DEA-C01 Data Security and Governance Practice Test 4 — 15 Questions

Question 1

A data engineer notices that an S3 bucket policy allows access to a user from another AWS account, but the access is being denied. What could be the reason?

Accepted Answer

The other account's IAM user does not have permissions to access the bucket. For cross-account S3 access to succeed, both the bucket policy (resource-based policy) and the IAM user policy (identity-based policy) in the other account must grant the necessary permissions. Option B is correct because even if the bucket policy allows access from the other account, the IAM user in that account must have an explicit IAM policy that permits the S3 action (e.g., s3:GetObject) on the bucket. Without this, the request is denied by the other account's own IAM evaluation.

Answer

The bucket policy does not include KMS permissions

Answer

S3 does not support cross-account access

Answer

The bucket is in a different region

Question 2

A company needs to encrypt data in transit between an EC2 instance and an S3 bucket. Which method should be used?

Accepted Answer

Use HTTPS endpoints. HTTPS endpoints encrypt data in transit between EC2 and S3 using TLS/SSL, ensuring confidentiality and integrity over the public internet. S3 supports HTTPS natively on its REST endpoints, and the AWS SDKs default to HTTPS, making this the simplest and most secure method for encrypting data in motion.

Answer

Use plain HTTP

Answer

Use an IPsec VPN

Answer

Server-side encryption (SSE)

Question 3

A data engineer is designing a data pipeline that processes PII data in AWS Glue. They need to ensure data is encrypted at rest and in transit. Which TWO actions should they take? (Choose TWO.)

Accepted Answer

Configure S3 bucket server-side encryption for job output. To ensure data is encrypted at rest and in transit, the data engineer should configure S3 bucket server-side encryption for job output (Option B) because Glue jobs write output to S3, and server-side encryption protects data at rest. Additionally, enabling encryption at rest for the AWS Glue Data Catalog (Option E) encrypts the catalog metadata at rest. Option A is incorrect because SSL should not be disabled; SSL provides encryption in transit. Option C is incorrect because KMS keys for Glue job bookmarks encrypt only bookmarks, not all data. Option D is incorrect because CloudWatch Logs are for logging, not for encryption.

Answer

Disable SSL for Glue connections

Answer

Use a KMS key for Glue job bookmarks

Answer

Use CloudWatch Logs for encryption

Question 4

A company wants to implement least privilege access for its data lake on S3. Which THREE practices should be followed? (Choose THREE.)

Accepted Answer

Use S3 bucket policies for cross-account access. The correct answers are B, C, and E. To implement least privilege for an S3 data lake, use S3 bucket policies for cross-account access (B), use S3 access points to enforce network policies (C), and use IAM policies to grant specific permissions (E). Option A is incorrect because granting s3:* to all users violates least privilege. Option D is incorrect because disabling S3 Block Public Access increases risk; it should be enabled.

Answer

Grant s3:* to all users for simplicity

Answer

Disable S3 Block Public Access to allow flexibility

Question 5

A data engineer needs to audit data access in Amazon S3 for compliance. Which TWO services can be used to capture and analyze S3 access logs? (Choose TWO.)

Accepted Answer

AWS CloudTrail. Options B and C are correct. AWS CloudTrail can be configured to record S3 data events, capturing API calls made to S3 buckets. S3 server access logs provide detailed records of all requests made to an S3 bucket, including source IP, requester, and operation. Option A (Amazon CloudWatch Logs) is used for monitoring and storing logs from various sources, but it does not natively generate S3 access logs. Option D (Amazon Macie) is for sensitive data discovery and classification. Option E (AWS Config) is for tracking resource configuration changes.

Answer

Amazon CloudWatch Logs

Answer

Amazon Macie

Answer

AWS Config

Question 6

Refer to the exhibit. A data engineer attached this S3 bucket policy to the bucket 'example-bucket'. What is the effect of this policy?

Accepted Answer

It denies PutObject requests that do not use SSE-S3. The bucket policy denies PutObject requests that do not include the x-amz-server-side-encryption header with value AES256 (SSE-S3). This means any PutObject request without SSE-S3 encryption is denied. Therefore, the correct answer is B.

