DEA-C01 Data Security and Governance Practice Test 4 — 15 Questions

Question 1

Refer to the exhibit. A data engineer runs the command above. The DataAdminRole is used by an application to decrypt data. The security team wants to ensure that a SecurityAdminRole can revoke the grant. What must be done to allow the SecurityAdminRole to retire the grant?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

No action needed; the SecurityAdminRole can retire the grant. The grant's RetiringPrincipal field is already set to SecurityAdminRole, so no additional action is needed. Option A is incorrect because setting the RetiringPrincipal to the root user would not grant SecurityAdminRole the ability to retire. Option B is incorrect because a Revoke grant is not required; retire is handled by the RetiringPrincipal. Option D is incorrect because creating a new grant is unnecessary when the existing grant already has the correct RetiringPrincipal.

Answer

Set the RetiringPrincipal to the root user

Answer

Add a grant with Revoke operation for the SecurityAdminRole

Answer

Create a new grant with SecurityAdminRole as GranteePrincipal

Question 2

A company uses S3 to store sensitive customer data. To prevent accidental public access, a data engineer needs to ensure that all S3 buckets block public access at the account level. Which AWS service should be used to enforce this policy?

Accepted Answer

Use an SCP in AWS Organizations to deny s3:PutBucketPublicAccessBlock. An AWS Organizations Service Control Policy (SCP) can be used to deny the s3:PutBucketPublicAccessBlock action across all accounts in the organization, preventing anyone from disabling the account-level Block Public Access settings. This enforces the policy at the organizational level, ensuring that even account administrators cannot override it. This is the most robust way to prevent accidental public access.

Answer

Enable S3 Block Public Access at the account level in the management account

Answer

Create an IAM policy that denies s3:PutBucketPolicy

Answer

Set up AWS Config rules to automatically remediate public buckets

Question 3

A company uses AWS Glue to process sensitive data. The security team requires that all data in transit between Glue and Amazon S3 be encrypted using TLS 1.2 or higher. Which configuration ensures this requirement is met?

Accepted Answer

Add a bucket policy that denies access unless aws:SecureTransport is true. Adding a bucket policy that denies access unless 'aws:SecureTransport' is true enforces that all requests to the S3 bucket must use HTTPS (TLS). AWS Glue, when accessing S3, will use HTTPS by default, but the bucket policy ensures that any non-TLS request is denied, thus meeting the requirement for encryption in transit with TLS 1.2 or higher.

Answer

Configure a VPC endpoint for S3 and enable private DNS

Answer

Enable S3 Block Public Access at the bucket level

Answer

Use SSE-KMS encryption on the S3 bucket

Question 4

A company uses AWS Lake Formation to manage permissions on a data lake stored in S3. A data engineer notices that a new IAM user can query data via Athena but cannot see the tables in the Lake Formation console. What is the most likely cause?

Accepted Answer

The user has not been granted DESCRIBE or SELECT permissions on the tables in Lake Formation. AWS Lake Formation enforces its own permission model on top of IAM. Even if an IAM user has s3:GetObject and Athena query permissions, Lake Formation requires explicit grants (DESCRIBE, SELECT, ALTER, DROP, etc.) on the Data Catalog resources (databases, tables, columns) for the user or their role. Without DESCRIBE, the user cannot see the table metadata in the Lake Formation console, even though a query may succeed if SELECT was granted via a different path or the table is registered with a resource link.

Answer

The Athena workgroup is not encrypted

Answer

The Glue Data Catalog is not enabled for the account

Answer

The IAM user lacks s3:GetObject permissions

Question 5

A data engineer needs to grant an IAM user read-only access to a specific KMS key for decrypting S3 objects. Which policy element should be used?

Accepted Answer

Add a statement to the KMS key policy allowing the IAM user to call kms:Decrypt. KMS key policies are the primary resource-based access control mechanism for KMS keys. To grant an IAM user (or any principal) permission to use a specific KMS key, the permission must be explicitly stated in that key's key policy — either directly naming the principal or delegating to IAM via the 'Enable IAM policies' statement. Without a key policy statement allowing the account/IAM to use the key, an IAM policy alone is insufficient because KMS evaluates the key policy first as the root of trust.

Answer

Attach an IAM policy to the user allowing kms:Decrypt

Answer

Add a bucket policy that grants kms:Decrypt

Answer

Use an SCP in AWS Organizations to allow kms:Decrypt

Question 6

A company uses Amazon EMR to process sensitive data. The data engineer needs to ensure that data in transit between EMR and S3 is encrypted. Which THREE configurations achieve this? (Choose THREE.)

