DEA-C01 Data Security and Governance Practice Test 28 — 15 Questions

Question 1

A company stores sensitive data in Amazon Redshift. The security team requires that all data in the cluster be encrypted at rest using a customer managed key in AWS KMS, and that the key be rotated annually. The data engineer needs to configure the Redshift cluster accordingly. Which action should the engineer take?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable Redshift cluster encryption using AWS KMS and select the customer managed key. Configure automatic key rotation for the KMS key with a 365-day rotation period.. To encrypt a Redshift cluster at rest with a customer managed KMS key, you enable encryption on the cluster and select the key. To rotate the key annually, you enable automatic rotation on that KMS key with a 365-day period. These are separate configurations but together satisfy the requirements.

Answer

Use Redshift Spectrum to query data in S3 that is encrypted with SSE-KMS, and enable key rotation on the S3 bucket's default key.

Answer

Enable Redshift cluster encryption using AWS KMS and set the cluster parameter require_ssl to true.

Answer

Enable Redshift cluster encryption using AWS KMS and create a scheduled AWS Lambda function that calls kms:RotateKey on the key annually.

Question 2

A data engineer is designing a data lake on Amazon S3 that contains personally identifiable information (PII). The compliance team requires that all access to the data be logged and that any attempt to delete or modify data be detected and alerted. The engineer enables AWS CloudTrail data events for the S3 bucket and configures Amazon CloudWatch alarms. Which additional AWS service should the engineer use to automatically detect and remediate unauthorized changes to the S3 bucket's ACLs or policies?

Accepted Answer

AWS Config with managed rules and automatic remediation.. AWS Config is designed to assess, audit, and evaluate configurations of AWS resources. With managed rules for S3, it can detect changes to ACLs and policies, and trigger automatic remediation via SSM Automation. Other services like Macie, Trusted Advisor, and GuardDuty focus on data classification, recommendations, or threat detection, not configuration compliance and remediation.

Answer

AWS Trusted Advisor with S3 bucket permissions checks.

Answer

Amazon Macie with custom data identifiers.

Answer

Amazon GuardDuty with S3 protection.

Question 3

A data engineer must give an AWS Glue ETL job temporary access to data in an Amazon S3 bucket without creating long-term IAM user access keys. The job runs on a schedule and must retrieve credentials automatically. Which mechanism should the engineer use?

Accepted Answer

Attach an IAM role to the AWS Glue job and let the service assume it to obtain temporary credentials automatically.. AWS Glue jobs are associated with an IAM role that the service assumes to call other AWS services. The Glue runtime and AWS SDK automatically obtain temporary credentials from that role, so the job can read S3 data without any stored access keys. This satisfies the no-long-term-credentials requirement and follows AWS best practice for service-to-service authorization.

Answer

Store an IAM user's access key and secret key in AWS Secrets Manager and have the Glue job retrieve them at runtime.

Answer

Generate a pre-signed URL for each S3 object and pass the URLs as job parameters to the Glue script.

Answer

Create an IAM user with programmatic access and embed the access key in the Glue job script as a hard-coded variable.

Question 4

A company's security policy states that no S3 bucket in the data platform account may ever be made public, even accidentally. A data engineer must implement a guardrail that blocks any attempt to set a public bucket ACL or public bucket policy, regardless of who makes the change. Which solution enforces this requirement?

Accepted Answer

Enable S3 Block Public Access at the account level and ensure the setting remains on for all existing and future buckets.. S3 Block Public Access at the account level prevents public ACLs and policies for every bucket, including future ones, and can be locked down via AWS Organizations. Detective controls such as AWS Config rules or logging only report exposure after the fact. The requirement is preventive, account-wide, and independent of who attempts the change, which the account-level block setting delivers.

Answer

Configure AWS Config with the s3-bucket-public-read-prohibited and s3-bucket-public-write-prohibited managed rules and rely on their evaluations.

Answer

Turn on S3 server access logging and create an Amazon EventBridge rule that notifies the security team when a public ACL is applied.

Answer

Create an S3 bucket policy that denies s3:PutBucketAcl and s3:PutBucketPolicy for all principals in the account.

Question 5

A data engineer is using AWS Lake Formation to manage fine-grained access to a data lake in Amazon S3. The engineer grants a data analyst SELECT permission on a table but wants to ensure that the analyst cannot access columns containing sensitive data such as social security numbers. The table is registered in the AWS Glue Data Catalog. Which Lake Formation feature should the engineer use to restrict access to specific columns?

Accepted Answer

Column-level security in Lake Formation permissions.. Lake Formation column-level security allows granting SELECT on a subset of columns, effectively hiding sensitive columns from unauthorized users. Row-level security filters rows, not columns. Glue Data Catalog policies and S3 bucket policies do not provide column-level granularity for query engines.

Answer

Row-level security using filter expressions in Lake Formation.

Answer

S3 bucket policies with prefix-based restrictions.

Answer

AWS Glue Data Catalog resource policies.

Question 6

A data engineer manages an AWS Glue job that reads from an Amazon S3 bucket containing PII. The security team requires that the data be encrypted at rest using a customer-managed AWS KMS key, and that the engineer be able to audit key usage. The engineer has already created a KMS key. Which combination of steps should the engineer take to meet these requirements?

