DEA-C01 Data Security and Governance Practice Test 4 — 15 Questions

Question 1

A company uses Amazon DynamoDB to store session data. The security team requires that all data be encrypted at rest using a customer-managed KMS key. The data engineer has enabled encryption with a KMS key, but discovers that old data remains encrypted with the previous AWS-managed key. How can the engineer re-encrypt all existing data with the new key?

Accepted Answer

Export the table to S3 using DynamoDB Export to S3, then import using DynamoDB Import from S3 with the new encryption key specified. Option C is correct because Export to S3 and Import from S3 can re-encrypt the data with the new key. Option A is wrong because DynamoDB does not support in-place re-encryption. Option B is wrong because enabling encryption with a new key only applies to new writes. Option D is wrong because copying the table does not re-encrypt with the new key; it uses the table's default key.

Answer

Disable and re-enable encryption with the new KMS key

Answer

Use AWS Backup to back up the table and restore it with the new encryption key

Answer

Use the DynamoDB console to change the encryption key and select 'Apply to existing data'

Question 2

A data engineer needs to grant an IAM user access to query a specific table in Amazon Athena, but the user should not be able to view other tables in the same database. Which method should the engineer use?

Accepted Answer

Use AWS Lake Formation to grant SELECT permission on the specific table to the user. Option A is correct because Lake Formation provides fine-grained table-level permissions. Option B is wrong because S3 bucket policies do not control Athena table access. Option C is wrong because IAM policies alone cannot restrict table access in Athena without Lake Formation. Option D is wrong because Workgroup policies do not provide table-level security.

Answer

Attach an IAM policy that allows athena:StartQueryExecution and restrict the query by table name

Answer

Apply an S3 bucket policy that restricts access to the table's underlying data

Answer

Create a separate Athena workgroup with a query limit that only allows queries on that table

Question 3

A company stores sensitive data in Amazon S3. The data engineer needs to implement a solution that automatically detects and redacts PII in new objects as they are uploaded. Which TWO AWS services should be used together?

Accepted Answer

Amazon Macie. Amazon Macie is a fully managed data security and data privacy service that uses machine learning and pattern matching to discover and protect sensitive data in Amazon S3. Amazon Comprehend is a natural language processing (NLP) service that can be used to detect and redact PII entities from text. Together, they enable automated detection and redaction of PII in newly uploaded S3 objects by triggering Macie to identify sensitive data and then using Comprehend to redact the PII.

Answer

AWS Glue ETL

Answer

Amazon DynamoDB

Answer

AWS Glue Data Catalog

Question 4

A company uses AWS KMS to encrypt data in Amazon Redshift. The data engineer needs to rotate the customer-managed KMS key annually. Which TWO actions must be taken to successfully rotate the key without data loss?

Accepted Answer

Create a new KMS key and update the Redshift cluster to use the new key. Option A is correct because the Redshift cluster must be configured to use the new key. Option C is correct because the old key must remain enabled to decrypt existing data. Option B is wrong because automatic rotation is optional. Option D is wrong because CloudTrail logs rotation but is not required. Option E is wrong because Redshift does not use S3 for key storage.

Answer

Use AWS CloudTrail to verify the key rotation was successful

Answer

Store the new key in Amazon S3 for backup

Answer

Enable automatic KMS key rotation on the existing key

Question 5

A data engineer is designing a data lake on Amazon S3 that must comply with GDPR. The engineer needs to ensure that individuals can request deletion of their personal data. Which THREE AWS services can be used together to automate the deletion of specific records?

Accepted Answer

AWS Lambda. Option B (S3 Select) can query specific records, Option C (Lambda) can process deletion, Option E (S3 Batch Operations) can delete objects. Option A (Glue) is for ETL, not for selective deletion. Option D (DynamoDB) is not for S3.