Answer

It allows all PutObject requests that do not use encryption

Answer

It denies all PutObject requests unless they use SSE-KMS

Answer

It denies all PutObject requests from anonymous users

Question 7

Refer to the exhibit. The exhibit shows output from AWS CLI commands. Which key can be used to enable automatic annual rotation?

Accepted Answer

The first key (1234abcd-...). (the first key) is correct because automatic annual rotation is only configurable for customer managed keys. The first key is customer managed, allowing the user to enable or disable automatic rotation with a specified frequency (e.g., annually). The second key is AWS managed, which rotates automatically every three years without user configuration, so its rotation cannot be enabled or disabled by the user. Options A and B are incorrect because the second key (AWS managed) does not support user-controlled automatic rotation, and both keys cannot have rotation configured independently. Option C is incorrect because the first key (customer managed) does support automatic annual rotation.

Answer

The second key (5678efgh-...)

Answer

Both keys

Answer

Neither key

Question 8

Refer to the exhibit. An IAM policy includes this statement. What access does it grant?

Accepted Answer

It allows GetObject access to the bucket only from IP addresses in 10.0.0.0/8. The policy statement allows the s3:GetObject action on the specified bucket, with a condition that the request must originate from an IP address within the 10.0.0.0/8 range. Therefore, it grants GetObject access only from IP addresses in that range. Option A is incorrect because the policy allows, not denies. Option B is incorrect because the condition is based on IP address, not VPC. Option C is incorrect because the action is GetObject, not PutObject. Option D correctly describes the access granted.

Answer

It denies GetObject access to the bucket from IP addresses in 10.0.0.0/8

Answer

It allows GetObject access to the bucket only from a specific VPC

Answer

It allows PutObject access to the bucket from any IP address

Question 9

A company uses AWS Glue to process sensitive customer data stored in S3. The data engineer must ensure that the Glue ETL jobs do not write any data to S3 buckets that lack encryption. Which approach meets this requirement?

Accepted Answer

Attach an S3 bucket policy that denies s3:PutObject unless the request includes the x-amz-server-side-encryption header. An S3 bucket policy with a condition key such as s3:x-amz-server-side-encryption can deny s3:PutObject requests that do not specify encryption, thereby preventing unencrypted writes. Option A is incorrect because AWS CloudTrail is an auditing service that logs API calls but does not actively prevent writes. Option C is incorrect because while S3 default encryption automatically encrypts objects at rest, it does not enforce that write requests include encryption headers; the bucket policy approach ensures encryption is explicitly requested. Option D is incorrect because an IAM role policy can also enforce encryption, but a bucket policy is more comprehensive as it applies to all principals accessing the bucket, including the Glue service role.

Answer

Use AWS CloudTrail to monitor and alert on unencrypted writes

Answer

Enable S3 default encryption on the bucket

Answer

Configure an IAM role for Glue with a policy that denies s3:PutObject without encryption

Question 10

A company uses AWS Lake Formation to manage access to data in a data lake. The data engineer needs to grant a user the ability to query tables in the 'sales' database using Amazon Athena, but only when the user's IP address is within the corporate network (10.0.0.0/8). Which combination of actions should the data engineer take?

Accepted Answer

Grant Lake Formation permissions on the tables and attach an IAM policy to the user with aws:SourceIp condition. Lake Formation permissions are needed to grant query access to the tables in the 'sales' database, and an IAM policy attached to the user with a condition key `aws:SourceIp` restricts Athena access to the corporate IP range (10.0.0.0/8). Option A is incorrect because S3 bucket policies with `aws:SourceIp` cannot be used to restrict Athena queries through Lake Formation; Lake Formation manages access at a higher level. Option C is incorrect because using an S3 VPC endpoint alone does not enforce IP-based restrictions; it only restricts network traffic to the VPC. Option D is incorrect because network ACLs operate at the subnet level and do not control access to specific Lake Formation resources or Athena queries.

