DEA-C01 Data Security and Governance Practice Test 30 — 15 Questions

Question 1

A data engineer manages an Amazon Redshift cluster that contains a table with credit card numbers. The security team requires that the credit card column be stored in encrypted form and that only users with a specific IAM role can see the full values. Other users should see a partially masked value when they query the table. Which Redshift feature should the data engineer use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Redshift dynamic data masking with a masking policy attached to the credit card column.. Redshift dynamic data masking attaches a masking policy to a column and evaluates the querying user's role at query time. Authorized roles see the original value, while others see a masked form such as the last four digits. Column-level encryption, Spectrum, and row-level security address different concerns and cannot produce role-based partial masking of a column value.

Answer

Redshift row-level security with a policy that filters rows containing credit card numbers.

Answer

Redshift column-level encryption with a customer managed key in AWS KMS.

Answer

Redshift Spectrum with an external table that uses a SerDe to mask the credit card column.

Question 2

A data engineer is designing a data lake on Amazon S3 that will store sensitive financial data. The security team requires that access to the data be audited, that data be encrypted at rest with customer-managed keys, and that the engineer be able to identify which IAM principals accessed specific objects. Which TWO AWS services or features should the engineer use to meet these requirements? (Choose two.)

Accepted Answer

AWS CloudTrail data events for S3. CloudTrail data events provide the necessary audit trail for object-level access, identifying IAM principals. SSE-KMS with customer managed keys satisfies the encryption at rest requirement with customer-managed keys. Together, they meet the auditing and encryption needs.

Answer

Amazon S3 server access logging

Answer

Amazon Macie for sensitive data discovery

Answer

AWS Secrets Manager for storing encryption keys

Question 3

A company stores sensitive data in Amazon S3 and requires that all data in transit between on-premises applications and S3 be encrypted. The applications use the AWS SDK to upload and download objects. Which configuration should the data engineer implement to enforce encryption in transit?

Accepted Answer

Configure the S3 bucket policy to deny requests that do not use the aws:SecureTransport condition key.. To enforce encryption in transit for S3, the bucket policy should deny any request that does not use HTTPS, which is indicated by the aws:SecureTransport condition key being false. This ensures that all data transfers between on-premises applications and S3 are encrypted using TLS. Other options address encryption at rest or performance, not in-transit encryption.

Answer

Enable default encryption on the S3 bucket using SSE-S3.

Answer

Enable S3 Transfer Acceleration on the bucket to ensure data is encrypted during transfer.

Answer

Use AWS Certificate Manager (ACM) to provision a TLS certificate for the S3 bucket.

Question 4

A company uses AWS Glue to process data stored in Amazon S3. The security team mandates that all data in transit between AWS Glue and Amazon S3 must be encrypted with TLS. The Glue job connects to S3 using the AWS SDK. Which configuration should the data engineer implement to enforce TLS encryption for the Glue job's S3 connections?

Accepted Answer

Attach an S3 bucket policy that denies requests where aws:SecureTransport is false.. To enforce TLS for all connections to an S3 bucket, including from AWS Glue, an S3 bucket policy that denies requests when aws:SecureTransport is false is the correct approach. This condition evaluates the transport protocol and blocks non-TLS requests. It is a best practice recommended by AWS for ensuring data in transit encryption.

Answer

Configure the Glue job to use a VPC endpoint for S3 and enable AWS PrivateLink.

Answer

Set the Glue job parameter --encryption-mode to TLS.

Answer

Enable default encryption on the S3 bucket with SSE-KMS.

Question 5

A data engineer must ensure that an AWS Glue ETL job can read from an Amazon S3 bucket encrypted with SSE-KMS and write to another S3 bucket also encrypted with SSE-KMS, using a single KMS key. The engineer has created an IAM role for the Glue job with permissions to access both buckets. What additional step is required to allow the Glue job to decrypt and encrypt data using the KMS key?

Accepted Answer

Attach a KMS key policy to the customer managed key that allows the Glue job's IAM role to use the key for encrypt and decrypt operations.. For a Glue job to use a KMS key for SSE-KMS encryption, both the IAM role's identity-based policy and the KMS key policy must grant the necessary permissions. The key policy is the resource-based policy that controls access to the KMS key. Without an explicit allow in the key policy for the Glue job's IAM role to perform kms:Decrypt and kms:Encrypt, the job cannot use the key, even if the IAM policy allows it.

Answer

Grant the Glue job's IAM role the kms:CreateGrant permission in its identity-based policy.

Answer

Enable default encryption on both S3 buckets using SSE-S3 instead of SSE-KMS.

Answer

Modify the S3 bucket policy to allow the Glue job's IAM role to perform kms:Decrypt on the bucket.

Question 6

A data engineer is building an AWS Lake Formation governed data lake. The security team wants to grant a group of analysts access to only the non-sensitive columns of a table in the Data Catalog, while denying access to columns containing Social Security numbers. The analysts use Amazon Athena to query the data. Which Lake Formation permission model should the data engineer use?