Answer

AWS Glue

Answer

Amazon DynamoDB

Question 6

Refer to the exhibit. A data engineer attaches this bucket policy to an S3 bucket. A developer tries to upload an object to the bucket using the AWS CLI with the command: `aws s3 cp file.txt s3://my-bucket/`. The upload fails. What is the most likely reason?

Accepted Answer

The CLI command does not specify the encryption header, so the request is denied by the policy. Option B is correct because the CLI does not automatically set encryption headers for `aws s3 cp`; it uses SSE-S3 by default unless `--sse` is specified. The policy denies PutObject if encryption header is missing or not SSE-KMS. Option A is wrong because the user may have s3:PutObject. Option C is wrong because the policy does not require a specific KMS key ID. Option D is wrong because SSE-S3 is not allowed.

Answer

The developer used the wrong AWS region

Answer

The CLI command does not include the required KMS key ID

Answer

The IAM user does not have s3:PutObject permission

Question 7

Refer to the exhibit. A data engineer reviews an Amazon S3 server access log entry for an object upload. The log shows a status of 200 and encryption status "AES256". The company policy requires that all data be encrypted with SSE-KMS. Which action should the engineer take to enforce this policy?

Accepted Answer

Attach an S3 bucket policy that denies s3:PutObject unless the request includes x-amz-server-side-encryption: aws:kms. Option C is correct because the log shows the object was encrypted with AES256 (SSE-S3), not KMS. The engineer should attach a bucket policy that denies PutObject unless the encryption header is aws:kms. Option A is wrong because the upload succeeded. Option B is wrong because CloudTrail does not prevent uploads. Option D is wrong because default encryption only applies to new objects without encryption headers, but the policy must deny SSE-S3.

Answer

Revoke the IAM role's s3:PutObject permission

Answer

Enable AWS CloudTrail data events to monitor future uploads

Answer

Enable S3 default encryption with SSE-KMS on the bucket

Question 8

Refer to the exhibit. A data engineer runs the AWS CLI command and gets the output shown. The engineer wants to grant a data analyst read-only access to the 'sales_db' database in AWS Glue Data Catalog using IAM. Which IAM policy statement is required?

Accepted Answer

{"Effect": "Allow", "Action": "glue:GetDatabase", "Resource": "arn:aws:glue:us-east-1:123456789012:database/sales_db"}. Option A is correct because to read a database, the user needs glue:GetDatabase. Option B is wrong because glue:GetDatabases is for listing databases. Option C is wrong because s3:GetObject is for data access. Option D is wrong because glue:GetTable is for tables, not databases.

Answer

{"Effect": "Allow", "Action": "glue:GetTable", "Resource": "arn:aws:glue:us-east-1:123456789012:table/sales_db/*"}

Answer

{"Effect": "Allow", "Action": "glue:GetDatabases", "Resource": "*"}

Answer

{"Effect": "Allow", "Action": "s3:GetObject", "Resource": "arn:aws:s3:::data-lake-sales/*"}

Question 9

A data engineer needs to encrypt data in transit between an Amazon RDS for MySQL instance and an application. Which solution should be used?

Accepted Answer

Use SSL/TLS to connect to the RDS instance. Option B is correct because SSL/TLS is used to encrypt data in transit between clients and RDS. Option A is wrong because KMS encrypts data at rest, not in transit. Option C is wrong because S3 is not involved in this scenario. Option D is wrong because CloudHSM provides hardware security modules for key storage, not encryption in transit.

Answer

Enable encryption at rest using AWS KMS

Answer

Store the data in Amazon S3 with server-side encryption

Answer

Use AWS CloudHSM to generate and store encryption keys

Question 10

A company is using AWS Lake Formation to manage access to data in a data lake stored in Amazon S3. A data engineer notices that users with SELECT permissions on a table can still query the underlying S3 data directly using Athena. What is the most likely cause?

