DEA-C01 Data Security and Governance Practice Test 29 — 15 Questions

Question 1

A healthcare company stores patient records in an Amazon S3 bucket and uses AWS Lake Formation to manage access for multiple analytics teams. The compliance team requires that any column containing patient identifiers be masked by default for all users except a privileged data steward role. Which Lake Formation feature should the data engineer implement to meet this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a Lake Formation tag-based access control policy that attaches LF-Tags to the sensitive columns and grants access only to the steward role.. Lake Formation tag-based access control enables attribute-based permissions where LF-Tags on columns determine access. Tagging sensitive columns and granting only the steward role access ensures all other users are denied those columns by default, effectively masking them. This is a native Lake Formation governance feature that integrates with analytics services and provides fine-grained control without duplicating data.

Answer

Enable S3 Object Lock in governance mode on the bucket to prevent unauthorized access to sensitive objects.

Answer

Use AWS Glue DataBrew to create a masking recipe that anonymizes the sensitive columns before granting access.

Answer

Configure a data filter that excludes sensitive columns from the table definition.

Question 2

A data engineer stores sensitive records in an Amazon S3 bucket. The security team wants to guarantee that every object is encrypted before it is written to disk and that the bucket automatically rejects any unencrypted PUT request, regardless of which IAM principal sends it. Which configuration should the data engineer apply?

Accepted Answer

Attach a bucket policy that denies s3:PutObject when the request lacks the s3:x-amz-server-side-encryption condition key.. The only mechanism that blocks an unencrypted PUT before the object is stored is a bucket policy using a Deny effect with the s3:x-amz-server-side-encryption condition key. Default encryption and console warnings are passive safeguards that cannot stop an explicit unencrypted request from an SDK or CLI. Block Public Access and lifecycle rules address different concerns entirely.

Answer

Enable S3 Block Public Access at the account level so that only encrypted objects can be uploaded.

Answer

Enable default bucket encryption with SSE-S3 and rely on the S3 console warning for unencrypted uploads.

Answer

Configure an S3 Lifecycle rule to transition objects to S3 Glacier Instant Retrieval, which encrypts data at rest.

Question 3

A company uses Amazon Kinesis Data Streams to ingest real-time financial data. The security team requires that all data be encrypted at rest using a customer-managed AWS KMS key, and that the key be rotated annually. The data engineer needs to configure the Kinesis stream to meet these requirements. Which combination of actions should the data engineer take?

Accepted Answer

Enable server-side encryption on the Kinesis stream using the StartStreamEncryption API with the customer-managed KMS key, and enable automatic key rotation on the KMS key.. To encrypt a Kinesis data stream at rest with a customer-managed KMS key, you use the StartStreamEncryption API, specifying the stream and the KMS key. This enables server-side encryption. To rotate the key annually, you enable automatic key rotation on the customer-managed KMS key. AWS KMS automatically rotates the key material every year when automatic rotation is enabled. This combination meets both requirements with minimal effort.

Answer

Enable encryption at rest by setting the Kinesis stream's EncryptionType to KMS and specifying a customer-managed key, then manually rotate the key by creating a new key and updating the stream configuration every year.

Answer

Use AWS CloudFormation to deploy the Kinesis stream with the KmsKeyId property set to a customer-managed key, and set the EnableKeyRotation property to true on the key resource.

Answer

Configure the Kinesis stream to use AWS-managed KMS keys for encryption, and create a custom AWS Lambda function that rotates the key every 365 days.

Question 4

A data engineering team is building an AWS Glue ETL job that reads from an Amazon S3 bucket and writes to another. The security team mandates that both read and write operations use a customer-managed AWS KMS key so they can audit key usage. Which configuration should the data engineer apply to the Glue job to meet this requirement?

