that IAM policies alone control row and column visibility.

Answer

Attach an IAM policy to the finance analyst role that denies s3:GetObject on any S3 prefix whose object metadata does not contain a region tag of EMEA.

Question 6

A company stores sensitive data in Amazon S3 and uses AWS KMS customer-managed keys for encryption. The security team wants to monitor and audit all KMS API calls that involve the key, including who used the key and when. They also want to receive alerts if the key is used by an unauthorized principal. Which AWS service should the data engineer use to meet these requirements?

Accepted Answer

AWS CloudTrail with KMS key usage logs, and Amazon CloudWatch alarms based on CloudTrail metrics.. AWS CloudTrail logs all KMS API calls, providing a detailed audit trail. To receive alerts on unauthorized usage, you can create CloudWatch metric filters on CloudTrail logs and set up CloudWatch alarms. This combination meets both the auditing and alerting requirements. Other services like AWS Config, GuardDuty, or Security Hub do not provide the same level of detailed API call logging and direct alerting for KMS usage.

Answer

Amazon GuardDuty with KMS protection, and AWS Lambda functions to remediate unauthorized access.

Answer

AWS CloudTrail with KMS key usage logs, and AWS Security Hub for automated alerts on unauthorized access.

Answer

AWS Config with KMS key configuration rules, and Amazon SNS notifications for noncompliance.

Question 7

A data engineer is configuring cross-account access so that an analytics AWS account can read objects from a data-lake S3 bucket in a producer account. The objects are encrypted with SSE-KMS using a customer managed key in the producer account. The engineer has already added a bucket policy granting s3:GetObject to the analytics account's IAM role. Reads still fail with AccessDenied. Which additional change is required?

Accepted Answer

Attach an IAM policy to the analytics role allowing kms:Decrypt and kms:DescribeKey, and update the KMS key policy to allow the analytics account role to use the key.. Reading SSE-KMS objects across accounts needs authorization on both sides: the identity must be allowed kms:Decrypt and the KMS key policy must trust that identity. A bucket policy granting s3:GetObject is necessary but not sufficient, because S3 calls KMS to unwrap the object's data key, and KMS independently evaluates its key policy. Both the identity policy and key policy must permit the analytics role.

Answer

Add s3:GetObjectVersion to the analytics role's IAM policy and include the s3:ExistingObjectTag condition in the bucket policy.

Answer

Enable S3 Block Public Access on the data-lake bucket and re-run the cross-account read.

Answer

Change the bucket's default encryption to SSE-S3 so that cross-account readers no longer need KMS permissions.

Question 8

A data engineer stores raw customer records in an Amazon S3 bucket and runs an AWS Glue job that writes curated Parquet files to a second bucket. The governance team requires that the curated data carry a verifiable record of which job run produced it and that any modification to a curated file be detectable. The engineer must also prove that the curated dataset has not been altered since a nightly baseline. Which combination of AWS features should the engineer use?

Accepted Answer

Compute an SHA-256 checksum per curated file, store the checksums and Glue job run IDs in a manifest, and use that manifest to verify the files against the nightly baseline.. Provenance and tamper evidence require linking each curated file to the job run that created it and being able to prove the bytes have not changed. A manifest that pairs a Glue job run ID with a per-file SHA-256 checksum delivers both. Comparing the nightly recomputed checksums against the baseline manifest surfaces any alteration, while versioning, CloudTrail, and Object Lock address adjacent concerns but not content integrity.

Answer

Enable AWS CloudTrail data events on the curated bucket and use AWS Glue job bookmarks to record the last processed run in the Data Catalog.

Answer

Enable S3 Versioning on the curated bucket and configure an S3 event notification to write each version ID to an Amazon DynamoDB table keyed by the Glue job run ID.

Answer

Enable S3 Object Lock in governance mode on the curated bucket and attach a retention period equal to the nightly baseline interval.

Question 9

A data engineer is configuring an AWS Glue ETL job that reads from an Amazon S3 bucket containing sensitive customer records. The security team requires that the job's data be encrypted at rest using a customer managed AWS KMS key, and that the key policy restrict usage to the specific IAM role used by the Glue job. The engineer has already created the KMS key and attached the necessary IAM policy to the Glue job role. What additional step is required to ensure the Glue job can decrypt the S3 data using the customer managed key?