Accepted Answer

The users are using a version of Athena that does not support Lake Formation. Option C is correct because Lake Formation integrates with Athena by default when using the Athena engine version 2 or later. Option A is wrong because Lake Formation can be used with Athena. Option B is wrong because the issue is about direct S3 access, not encryption. Option D is wrong because Lake Formation can work with S3 bucket policies.

Answer

The S3 bucket policy allows full access to all principals

Answer

The S3 bucket does not have server-side encryption enabled

Answer

Lake Formation does not support integration with Athena

Question 11

A data engineer is designing a data pipeline that ingests data from an on-premises system into Amazon S3 using AWS Transfer Family. The data must be encrypted at rest using a customer-managed key in AWS KMS. The S3 bucket policy must allow only encrypted connections. Which policy condition should be used?

Accepted Answer

aws:SecureTransport. Option D is correct because the condition aws:SecureTransport is used to enforce encrypted connections (TLS). Option A is wrong because s3:x-amz-server-side-encryption-aws-kms-key-id enforces the use of a specific KMS key, not encrypted connections. Option B is wrong because kms:EncryptionContext is for additional context, not connection encryption. Option C is wrong because s3:x-amz-server-side-encryption enforces SSE, not in-transit encryption.

Answer

kms:EncryptionContext

Answer

s3:x-amz-server-side-encryption-aws-kms-key-id

Answer

s3:x-amz-server-side-encryption

Question 12

A company is using Amazon Redshift for data warehousing. They need to ensure that all queries are logged for audit purposes. Which AWS service should be used to capture query logs?

Accepted Answer

Amazon CloudWatch Logs. Option A is correct because Amazon Redshift can publish audit logs to CloudWatch Logs. Option B is wrong because CloudTrail captures API activity, not query logs. Option C is wrong because S3 is a storage service, not for logging. Option D is wrong because Athena is a query service, not a logging service.

Answer

AWS CloudTrail

Answer

Amazon S3

Answer

Amazon Athena

Question 13

A data engineer needs to share a dataset stored in Amazon S3 with another AWS account. The bucket policy currently grants access only to the owning account. What is the simplest way to grant cross-account access?

Accepted Answer

Add a bucket policy that grants access to the other account's IAM role. Option C is correct because a bucket policy with a principal ARN of the other account's IAM role is the standard way to grant cross-account access. Option A is wrong because that would make the object public, which is not recommended. Option B is wrong because a bucket policy can directly grant cross-account access without needing an IAM role in the other account. Option D is wrong because an ACL grants basic permissions but is less flexible.

Answer

Set the object ACL to public-read

Answer

Use an S3 access control list (ACL) to grant access to the other account

Answer

Create an IAM role in the other account and attach a policy to it

Question 14

An organization is using AWS Glue to process sensitive data. The data is stored in S3 with server-side encryption using AWS KMS (SSE-KMS). The Glue job fails with an error indicating that it cannot read the data. The IAM role used by Glue has the following policy. What is missing?

Accepted Answer

The kms:Decrypt permission on the KMS key. Option B is correct because the Glue job needs kms:Decrypt permission to read data encrypted with SSE-KMS. Option A is wrong because s3:GetObject is present. Option C is wrong because kms:GenerateDataKey is for writing, not reading. Option D is wrong because kms:ReEncrypt is not needed.

Answer

The s3:GetObject permission on the bucket

Answer

The kms:GenerateDataKey permission on the KMS key

Answer

The kms:ReEncrypt permission on the KMS key

Question 15

A data engineer needs to audit all changes to IAM policies in an AWS account. Which AWS service should be used?

Accepted Answer

AWS CloudTrail. Option D is correct because AWS CloudTrail records API calls, including IAM policy changes. Option A is wrong because AWS Config tracks resource configuration changes, not API calls. Option B is wrong because CloudWatch Logs is for log storage. Option C is wrong because AWS Organizations manages multiple accounts.

Answer

AWS Config

Answer

AWS Organizations

Answer

Amazon CloudWatch Logs