DEA-C01 Data Security and Governance Practice Test 3 — 15 Questions

Question 1

Refer to the exhibit. A data engineer runs the AWS CLI command and gets the output shown. The engineer wants to grant a data analyst read-only access to the 'sales_db' database in AWS Glue Data Catalog using IAM. Which IAM policy statement is required?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

{"Effect": "Allow", "Action": "glue:GetDatabase", "Resource": "arn:aws:glue:us-east-1:123456789012:database/sales_db"}. To grant read-only access to a database in AWS Glue Data Catalog, the required IAM action is glue:GetDatabase. Option B correctly specifies this action and targets the specific database resource. Option A uses glue:GetTable, which is for tables, not databases. Option C uses glue:GetDatabases, which is for listing databases and requires broader permissions. Option D uses s3:GetObject, which is for S3 data access, not Glue catalog operations.

Answer

{"Effect": "Allow", "Action": "glue:GetTable", "Resource": "arn:aws:glue:us-east-1:123456789012:table/sales_db/*"}

Answer

{"Effect": "Allow", "Action": "glue:GetDatabases", "Resource": "*"}

Answer

{"Effect": "Allow", "Action": "s3:GetObject", "Resource": "arn:aws:s3:::data-lake-sales/*"}

Question 2

A company is using AWS Lake Formation to manage access to data in a data lake stored in Amazon S3. A data engineer notices that users with SELECT permissions on a table can still query the underlying S3 data directly using Athena. What is the most likely cause?

Accepted Answer

The users are using a version of Athena that does not support Lake Formation. The most likely cause is that the users are using a version of Athena that does not support Lake Formation. Lake Formation enforces fine-grained access control only when the query engine is integrated with Lake Formation and uses the Lake Formation permissions model. Older Athena engine versions (e.g., Athena engine version 1) do not support Lake Formation, so they bypass Lake Formation permissions and rely solely on IAM and S3 bucket policies. Therefore, even with SELECT permissions granted via Lake Formation, users on an unsupported Athena version can directly query the underlying S3 data if their IAM permissions allow it.

Answer

The S3 bucket policy allows full access to all principals

Answer

The S3 bucket does not have server-side encryption enabled

Answer

Lake Formation does not support integration with Athena

Question 3

A company is using Amazon Redshift for data warehousing. They need to ensure that all queries are logged for audit purposes. Which AWS service should be used to capture query logs?

Accepted Answer

Amazon CloudWatch Logs. Amazon CloudWatch Logs is the correct service because Redshift can export its audit and user activity logs (including query logs via the database audit logging feature) to CloudWatch Logs for centralized storage, monitoring, and retention. This allows the company to capture, search, and set alarms on query activity for audit purposes. CloudWatch Logs is the native destination for Redshift audit logs when the cluster's audit logging is enabled.

Answer

AWS CloudTrail

Answer

Amazon S3

Answer

Amazon Athena

Question 4

A company is using Amazon S3 to store sensitive data. The security team requires that all objects be encrypted using server-side encryption with AWS KMS (SSE-KMS) and that the bucket policy denies any PutObject request that does not include the required encryption header. Which bucket policy condition should be added?

Accepted Answer

s3:x-amz-server-side-encryption-aws-kms-key-id. The option s3:x-amz-server-side-encryption-aws-kms-key-id is correct because it is the specific condition key that checks for the presence and value of the x-amz-server-side-encryption-aws-kms-key-id header, which specifies the AWS KMS customer managed key (CMK) used for SSE-KMS encryption. When the security team requires that all objects be encrypted with SSE-KMS and that the bucket policy denies any PutObject request that does not include the required encryption header, this condition key ensures that the request includes the KMS key ID header. This is the only condition key among the options that directly validates the KMS key ID header for SSE-KMS.

Answer

s3:x-amz-server-side-encryption

Answer

kms:EncryptionContext

Answer

aws:SecureTransport

Question 5

A data engineer is setting up an Amazon EMR cluster to process sensitive data. The data is stored in S3 with SSE-S3. The company policy requires that data in transit between the EMR cluster and S3 be encrypted. Which configuration should be used?

Accepted Answer

Enable S3 encryption in transit using TLS. Enabling S3 encryption in transit using TLS encrypts data between the EMR cluster and S3. Amazon S3 supports HTTPS (TLS) endpoints by default, and this ensures that data is encrypted during transfer. Option B is wrong because disabling encryption is not allowed per policy. Option C is incorrect because EMRFS with SSE-KMS encrypts data at rest, not in transit. Option D is wrong because SSE-C is also an at-rest encryption mechanism, not for transit.

Answer

Disable encryption and use VPC endpoints

Answer

Configure EMRFS to use SSE-KMS

Answer

Use SSE-C for S3 objects

Question 6

A data engineer is troubleshooting an Amazon Redshift cluster that is unable to access an S3 bucket for COPY operations. The cluster has an IAM role attached. Which of the following could be causing the failure? (Choose TWO.)