Accepted Answer

Add a KMS key policy statement granting kms:Decrypt and kms:GenerateDataKey permissions to the Glue job's IAM role.. A customer managed KMS key requires that both the IAM policy of the calling principal and the KMS key policy grant the necessary permissions. The IAM policy alone is insufficient; the key policy must explicitly allow the Glue job's IAM role to use the key for decryption and data key generation. Without this key policy statement, the Glue job cannot decrypt the S3 objects.

Answer

Configure the S3 bucket to use SSE-S3 instead of SSE-KMS, because Glue cannot use customer managed keys.

Answer

Enable AWS CloudTrail logging for the KMS key to allow Glue to decrypt the data.

Answer

Attach an S3 bucket policy that grants the Glue job role s3:GetObject and s3:PutObject permissions.

Question 10

A data engineer must give an Amazon Redshift cluster the ability to load data from an Amazon S3 bucket using the COPY command. The security team prohibits embedding long-term AWS credentials in SQL and requires that access be revoked automatically when the cluster is deleted. The S3 bucket is encrypted with SSE-KMS using a customer managed key. Which approach should the data engineer use?

Accepted Answer

Attach an IAM role to the Redshift cluster, grant the role s3:GetObject on the bucket and kms:Decrypt on the customer managed key, and reference the role ARN in the COPY command.. Attaching an IAM role to the Amazon Redshift cluster lets the COPY command assume temporary credentials without any long-term keys in SQL. The role needs s3:GetObject on the bucket and kms:Decrypt on the customer managed key to read SSE-KMS encrypted objects. Because the role is associated with the cluster, deleting the cluster removes that association, so access is revoked automatically as the security team requires.

Answer

Configure the cluster with a database user that has a password stored in AWS Systems Manager Parameter Store and grant that user access to the S3 bucket through a bucket ACL.

Answer

Use the COPY command with the ACCESS_KEY_ID and SECRET_ACCESS_KEY parameters populated from an IAM role's temporary credentials obtained by calling AssumeRole from an external application.

Answer

Create an IAM user with an access key, store the key in AWS Secrets Manager, and pass the secret ARN to the COPY command using the CREDENTIALS clause.

Question 11

A data engineer manages an AWS Glue ETL job that processes sensitive customer records stored in Amazon S3. The security team mandates that all data at rest in the S3 bucket be encrypted with AWS KMS keys, and that the Glue job have the minimum permissions necessary to read and write data. The engineer creates a KMS key and configures the S3 bucket to use SSE-KMS with that key. Which additional step is required to allow the Glue job to access the encrypted data?

Accepted Answer

Attach an IAM policy to the Glue job's execution role that allows kms:Decrypt and kms:GenerateDataKey on the KMS key.. For an AWS Glue job to read and write SSE-KMS encrypted S3 objects, its execution role must have IAM permissions for kms:Decrypt and kms:GenerateDataKey on the specific KMS key. S3 bucket policies do not control KMS key access, and switching encryption types would violate requirements. VPC endpoints address network connectivity, not authorization.

Answer

Modify the S3 bucket policy to grant the Glue service principal kms:Decrypt and kms:GenerateDataKey permissions.

Answer

Enable default encryption on the S3 bucket using SSE-S3 instead of SSE-KMS to avoid KMS permission complexity.

Answer

Create a VPC endpoint for KMS and attach it to the Glue job's subnet to allow KMS traffic.

Question 12

A data engineer manages an AWS Glue ETL job that reads from an Amazon S3 bucket and writes to another bucket. The security team mandates that all data at rest in both buckets be encrypted with customer-managed AWS KMS keys, and that each service use a distinct key. The Glue job's IAM role currently has s3:GetObject and s3:PutObject permissions but jobs fail with an access denied error when writing output. What is the MOST likely cause?

Accepted Answer

The IAM role lacks kms:GenerateDataKey and kms:Decrypt permissions on the customer-managed KMS key used by the output bucket.. Writing to an S3 bucket encrypted with SSE-KMS using a customer-managed key requires both the S3 PutObject permission and KMS permissions on that key, specifically kms:GenerateDataKey for uploads and kms:Decrypt for downloads. The Glue execution role only has S3 permissions, so the KMS authorization check fails and S3 returns access denied. Granting the role the needed KMS actions on the output key fixes the job.