Accepted Answer

Create an AWS Glue Security configuration that enables S3 encryption with the customer-managed KMS key for both reads and writes, and attach it to the job.. The correct approach is to use an AWS Glue Security configuration that specifies the customer-managed KMS key for S3 encryption. This configuration is applied at the job level and ensures that Glue uses the key for both reading and writing data. It provides a centralized way to enforce encryption and enables auditing of key usage. Other methods like bucket policies or default encryption do not guarantee that the Glue job will use the specified key for all operations.

Answer

Enable default encryption on the S3 bucket with the customer-managed KMS key and rely on Glue to use that default for all operations.

Answer

Modify the S3 bucket policy to deny any requests that do not include the aws:SecureTransport condition and require the KMS key in the request headers.

Answer

Add a job parameter --encryption-type sse-kms and specify the KMS key ARN in the job script, then set the Security configuration to use the same key.

Question 5

A data engineer is configuring an AWS Glue ETL job that reads from an Amazon S3 bucket encrypted with SSE-KMS and writes to another S3 bucket also encrypted with SSE-KMS. The job uses an IAM role. The security team requires that the job have only the minimum necessary permissions to decrypt and encrypt data. Which TWO actions should be included in the IAM policy attached to the Glue job role? (Choose two.)

Accepted Answer

kms:GenerateDataKey on the KMS key used by the destination S3 bucket.. To read SSE-KMS encrypted objects from the source bucket, the Glue job role needs kms:Decrypt on the source key. To write SSE-KMS encrypted objects to the destination bucket, S3 requires the job role to have kms:GenerateDataKey on the destination key. These two permissions are the minimum required for the job to function while adhering to least privilege.

Answer

kms:ReEncryptFrom on the KMS key used by the destination S3 bucket.

Answer

kms:Encrypt on the KMS key used by the source S3 bucket.

Answer

kms:CreateGrant on both KMS keys to allow S3 to use the keys.

Question 6

A company uses AWS Lake Formation to manage fine-grained access to a data lake in Amazon S3. A data analyst needs to query a table in the AWS Glue Data Catalog that contains columns with sensitive data. The analyst must be able to see only non-sensitive columns and only rows where the region column equals 'US'. The analyst uses Amazon Athena for queries. Which Lake Formation permission model should the data engineer implement?

Accepted Answer

Grant the analyst SELECT permission on the table and create a data filter that includes only non-sensitive columns and a row filter for region = 'US'.. Lake Formation data filters provide column-level and row-level security by allowing you to specify which columns and rows a principal can access. By granting SELECT with a data filter that includes only non-sensitive columns and a row filter for region = 'US', the analyst is restricted appropriately. IAM policies, Athena views, and Glue job bookmarks do not enforce the required fine-grained access control.

Answer

Grant the analyst SELECT permission on the table and use AWS Glue job bookmarks to filter sensitive data.

Answer

Create a view in Athena that selects only non-sensitive columns and filters rows for region = 'US', and grant the analyst access to the view.

Answer

Grant the analyst SELECT permission on the table and use an IAM policy to deny access to sensitive columns.

Question 7

A data engineer must give an AWS Glue ETL job access to an S3 bucket that is encrypted with SSE-KMS using a customer managed key. The Glue job runs under an IAM role. The security team wants the least-privilege permissions required for the job to read and write objects in that bucket. Which TWO actions must be included in the IAM role's policy? (Choose two.)

Accepted Answer

kms:Decrypt on the customer managed key.. Reading SSE-KMS encrypted objects requires kms:Decrypt on the key, and writing them requires kms:GenerateDataKey so S3 can obtain a fresh data key per object. These two KMS actions, combined with the appropriate s3:GetObject and s3:PutObject permissions, give the Glue job the minimum cryptographic access it needs without granting administrative key management capabilities.

Answer

kms:ListKeys on the customer managed key.

Answer

kms:ScheduleKeyDeletion on the customer managed key.

Answer

kms:CreateGrant on the customer managed key.

Question 8

A media company stores video metadata in an Amazon DynamoDB table. The security team requires that all data at rest in the table be encrypted with a customer managed key in AWS KMS, and that the key usage be auditable. The data engineer needs to configure encryption for the table. Which action should the data engineer take?