Accepted Answer

Configure the S3 bucket to use SSE-KMS with the customer-managed key, and enable AWS CloudTrail logging for KMS API calls.. SSE-KMS with a customer-managed key provides control over the encryption key and enables auditing via CloudTrail, which logs all KMS API calls. This meets both the encryption at rest and auditability requirements. Other options either use AWS-managed keys or do not provide the necessary audit detail.

Answer

Use SSE-S3 for the S3 bucket and enable S3 server access logging to track key usage.

Answer

Enable default encryption on the S3 bucket with SSE-KMS using the AWS managed key aws/s3, and enable AWS CloudTrail data events for S3.

Answer

Configure the Glue job to use client-side encryption with a customer-managed KMS key, and enable AWS CloudTrail management events.

Question 7

A data engineer is configuring an AWS Glue ETL job that processes data from an Amazon S3 bucket. The security team requires that all data in transit between AWS Glue and Amazon S3 be encrypted using TLS. The engineer needs to ensure that the Glue job uses HTTPS endpoints when reading from and writing to S3. Which action should the engineer take?

Accepted Answer

No action is needed; AWS Glue uses HTTPS for S3 by default.. AWS Glue uses the AWS SDK to interact with Amazon S3, and the SDK uses HTTPS endpoints by default. This means data in transit is encrypted with TLS without any additional configuration. There is no need for special job parameters, connection settings, or IAM permissions to enable TLS. The correct action is to recognize that no action is needed.

Answer

Ensure that the Glue job's IAM role has permissions to use HTTPS, and no further configuration is needed.

Answer

Add the --enable-s3-ssl parameter to the Glue job's job parameters.

Answer

Configure the Glue connection to use an S3 endpoint with the https:// prefix.

Question 8

A data engineer is using AWS Lake Formation to manage permissions on a Data Catalog table backed by Amazon S3. Analysts query the table with Amazon Athena. The security team wants analysts to see only rows where the region column equals 'EU' and to prevent them from viewing the customer_id column entirely. Which combination of Lake Formation features should the engineer implement?

Accepted Answer

Define a Lake Formation data filter with a row filter expression region='EU' and exclude the customer_id column, then grant the analysts SELECT on the table with that filter.. Lake Formation data filters combine row filter expressions with column selection. A row filter of region='EU' restricts visible rows, and excluding customer_id from the filter removes that column from query results. Granting analysts SELECT on the table through the filter applies both restrictions automatically for Athena and other integrated engines without duplicating or transforming the underlying data.

Answer

Use AWS Glue DataBrew to create a project that removes the customer_id column and filters to EU rows, then publish the result as a new table for analysts.

Answer

Attach a tag-based access control policy to the table that grants access only when the analyst's IAM principal carries a tag matching the region value.

Answer

Create an IAM policy that allows Athena access only to the S3 prefix containing EU data and deny access to the customer_id column in the Data Catalog.

Question 9

A data engineer is preparing an AWS Glue ETL job that reads from and writes to Amazon S3 and must audit every access to sensitive data for compliance. The security team wants to know which principals accessed which objects and when, and also wants to detect anomalous access patterns. Which TWO AWS services should be used together to meet these requirements? (Choose two.)

Accepted Answer

Amazon GuardDuty S3 Protection. CloudTrail data events capture object-level API activity with caller identity, bucket, key, and time, forming the required audit trail for sensitive object access. GuardDuty S3 Protection analyzes that activity to surface anomalous or suspicious access. Together they provide both the detailed record and the detection capability, while inventory, bookmarks, and Macie address classification or processing state rather than access auditing.

Answer

Amazon Macie sensitive data discovery jobs

Answer

Amazon S3 Inventory reports

Answer

AWS Glue job bookmarks

Question 10

A company stores sensitive financial data in Amazon S3 and requires that all data be encrypted at rest using customer-managed keys. A data engineer configures the S3 bucket to use SSE-KMS with a customer-managed KMS key. The security team now wants to audit all API calls that use the KMS key to decrypt data. Which AWS service should the engineer use to capture and review these KMS API calls?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the service that records API activity in your AWS account, including KMS operations. By enabling CloudTrail, you can audit who used the KMS key and when. AWS Config, CloudWatch Logs, and Trusted Advisor do not provide the same level of API call logging for KMS.

Answer

AWS Config

Answer

AWS Trusted Advisor

Answer

Amazon CloudWatch Logs

Question 11

A data engineer manages an AWS Glue Data Catalog shared across teams. Analysts in one team must be able to query only the sales database and its tables, while another team owns the marketing database. The engineer wants permissions managed centrally in Lake Formation and wants the analysts to be able to create their own temporary tables but not alter the sales tables. Which combination of Lake Formation grants should the engineer apply?

Accepted Answer

Grant DESCRIBE and SELECT on the sales database and its tables to the analysts, and grant CREATE_TABLE on a separate scratch database for their temporary tables.. Least privilege in Lake Formation separates read permissions from modification and creation rights. DESCRIBE and SELECT on the sales database and tables allow discovery and querying, while withholding ALTER and DROP prevents changes to production tables. CREATE_TABLE on a dedicated scratch database lets analysts build temporary tables safely, keeping marketing data and the sales schema protected and centrally governed.