Answer

The output bucket uses SSE-S3 by default, which overrides the SSE-KMS setting and prevents the customer-managed key from being used.

Answer

The KMS key policy does not allow the AWS Glue service principal to use the key for cryptographic operations.

Answer

The S3 bucket policy on the output bucket does not include a statement allowing the Glue job role to perform s3:PutObject.

Question 13

A company uses AWS Lake Formation to manage access to a data lake in Amazon S3. A data engineer needs to grant a specific IAM role access to only the columns containing non-sensitive data in a table, while hiding columns with personally identifiable information (PII). The engineer has already registered the S3 bucket and the table in Lake Formation. What should the engineer do to meet this requirement?

Accepted Answer

Create a Lake Formation data filter that excludes the PII columns and grant SELECT permission on the filtered table to the IAM role.. Lake Formation data filters enable column-level security by allowing you to exclude specific columns from a table. When you grant SELECT permission on a filtered table, the user can only access the included columns. This meets the requirement of hiding PII columns while providing access to non-sensitive data, without duplicating data or altering S3 objects.

Answer

Attach a bucket policy to the S3 bucket that allows the IAM role to read only specific objects.

Answer

Use an IAM policy that denies access to the S3 prefixes containing the PII columns.

Answer

Configure an AWS Glue job to create a new table that omits the PII columns and grant access to that table.

Question 14

A healthcare company stores patient records in an Amazon S3 bucket encrypted with SSE-KMS using a customer managed key. A new AWS Glue ETL job must read these records and write transformed data to another S3 bucket that is also encrypted with the same KMS key. The company's security policy requires that the Glue job's access to the KMS key be least-privilege and auditable. Which TWO actions should the data engineer take to meet these requirements? (Choose two.)

Accepted Answer

Attach a key policy to the KMS key that allows the AWS Glue service role to use the key for decrypt and generateDataKey operations, scoped to the specific S3 buckets via encryption context conditions.. Access to SSE-KMS encrypted S3 objects requires permissions in both the KMS key policy and the IAM identity policy of the calling principal. The Glue service role must be granted only the necessary KMS operations (Decrypt and GenerateDataKey) on the specific key, with conditions to scope usage. This combination enforces least privilege and provides an auditable trail. Broad permissions or unrelated services do not meet the security policy.

Answer

Enable S3 Block Public Access on both S3 buckets and enable default encryption with SSE-S3 to simplify key management.

Answer

Grant the Glue service role kms:* permissions on all KMS keys in the account to ensure the job can read and write data without interruption.

Answer

Use AWS Lake Formation to grant the Glue job fine-grained access to the underlying S3 data and rely on Lake Formation to manage KMS permissions automatically.

Question 15

A data engineer maintains an AWS Glue Data Catalog with databases for several lines of business. Auditors require that every change to table definitions, partition additions, and schema edits in the catalog be recorded with the identity of the caller and that the records be retained for 365 days in a dedicated S3 bucket. Which solution should the data engineer implement?

Accepted Answer

Configure an AWS CloudTrail trail that logs management events, including AWS Glue Data Catalog API calls, and deliver the trail to the dedicated S3 bucket with a 365-day lifecycle rule.. AWS Glue Data Catalog mutations such as CreateTable, UpdateTable, and BatchCreatePartition are management events, and a CloudTrail trail that logs management events records the caller identity and request details for each. Delivering that trail to a dedicated S3 bucket with a 365-day lifecycle rule satisfies both the identity-capture and retention requirements, whereas data events, job logs, and AWS Config do not cover these catalog operations.

Answer

Enable AWS Glue job metrics and continuous logging, then export the logs to Amazon CloudWatch Logs with a retention period of 365 days.

Answer

Turn on AWS Config recording for the AWS::Glue::Table resource type and store configuration snapshots in the dedicated S3 bucket for 365 days.

Answer

Enable AWS CloudTrail data events for the AWS Glue Data Catalog and deliver the logs to the dedicated S3 bucket with a 365-day lifecycle retention policy.