Accepted Answer

Grant column-level SELECT permission on the non-sensitive columns and exclude the Social Security number column.. Lake Formation column-level permissions let you grant SELECT on a subset of columns in a Data Catalog table. Analysts can then query the permitted columns through Athena, and any attempt to select the Social Security number column is denied. Duplicating tables or using broad IAM denies does not achieve the same precise, least-privilege control.

Answer

Grant table-level SELECT permission to the analysts and rely on Athena to hide the sensitive columns.

Answer

Use an IAM policy that denies athena:GetQueryResults for queries that reference the sensitive column.

Answer

Create a separate Data Catalog table that contains only non-sensitive columns and grant access to that table.

Question 7

A data engineer is setting up an AWS Glue ETL job that reads data from an Amazon S3 bucket and writes to another S3 bucket. The security team requires that all data in transit be encrypted using TLS. The engineer has configured the job to use the appropriate S3 endpoints. Which additional configuration is necessary to enforce TLS for data in transit between AWS Glue and Amazon S3?

Accepted Answer

Attach an S3 bucket policy that denies requests where aws:SecureTransport is false.. To enforce TLS for data in transit to S3, you must use a bucket policy that denies requests when aws:SecureTransport is false. This ensures that all access, including from AWS Glue, uses HTTPS. Other options address encryption at rest or network routing, not TLS enforcement.

Answer

Set the AWS Glue job's security configuration to enable S3 encryption in transit.

Answer

Enable default encryption on the S3 bucket using SSE-KMS.

Answer

Configure the AWS Glue job to use a VPC endpoint for S3 and enable private DNS.

Question 8

A data engineer is using AWS Glue to transform data stored in Amazon S3. The security team requires that data in transit between AWS Glue and Amazon S3 be encrypted. The engineer wants to ensure that all connections use TLS. Which action should the engineer take to enforce encryption in transit for AWS Glue jobs accessing S3?

Accepted Answer

Attach a bucket policy to the S3 bucket that denies requests where aws:SecureTransport is false.. Enforcing encryption in transit for S3 is done by adding a bucket policy that denies requests when aws:SecureTransport is false. This ensures that all clients, including AWS Glue, must use HTTPS/TLS when accessing the bucket. Other options either address encryption at rest or do not enforce TLS.

Answer

Enable SSL/TLS for the Glue connection and set the require_ssl parameter to true in the JDBC URL.

Answer

Configure the Glue job to use a VPC endpoint for S3 and enable encryption on the endpoint.

Answer

Set the Glue job parameter --encryption-mode to SSE-S3.

Question 9

A data engineer is configuring an AWS Glue crawler to catalog data stored in an Amazon S3 bucket. The security team requires that all data in transit between the crawler and S3 be encrypted using TLS. Which configuration should the engineer implement to meet this requirement?

Accepted Answer

Attach a bucket policy to the S3 bucket that denies requests that do not use the aws:SecureTransport condition.. To enforce encryption in transit for S3, the most direct method is to use a bucket policy that denies requests where aws:SecureTransport is false. This forces all clients, including AWS Glue crawlers, to use HTTPS. Glue crawlers use the AWS SDK, which defaults to HTTPS, so they will continue to work. This approach is recommended by AWS for compliance with encryption-in-transit requirements.

Answer

Enable default encryption on the S3 bucket with SSE-S3, which automatically encrypts data in transit.

Answer

Enable SSL/TLS for the Glue crawler by setting the --enable-ssl parameter in the crawler configuration.

Answer

Configure the Glue crawler to use a VPC endpoint for S3 and enable encryption in transit on the endpoint.

Question 10

A data engineer is building an AWS Glue ETL job that reads from an Amazon S3 bucket and writes to another. The security team requires that all data be encrypted at rest and that the job use a customer-managed KMS key for encryption. The engineer configures the job with `--encryption-type sse-kms` and a KMS key ID. However, the job fails with an access denied error when writing to S3. The IAM role used by the Glue job has permissions to read and write the S3 buckets but has no KMS permissions. Which additional IAM permissions are required for the Glue job role to successfully write encrypted data?

Accepted Answer

kms:Encrypt and kms:GenerateDataKey on the KMS key. To write data to Amazon S3 with SSE-KMS, the Glue job role must have permissions to use the KMS key for encryption. Specifically, kms:Encrypt and kms:GenerateDataKey are required to create and encrypt the data key used for server-side encryption. Without these, the S3 PutObject operation fails with access denied. The other options either relate to reading (Decrypt) or administrative tasks (CreateGrant, ReEncrypt) that do not satisfy the encryption requirement for writing.

Answer

kms:Decrypt and kms:DescribeKey on the KMS key

Answer

kms:ReEncryptFrom and kms:ReEncryptTo on the KMS key

Answer

kms:CreateGrant and kms:ListKeys on the KMS key

Question 11

A data engineer needs to ensure that an AWS Glue ETL job can access an Amazon S3 bucket that is encrypted with SSE-KMS. The Glue job runs with an IAM role. The KMS key policy grants access to the account root. Which TWO actions are required to allow the Glue job to read and write data in the bucket? (Choose two.)