Accepted Answer

Configure EMRFS to use server-side encryption with S3 (SSE-S3) and require HTTPS. Option B is correct because configuring EMRFS with SSE-S3 and requiring HTTPS ensures that all EMRFS requests to S3 are made over TLS, which encrypts data in transit between EMR and S3. Option D is correct because using SSE-C with HTTPS means the client supplies the encryption key and the connection uses TLS, so data in transit is encrypted while also being encrypted at rest with a customer-provided key. Option E is correct because an S3 VPC endpoint (gateway endpoint) combined with a bucket or endpoint policy that enforces aws:SecureTransport=true (HTTPS) guarantees EMR-to-S3 traffic stays on the AWS network and is encrypted in transit via TLS. Option A is not correct because S3 Block Public Access only controls public access permissions and does not encrypt data in transit. Option C is not correct because SSE-KMS provides encryption at rest for objects in S3 and does not by itself encrypt data in transit between EMR and S3.

Answer

Enable S3 Block Public Access on the bucket

Answer

Enable SSE-KMS on the S3 bucket

Question 7

Refer to the exhibit. A data engineer configured CloudTrail to log data events for an S3 bucket. However, the engineer notices that no data events are being logged for objects in the 'logs/' prefix. What is the most likely reason?

Accepted Answer

The S3 bucket policy does not allow CloudTrail to write logs. The data resource value is missing a trailing slash (should be 'logs/')? Actually it has a trailing slash. Wait, the issue is that the ARN is for a prefix, but CloudTrail data event selectors for S3 require a bucket ARN or prefix ARN with a trailing slash. The provided ARN 'arn:aws:s3:::my-bucket/logs/' is correct format. However, the likely issue is that the bucket is in a different region, but the trail is in a different region? No, more common: the IAM role for CloudTrail lacks permissions to log to S3. But the exhibit shows a correct selector. Actually, common mistake: the selector must have a trailing slash, which it does. The most likely cause is that the trail is not logging because the S3 bucket policy does not grant CloudTrail write access. Option A is plausible. Option B is wrong because prefix is correct. Option C is wrong because it includes trailing slash. Option D is wrong because data events are enabled. So option A is correct.

Answer

The data resource should specify the bucket ARN without a prefix

Answer

The prefix 'logs/' must not include a trailing slash

Answer

Data events are not supported for S3

Question 8

Refer to the exhibit. A data engineer creates an IAM policy for a service role used by AWS Glue. What does the condition in the policy enforce?

Accepted Answer

The role can only use the KMS key when the request comes from S3. The condition in the IAM policy uses aws:SourceArn or aws:SourceAccount (or a service-specific key like kms:ViaService) to restrict KMS key usage to requests originating from S3. This is a confused-deputy prevention pattern that ensures the Glue service role can only use the key when the request is made on behalf of S3, not from arbitrary services.

Answer

The role can use the KMS key from any AWS service

Answer

The role can only use the KMS key when the request comes from Glue

Answer

The role can only use the KMS key for decrypting data

Question 9

A company wants to encrypt data at rest in Amazon S3 using server-side encryption. They need to manage the encryption keys themselves and rotate them annually. Which S3 encryption option should they use?

Accepted Answer

SSE-C. SSE-C (Server-Side Encryption with Customer-Provided Keys) allows customers to provide their own encryption keys, manage them, and rotate them as needed. SSE-S3 uses AWS-managed keys, offering no customer control over key management. SSE-KMS uses AWS KMS keys, where AWS manages the key material, though customers can manage key policies and automatic rotation. Client-side encryption is not server-side and does not meet the requirement. Therefore, SSE-C is the correct option.

Answer

SSE-KMS

Answer

SSE-S3

Answer

Client-side encryption

Question 10

A data engineer needs to audit all access to an S3 bucket for compliance. They want to capture object-level operations such as GetObject and PutObject, as well as bucket-level operations like ListBucket. Which AWS service should be used?

Accepted Answer

S3 server access logs. S3 server access logs record both object-level operations (e.g., GetObject, PutObject) and bucket-level operations (e.g., ListBucket). AWS CloudTrail can also capture S3 API calls, but by default it logs bucket-level management events only; object-level data events must be explicitly enabled. Amazon CloudWatch Logs (Option A) is a log storage and monitoring service, not a source of S3 access logs; logs must be sent to it from another service. AWS CloudTrail management events (Option C) capture only bucket-level operations, not object-level. AWS Config (Option D) monitors resource configuration changes, not API calls. Therefore, the correct service for auditing all S3 access is S3 server access logs.