Accepted Answer

The S3 bucket policy denies access to the IAM role. Option B is correct because an explicit Deny in the S3 bucket policy overrides any Allow granted by the IAM role's identity-based policies, so a bucket policy that denies the role's ARN will block Redshift COPY operations. Option D is correct because the IAM role attached to the cluster must include the required S3 permissions (such as s3:GetObject for reading source data, and s3:ListBucket for prefix listing) for COPY to succeed. Option A is not correct because Redshift's COPY from S3 is performed by the Redshift service over AWS's internal network, not through the customer VPC security group's outbound rules. Option C is not correct because default encryption (SSE-S3) is transparent to Redshift and does not by itself prevent COPY access. Option E is not correct because the KMS key sharing requirement applies to the IAM role/user performing the operation, not to the Redshift cluster itself, and the scenario already specifies an IAM role is attached.

Answer

The VPC security group does not allow outbound HTTPS traffic

Answer

The S3 bucket has default encryption enabled

Answer

The KMS key used for encryption is not shared with Redshift

Question 7

The IAM policy shown in the exhibit is attached to a user. The user tries to upload an object to my-bucket using the AWS CLI without specifying encryption. What will happen?

Accepted Answer

The upload will fail with an access denied error. The IAM policy attached to the user explicitly denies the s3:PutObject action unless the request includes the s3:x-amz-server-side-encryption condition (or a KMS key header). Because the user uploads without specifying encryption, the condition is not satisfied, so the Deny statement takes precedence and the request is rejected with Access Denied. Default bucket encryption does not override an explicit IAM Deny.

Answer

The upload will succeed because the bucket has default encryption

Answer

The upload will succeed but the object will not be encrypted

Answer

The upload will fail because a KMS key is required

Question 8

A data engineer runs the command shown in the exhibit to check the bucket policy. A user from another AWS account is trying to download an object using HTTP (not HTTPS). What will happen?

Accepted Answer

The download will fail with an access denied error. The bucket policy denies all actions when aws:SecureTransport is false (i.e., HTTP). Therefore, HTTP requests are denied. Option A is wrong because the policy denies HTTP requests. Option C is wrong because the policy does not require encryption at rest. Option D is wrong because the policy explicitly denies HTTP.

Answer

The download will succeed because the principal is not specified

Answer

The download will succeed if the object is encrypted at rest

Answer

The download will succeed because the policy only denies write operations

Question 9

A data engineer receives the error shown in the exhibit when trying to upload a file to my-bucket. The engineer uses the AWS CLI with the following command: aws s3 cp file.txt s3://my-bucket/. What is the most likely cause of the error?

Accepted Answer

The object is not encrypted with SSE-KMS. The error indicates that the upload was denied because the object is not encrypted with SSE-KMS. The bucket policy likely requires SSE-KMS for all PutObject requests, but the AWS CLI command `aws s3 cp file.txt s3://my-bucket/` does not specify the `--sse aws:kms` flag, so the object is uploaded without the required encryption header. This causes the policy condition to evaluate to false, resulting in an access denied error. Option A is wrong because the command does not specify any KMS key; the error is about encryption header, not key validity. Option B is wrong because the error is not related to VPC endpoint policies. Option D is wrong because a default encryption configuration would automatically apply encryption, but the error suggests the upload attempted to skip encryption entirely, which is denied by the explicit policy requirement.

Answer

The KMS key specified in the command is incorrect

Answer

The VPC endpoint policy is blocking the request

Answer

The bucket does not have a default encryption configuration

Question 10

A data engineer needs to ensure that an S3 bucket is encrypted at rest using AWS KMS. The bucket policy must allow only a specific IAM role to access the bucket and enforce encryption in transit. Which combination of bucket policy statements should be used?

Accepted Answer

Use kms:ViaService: s3.*.amazonaws.com and aws:SecureTransport: true. Option A uses the kms:ViaService condition key to restrict the use of the KMS key to requests that come through Amazon S3 (s3.*.amazonaws.com) and the aws:SecureTransport condition to enforce encryption in transit. This ensures that only requests made via S3 and using HTTPS/TLS are allowed to use the key. Option B uses s3:x-amz-server-side-encryption: AES256, which enforces SSE-S3 (AES-256) encryption, not KMS encryption. Option C uses s3:x-amz-server-side-encryption-aws-kms-key-id, which requires a specific KMS key ID, but the aws:SourceIp condition does not enforce encryption in transit. Option D uses kms:EncryptionContext, which can be used to enforce KMS encryption but does not include the aws:SecureTransport condition, so encryption in transit is not enforced.

Answer

Use s3:x-amz-server-side-encryption: AES256 and aws:SecureTransport: true

Answer

Use s3:x-amz-server-side-encryption-aws-kms-key-id and aws:SourceIp

Answer

Use kms:EncryptionContext: service:s3 and aws:SecureTransport: true

Question 11

A company uses AWS Lake Formation to manage permissions on a data lake in S3. A data analyst reports that queries using Amazon Athena return zero rows for a table that the analyst has been granted SELECT permission on. The table is registered in Lake Formation and uses a partition projection. What is the most likely cause?