Accepted Answer

Add s3:GetObject and s3:PutObject permissions to the Glue job's IAM role.. To allow an AWS Glue job to access an S3 bucket encrypted with SSE-KMS, the job's IAM role must have both S3 permissions (s3:GetObject, s3:PutObject) and KMS permissions (kms:Decrypt, kms:GenerateDataKey). These permissions enable the job to read and write objects and to use the KMS key for encryption and decryption. Other options either do not provide the necessary permissions or would change the encryption method, which is not desired.

Answer

Configure the S3 bucket to use SSE-S3 instead of SSE-KMS.

Answer

Attach an S3 bucket policy that allows the Glue job role to perform s3:GetObject and s3:PutObject.

Answer

Add kms:CreateGrant permission to the Glue job's IAM role.

Question 12

A data engineer is using AWS Lake Formation to manage access to a data lake in Amazon S3. The engineer needs to grant a specific IAM role read access to only the columns 'customer_id' and 'purchase_amount' in a table stored in the AWS Glue Data Catalog. The table contains sensitive columns like 'credit_card_number'. Which Lake Formation permission model should the engineer use to achieve this?

Accepted Answer

Grant the IAM role SELECT permission on the table, and then create a data filter that includes only the required columns.. AWS Lake Formation provides fine-grained access control, including column-level security. To grant read access to specific columns, you grant SELECT permission on the table and then attach a data filter that includes only the allowed columns. Data filters are evaluated at query time, ensuring that the role can only access the specified columns. This is the most direct and secure method.

Answer

Grant the IAM role DESCRIBE permission on the table, and then use AWS Glue to create a transformed dataset with only the required columns.

Answer

Grant the IAM role SELECT permission on the table, and then use an IAM policy to deny access to the sensitive columns.

Answer

Create a view in Amazon Athena that selects only the required columns, and grant the IAM role access to the view.

Question 13

A data engineer is configuring an AWS Lake Formation permissions model for a data lake in Amazon S3. Analysts must query a table through Amazon Athena and see only rows where the 'region' column equals 'EU'. The engineer has already registered the S3 location with Lake Formation and created the table in the AWS Glue Data Catalog. Which action should the engineer take to enforce the row-level restriction?

Accepted Answer

Create a Lake Formation data filter that includes the expression region='EU' and grant SELECT on the table with that data filter to the analysts' IAM role.. Lake Formation data filters are the correct mechanism for row-level security. By creating a data filter with the expression region='EU' and granting SELECT with that filter, the analyst's queries through Athena automatically receive the filter condition. This enforcement happens at the Lake Formation permission layer, so it applies consistently regardless of how the query is written, and the underlying data remains unchanged.

Answer

Create an IAM policy that allows Athena StartQueryExecution only when the query string contains region='EU'.

Answer

Create an S3 bucket policy that denies GetObject for objects whose keys do not start with 'EU/'.

Answer

Create a separate Athena workgroup for the analysts and configure the workgroup to append a WHERE clause to every query.

Question 14

A data engineer is using AWS Lake Formation to manage access to a data lake in Amazon S3. The engineer needs to grant a specific IAM role access to only the columns containing non-sensitive data in a table stored in the AWS Glue Data Catalog. The role should not have access to sensitive columns. What should the engineer do?

Accepted Answer

Create a Lake Formation data filter that excludes the sensitive columns, and grant the IAM role SELECT permission on the table with the data filter applied.. AWS Lake Formation provides column-level security through data filters. By creating a data filter that excludes sensitive columns and granting SELECT with that filter, the engineer ensures the IAM role can only access the permitted columns. This is the native and most secure method for fine-grained access control in Lake Formation.

Answer

Grant the IAM role SELECT permission on the table, and then apply an IAM policy that denies access to the columns with sensitive data.

Answer

Use AWS Glue Data Catalog resource policies to deny access to the sensitive columns for the IAM role.

Answer

Create a view in Amazon Athena that selects only the non-sensitive columns, and grant the IAM role access to the view instead of the table.

Question 15

A data engineer needs to ensure that data stored in Amazon S3 is protected against accidental deletion and that the data cannot be altered for a period of 7 years to meet compliance requirements. The engineer must also ensure that the data remains encrypted at rest using SSE-KMS. Which two actions should the engineer take? (Choose two.)

Accepted Answer

Enable S3 Object Lock in compliance mode on the bucket and set a retention period of 7 years for all objects.. To protect data from deletion and alteration for 7 years, S3 Object Lock in compliance mode must be enabled on the bucket with a retention period of 7 years. This ensures objects are immutable. Additionally, default encryption with SSE-KMS ensures data is encrypted at rest. Other options like versioning, lifecycle rules, bucket policies, or AWS Backup do not provide the required immutability for the primary data in S3.

Answer

Use AWS Backup to create a vault lock with a 7-year retention policy and schedule daily backups of the S3 bucket.

Answer

Enable versioning on the bucket and configure a lifecycle rule to transition objects to S3 Glacier Deep Archive after 30 days.

Answer

Create an S3 bucket policy that denies s3:DeleteObject and s3:PutObject for all principals except a specific IAM role.