Accepted Answer

Create a customer managed KMS key and specify it when creating the DynamoDB table, ensuring the key policy allows DynamoDB to use it for encryption and decryption.. DynamoDB encryption at rest can use customer managed KMS keys. Specifying such a key during table creation ensures the table is encrypted with that key. The key policy must grant DynamoDB permission to use the key. KMS key usage is logged in CloudTrail, providing auditability. Other options use keys that are not customer managed or do not encrypt the table at rest.

Answer

Use DynamoDB Accelerator (DAX) with encryption in transit enabled, and configure the DAX cluster to use a customer managed KMS key.

Answer

Enable DynamoDB encryption at rest using the default AWS owned key, and enable CloudTrail logging for DynamoDB.

Answer

Enable DynamoDB encryption at rest using an AWS managed key, and use AWS CloudTrail to monitor key usage.

Question 9

A data engineer needs to implement encryption for data at rest in an Amazon S3 bucket that stores sensitive financial records. The company's security policy requires that the encryption keys be managed by the company and rotated annually. The data engineer wants to use AWS Key Management Service (AWS KMS) to meet these requirements. Which solution should the data engineer implement?

Accepted Answer

Use server-side encryption with AWS KMS customer managed keys (SSE-KMS) and configure automatic key rotation for the KMS key.. SSE-KMS with customer managed keys enables the company to control KMS keys and configure automatic annual rotation. This meets the security policy for company-managed keys and rotation, while providing seamless encryption for S3 objects.

Answer

Use client-side encryption with a customer-provided key stored in AWS Secrets Manager, and manually rotate the key annually.

Answer

Use server-side encryption with Amazon S3 managed keys (SSE-S3) and enable automatic key rotation.

Answer

Use server-side encryption with customer-provided keys (SSE-C) and rotate the keys by re-uploading objects with new keys annually.

Question 10

A data engineer needs to grant an IAM role used by an AWS Lambda function permission to read encrypted data from an Amazon S3 bucket. The data is encrypted with a customer-managed AWS KMS key. The engineer wants to follow the principle of least privilege. Which combination of actions should the engineer include in the IAM policy for the Lambda execution role?

Accepted Answer

s3:GetObject on the bucket and kms:Decrypt on the KMS key.. The Lambda function requires s3:GetObject to retrieve the object and kms:Decrypt to decrypt the data key used by S3 server-side encryption with KMS. These permissions are the minimal set needed to read the encrypted object. Other KMS actions like Encrypt, GenerateDataKey, or CreateGrant do not provide decryption capability and would not allow the function to read the data.

Answer

s3:GetObject on the bucket and kms:GenerateDataKey on the KMS key.

Answer

s3:GetObject on the bucket and kms:CreateGrant on the KMS key.

Answer

s3:GetObject on the bucket and kms:Encrypt on the KMS key.

Question 11

A data engineer is setting up an AWS Glue job that reads from an Amazon Kinesis Data Stream and writes to an Amazon S3 bucket. The security team requires that all data in transit be encrypted using TLS, and that the Glue job must use a VPC endpoint to access Kinesis and S3. Which configuration ensures compliance?

Accepted Answer

Configure the Glue job to use a VPC connection and create VPC endpoints for Kinesis and S3 with policies that enforce TLS.. To meet both TLS encryption in transit and VPC endpoint usage, the Glue job must run within a VPC using a VPC connection, and VPC endpoints for Kinesis and S3 must be created with policies that enforce TLS. This ensures all traffic goes through the endpoints and is encrypted. Other options either address only encryption at rest or do not include VPC endpoints.

Answer

Attach a bucket policy to the S3 bucket that denies requests where aws:SecureTransport is false, and enable Kinesis Data Stream encryption in transit.

Answer

Enable default encryption on the S3 bucket and enable Kinesis Data Stream encryption at rest.

Answer

Use AWS Glue job bookmarks and enable S3 Transfer Acceleration.