Accepted Answer

The analyst lacks GetObject and ListBucket permissions on the underlying S3 location. When a table in Lake Formation uses partition projection, Athena bypasses the Glue Data Catalog for partition discovery and directly accesses the S3 location. This requires explicit S3 permissions (GetObject and ListBucket) on the underlying data, which Lake Formation does not automatically grant. The analyst likely can see the table metadata but cannot read the data, resulting in zero rows. Option A is incorrect because the table is registered in Lake Formation (otherwise it wouldn't appear in Athena). Option B is incorrect because DESCRIBE permission is not required for SELECT queries; SELECT alone should suffice. Option D is incorrect because encryption permission issues would cause an error message, not a silent return of zero rows.

Answer

The table is not registered as a resource in Lake Formation

Answer

The analyst does not have DESCRIBE permission on the table

Answer

The table uses server-side encryption with KMS and the analyst lacks kms:Decrypt permission

Question 12

A data engineer is designing a system to handle sensitive customer data in Amazon RDS for PostgreSQL. The compliance team requires that the data be encrypted at rest and that encryption keys be rotated every 90 days. Which solution meets these requirements?

Accepted Answer

Enable RDS encryption with a customer managed KMS key, enable automatic key rotation, and manually rotate the key every 90 days. Amazon RDS for PostgreSQL encryption at rest uses AWS KMS with customer managed keys. Automatic key rotation in KMS rotates the key annually, but the requirement is every 90 days. Therefore, manual key rotation must be performed every 90 days in addition to enabling automatic key rotation. Option A is incorrect because AWS CloudHSM is not directly integrated with RDS for encryption at rest; RDS encryption uses KMS. Option C is incorrect because Transparent Data Encryption (TDE) is not supported for Amazon RDS PostgreSQL; RDS uses KMS for encryption. Option D is incorrect because KMS automatic key rotation alone rotates keys only once per year, not every 90 days as required.

Answer

Use AWS CloudHSM to store the encryption key and create a custom key rotation Lambda function

Answer

Enable Transparent Data Encryption (TDE) on the RDS instance

Answer

Enable RDS encryption with a customer managed KMS key and enable automatic key rotation

Question 13

A company uses AWS Glue to process data. The security team requires that all data in transit between AWS Glue and Amazon S3 be encrypted using TLS. Which configuration should be used?

Accepted Answer

Enable S3 server-side encryption and use HTTPS endpoints. AWS Glue connects to Amazon S3 over HTTPS (TLS) by default when using the S3 API, so enabling S3 server-side encryption and using HTTPS endpoints ensures data in transit is encrypted with TLS. Server-side encryption protects data at rest, while HTTPS endpoints provide the TLS encryption for data in transit. Together, they satisfy the requirement that all data in transit between Glue and S3 be encrypted using TLS.

Answer

Configure a bucket policy to require aws:SecureTransport

Answer

Enable default encryption on the S3 bucket using SSE-KMS

Answer

Use an S3 VPC endpoint

Question 14

A company needs to implement a data encryption strategy for data in transit between an Amazon EC2 instance and an Amazon RDS for MySQL database. Which THREE actions should be taken?

Accepted Answer

Configure the RDS instance to require SSL connections. Option A is correct because configuring the RDS for MySQL instance to require SSL/TLS connections ensures that the database only accepts encrypted sessions, which directly protects data in transit between the EC2 instance and RDS. Option D is correct because the client-side JDBC driver must be configured with useSSL=true (along with proper certificate verification) so the application actually negotiates an encrypted TLS connection to the MySQL endpoint. Option E is correct because setting the rds.force_ssl parameter to 1 in the RDS parameter group enforces SSL for all connections at the server level, complementing the client-side configuration. Option B is not correct because VPC peering only provides network routing between VPCs and does not encrypt traffic. Option C is not correct because KMS encryption at rest protects stored data on the RDS volume, not data in transit.

Answer

Set up VPC peering between the EC2 and RDS subnets

Answer

Enable encryption at rest using KMS on the RDS instance

Question 15

A data engineer is designing a data lake on S3 with fine-grained access control using AWS Lake Formation. Which FOUR permissions can be managed by Lake Formation?

Accepted Answer

SELECT on a table. Lake Formation manages fine-grained data permissions at the table, column, and row level, and the four correct options here are all table-level data permissions it supports. A. SELECT on a table is correct because Lake Formation grants read access to table data, including column- and row-level filtering via data filters. B. INSERT on a table is correct because Lake Formation supports write permissions for adding data to a table. C. DESCRIBE on a table is correct because Lake Formation includes metadata visibility permissions that let principals see table schema and metadata. E. DELETE on a table is correct because Lake Formation supports delete permissions for removing data from a table. D. ALTER TABLE on a table is not correct because schema modification operations like ALTER TABLE are managed through AWS Glue Data Catalog/IAM permissions, not as a Lake Formation data permission.

Answer

ALTER TABLE on a table