Answer

Amazon CloudWatch Logs

Answer

AWS CloudTrail management events

Answer

AWS Config

Question 11

A company uses AWS KMS to encrypt data in Amazon S3 and RDS. They need to ensure that encryption keys are automatically rotated every year. Which KMS key type supports automatic annual rotation?

Accepted Answer

AWS managed keys (aws/xxx). AWS managed keys (AWS-managed KMS keys) have automatic rotation enabled by default every year, making option B correct. AWS owned keys are not visible to the customer and cannot be managed. Customer managed keys require explicit enabling of rotation, so they are not automatically rotated. Custom key stores do not support automatic rotation. Therefore, only AWS managed keys provide automatic annual rotation without additional configuration.

Answer

AWS owned keys

Answer

Customer managed keys

Answer

Custom key stores

Question 12

A company uses AWS Lake Formation to manage data lake permissions. A data engineer notices that a user can query tables in Athena even though the user does not have SELECT permission on the table in Lake Formation. What could be the cause?

Accepted Answer

The IAMAllowedPrincipals group has been granted Super permission on the database. In AWS Lake Formation, the IAMAllowedPrincipals group is a special group that, when granted Super permission on a database, allows all IAM principals with access to the underlying S3 data to bypass Lake Formation permissions. This means a user with only IAM permissions (e.g., Athena access) can query tables without explicit Lake Formation SELECT permission.

Answer

The user is using Redshift Spectrum

Answer

The user has S3 permissions to read the underlying data

Answer

The user has an IAM policy that allows Athena access

Question 13

A company stores sensitive data in S3 and uses VPC Endpoints to restrict access. They want to ensure that data can only be accessed from their VPC. What configuration is required?

Accepted Answer

Add a bucket policy condition aws:SourceVpce. To restrict S3 bucket access to a specific VPC, use a bucket policy with the aws:SourceVpce condition key to specify the VPC endpoint ID. Option A (VPC Flow Logs) logs traffic but does not restrict access. Option B is correct. Option C (S3 Block Public Access) prevents public access but does not limit access to a specific VPC. Option D (security groups) are used for EC2 instances, not S3 buckets.

Answer

Configure VPC Flow Logs to monitor access

Answer

Enable S3 Block Public Access

Answer

Associate a security group with the S3 bucket

Question 14

A data engineer needs to protect sensitive data in an S3 bucket. Which TWO AWS services can be used to detect and prevent accidental public access?

Accepted Answer

AWS Trusted Advisor. AWS Trusted Advisor (B) is correct because its Security category includes a check for S3 buckets with public read or write permissions and flags them, helping detect accidental public exposure across the account. S3 Block Public Access (D) is correct because it provides account-level and bucket-level settings that override bucket policies and ACLs to prevent public access from being granted, directly blocking accidental exposure. AWS Config (A) records configuration changes and can evaluate compliance via rules, but it is a configuration/compliance service rather than a purpose-built public-access prevention control. AWS CloudTrail (C) logs API activity for auditing and detection of who made changes, but it does not itself detect or prevent public access. Amazon Macie (E) discovers and classifies sensitive data in S3 and alerts on exposure risks, but it does not enforce prevention of public access.

Answer

AWS Config

Answer

AWS CloudTrail

Answer

Amazon Macie

Question 15

A company uses AWS KMS to encrypt data in multiple services. They want to ensure that only specific IAM roles can decrypt data using a particular KMS key. Which TWO steps are necessary?

Accepted Answer

Attach an IAM policy to each role with kms:Decrypt permission. Option A is correct because IAM identity-based policies must grant the calling principal the kms:Decrypt action; without an IAM policy allowing kms:Decrypt, the role's requests to decrypt with the KMS key are denied even if the key policy permits it. Option E is correct because a KMS key policy is required to allow the specific IAM roles to use the key for kms:Decrypt; the key policy is the primary resource-based control that must explicitly grant those roles access to the key. Option B is not required because enabling IAM policies in the key policy is only needed when you want the key policy to delegate access decisions to IAM policies, but the question asks for the steps that directly restrict decryption to specific roles, which are the IAM policy and the key policy statement. Option C is incorrect because automatic key rotation only rotates the backing key material and does not control which roles can decrypt data. Option D is incorrect because kms:GenerateDataKey is used to generate data keys for encryption, not to decrypt data, so it does not satisfy the requirement to allow decryption.

Answer

Enable IAM policies in the key policy

Answer

Enable automatic key rotation

Answer

Ensure the key policy allows kms:GenerateDataKey for the roles