Question 12

A data engineer must ensure that all objects written to an S3 bucket by an AWS Glue ETL job are encrypted with a customer-managed AWS KMS key, even if the job does not explicitly specify encryption parameters. The bucket policy already denies unencrypted PUT requests. Which configuration will enforce the required encryption with the LEAST operational overhead?

Accepted Answer

Set the default encryption on the S3 bucket to SSE-KMS with the customer-managed key.. Default bucket encryption with SSE-KMS using the customer-managed key automatically encrypts all objects written without explicit encryption headers, satisfying the requirement without modifying the Glue job. It also works with the existing bucket policy denial for non-compliant requests. This approach minimizes operational effort and ensures consistent encryption across all writers.

Answer

Enable S3 Bucket Keys for the bucket to reduce KMS costs.

Answer

Attach an IAM policy to the Glue job role that allows only s3:PutObject with the s3:x-amz-server-side-encryption condition.

Answer

Modify the Glue job to set the --encryption-type parameter to SSE-KMS for all writes.

Question 13

A retail company uses Amazon Redshift for its data warehouse. The security team requires that all data in the cluster be encrypted at rest using a hardware security module (HSM) to manage the encryption keys. The data engineer needs to configure the Redshift cluster accordingly. Which action should the data engineer take?

Accepted Answer

Configure the Redshift cluster to use an HSM for encryption at rest by specifying the HSM connection details and enabling encryption when creating the cluster.. Amazon Redshift supports encryption at rest using an HSM. When creating a cluster, you can choose HSM encryption and provide the HSM connection details. This allows the cluster to use keys stored in a hardware security module, satisfying the security team's requirement. Other options either use KMS or do not encrypt the cluster itself.

Answer

Use Redshift Spectrum to query data in Amazon S3 that is encrypted with an HSM, and enable encryption for the Redshift cluster with AWS KMS.

Answer

Enable Redshift encryption at rest with an AWS owned key and use AWS CloudHSM to store the key.

Answer

Enable Redshift encryption at rest using AWS KMS with a customer managed key, and configure the cluster to use an HSM for key storage.

Question 14

A data engineer is building an AWS Glue job that reads a table from the AWS Glue Data Catalog. The table contains columns with customer names, email addresses, and account numbers. The security team wants the job to mask the last four digits of account numbers in the output while leaving other columns unchanged. Which approach should the data engineer use?

Accepted Answer

Use a DynamicFrame map transformation with a custom function that replaces the account number value with a masked version.. Masking specific column values during a Glue ETL run is best done with a map transformation that applies a custom function to each record. This keeps the transformation inside the job, gives full control over the masking logic, and leaves other columns unchanged. PII detection, DataBrew recipes, and column-level encryption do not perform value-level masking in this context.

Answer

Use the AWS Glue DataBrew masking recipe and apply it as a transformation step in the Glue job.

Answer

Apply a DynamicFrame map transformation and call the PII detection transform on the account number column.

Answer

Enable column-level encryption on the Data Catalog table definition for the account number column.

Question 15

A data engineer needs to allow an AWS Lambda function to access a specific AWS KMS customer managed key to decrypt data. The Lambda function assumes an IAM role. Which policy statement should be added to the KMS key policy to grant the necessary permissions with least privilege?

Accepted Answer

Allow the IAM role to perform kms:Decrypt on the KMS key, specifying the role's ARN as the principal.. The KMS key policy must grant the Lambda function's IAM role the kms:Decrypt permission. Specifying the role's ARN as the principal ensures only that role can use the key for decryption. This follows least privilege by not granting unnecessary actions. Other options either grant excessive permissions or add unnecessary conditions that could hinder legitimate access.

Answer

Allow the IAM role to perform kms:Decrypt on the KMS key, with a condition that the request comes from the Lambda function's VPC endpoint.

Answer

Allow the IAM role to perform kms:* on the KMS key, specifying the role's ARN as the principal.

Answer

Allow the IAM role to perform kms:Decrypt on the KMS key, with a condition that the aws:PrincipalArn matches the role's ARN.