Answer

Grant ALL on the sales database to the analysts and rely on IAM policies to restrict which tables they can alter.

Answer

Grant SELECT on the sales tables and DESCRIBE on the sales database, and grant ALL on the marketing database to the analysts.

Answer

Grant DESCRIBE and SELECT on the sales database and tables, and grant ALTER on the sales database so analysts can create temporary tables there.

Question 12

A data engineer manages an AWS Glue Data Catalog table that contains sensitive customer PII. The table's underlying data is in Amazon S3 and is queried by several AWS analytics services. The security team wants to implement column-level access control so that only authorized principals can view the PII columns, while other principals can still query non-sensitive columns. The solution must integrate with AWS Lake Formation and be enforced consistently across all query engines. Which approach should the data engineer take?

Accepted Answer

Register the S3 bucket as a Lake Formation data location, then grant column-level permissions on the table using Lake Formation.. Lake Formation column-level permissions are designed to provide fine-grained access control on tabular data in the Data Catalog. By registering the S3 location and granting column-level permissions, the data engineer can restrict access to sensitive columns while allowing queries on other columns. This enforcement is consistent across integrated analytics services.

Answer

Implement an S3 bucket policy that allows only certain prefixes and use separate buckets for PII and non-PII data.

Answer

Create an IAM policy that denies access to the PII columns and attach it to the roles used by the analytics services.

Answer

Use AWS Glue Data Catalog resource policies to restrict access to specific columns in the table.

Question 13

A data engineer is using AWS Glue to process data stored in Amazon S3. The security team requires that all data in transit between AWS Glue and Amazon S3 be encrypted using TLS. The engineer has verified that the Glue job uses the AWS Glue Data Catalog and that the S3 bucket policy allows access. What should the engineer do to ensure that the Glue job enforces TLS when reading from and writing to S3?

Accepted Answer

Attach an IAM policy to the Glue job role that denies requests where the aws:SecureTransport condition is false.. To enforce TLS for AWS Glue access to S3, an IAM policy denying requests when aws:SecureTransport is false is the most direct method. This condition key evaluates to true for HTTPS requests and false for HTTP. By denying when false, all non-TLS requests are blocked. This applies to any principal using the role, including AWS Glue, ensuring encryption in transit.

Answer

Configure the Glue job to use the --enable-tls parameter.

Answer

Enable S3 default encryption on the bucket to enforce TLS.

Answer

Use an S3 VPC endpoint with a policy that allows only TLS connections.

Question 14

A healthcare company uses AWS Lake Formation to manage access to a data lake in Amazon S3. The data lake contains a table with patient records, and the company needs to ensure that only users in the 'Cardiology' department can query columns containing sensitive information such as patient name and diagnosis. Other departments should be able to query non-sensitive columns like patient ID and visit date. The company wants to implement this with the least operational overhead. What should the data engineer do?

Accepted Answer

Use Lake Formation column-level security to grant SELECT on the sensitive columns only to the Cardiology department role, and grant SELECT on non-sensitive columns to all other department roles.. Lake Formation column-level security allows granular access control at the column level, enabling the company to grant SELECT on sensitive columns only to the Cardiology department while allowing other departments to query non-sensitive columns. This approach centralizes permission management and requires no data duplication or custom ETL, minimizing operational overhead. It is the intended solution for fine-grained access control in a data lake.

Answer

Create an AWS Glue ETL job that reads the table, filters out sensitive columns based on the user's department, and writes the results to separate S3 buckets for each department. Grant each department access to its respective bucket.

Answer

Use AWS Identity and Access Management (IAM) policies to deny access to the sensitive columns for all departments except Cardiology. Attach these policies to the IAM roles used by each department.

Answer

Configure an Amazon Athena workgroup for each department and use Athena's column-level access control to restrict sensitive columns. Grant each department's users access to their workgroup.

Question 15

A data engineer is configuring an AWS Glue ETL job that reads from and writes to an Amazon S3 bucket. The security team requires that all data in transit between AWS Glue and Amazon S3 be encrypted using TLS, and that the job must fail if TLS is not used. Which two actions should the data engineer take to meet these requirements? (Choose two.)

Accepted Answer

Attach a bucket policy that denies s3:GetObject requests where aws:SecureTransport is false.. To enforce TLS for all data in transit between AWS Glue and Amazon S3, you must deny both read and write requests that do not use TLS. Bucket policies that deny s3:GetObject and s3:PutObject when aws:SecureTransport is false accomplish this. Default encryption, VPC endpoint policies, and Transfer Acceleration do not universally enforce TLS for all Glue-to-S3 traffic or cause the job to fail on insecure connections.

Answer

Enable default encryption on the S3 bucket using SSE-S3.

Answer

Configure the Glue job to use a VPC endpoint for Amazon S3 and set the endpoint policy to require TLS.

Answer

Enable S3 Transfer Acceleration on the bucket.