Answer

Grant Lake Formation permissions on the tables and attach an S3 bucket policy with aws:SourceIp condition

Answer

Use an S3 VPC endpoint and grant Lake Formation permissions on the tables

Answer

Grant Lake Formation permissions on the tables and configure a network ACL in the VPC

Question 11

A data engineer is designing a data pipeline that ingests personally identifiable information (PII) into Amazon Redshift. The engineer needs to ensure that only authorized users can view the data, and that all queries are logged for auditing. Which combination of AWS services should the engineer use?

Accepted Answer

AWS CloudTrail and Amazon CloudWatch Logs. AWS CloudTrail and Amazon CloudWatch Logs. CloudTrail logs API calls to Redshift for auditing administrative actions, while Amazon Redshift can be configured to send audit logs (including SQL queries) to Amazon CloudWatch Logs. This combination ensures both API activity and data access are logged. Option A is incorrect because Amazon Redshift audit logging is not a separate service; audit logs can be sent to CloudWatch Logs. Option B is incorrect because IAM Access Analyzer does not log queries. Option C is incorrect because S3 access logs only capture access to S3 objects, not Redshift queries.

Answer

AWS CloudTrail and Amazon Redshift audit logging

Answer

AWS IAM Access Analyzer and Amazon Redshift audit logging

Answer

Amazon S3 access logs and AWS CloudTrail

Question 12

A company wants to enforce that all data written to an S3 bucket is encrypted with a customer-managed AWS KMS key. The data engineer has created the KMS key and attached an S3 bucket policy. However, users are still able to upload objects without specifying the KMS key. What is the most likely cause?

Accepted Answer

The S3 bucket policy does not include a condition that denies s3:PutObject without the correct encryption. The bucket policy must explicitly deny s3:PutObject if the encryption header does not match the required KMS key. Without this condition, users can upload objects without specifying the KMS key, even if the bucket has default encryption. Option B is wrong because default encryption with SSE-S3 does not enforce a customer-managed KMS key. Option C is wrong because the KMS key policy grants encryption permissions, but the issue is that the bucket policy does not deny non-compliant uploads. Option D is wrong because the IAM role's s3:PutObject permission is not the issue; the issue is the lack of a condition in the bucket policy.

Answer

The S3 bucket has default encryption enabled with SSE-S3

Answer

The KMS key policy does not grant the users kms:Encrypt permission

Answer

The IAM role for the users does not have s3:PutObject permission

Question 13

A company uses Amazon RDS for PostgreSQL to store financial data. The security team requires that all database connections be encrypted in transit and that the database audit logs be stored in Amazon S3 for at least 7 years. Which steps should the data engineer take to meet these requirements?

Accepted Answer

Set the `rds.force_ssl` parameter to 1 in the DB parameter group, and export RDS audit logs to Amazon CloudWatch Logs with a subscription to Amazon S3. Setting `rds.force_ssl` to 1 in the DB parameter group forces all connections to use SSL/TLS, ensuring encryption in transit. To store audit logs in S3 for at least 7 years, you can export RDS audit logs to Amazon CloudWatch Logs and create a subscription filter to stream them to Amazon S3, where an S3 lifecycle policy can manage retention. Option A is incorrect because encryption at rest does not enforce TLS for connections, and RDS cannot publish logs directly to S3. Option B is incorrect because security groups control network access, not encryption protocol, and CloudTrail logs AWS API calls, not database queries. Option C is incorrect because ACM certificates are not used with RDS for SSL connections, and streaming to Kinesis Firehose is unnecessary and not directly supported for RDS audit logs.

Answer

Enable encryption at rest using AWS KMS, and configure the RDS instance to publish logs to an S3 bucket with a lifecycle policy

Answer

Configure the DB security group to allow only TLS connections, and set up AWS CloudTrail to log all database queries

Answer

Use an SSL certificate from AWS Certificate Manager (ACM) and attach it to the RDS instance, and stream logs to Amazon Kinesis Data Firehose with S3 destination

Question 14

A data engineer is troubleshooting an issue where an AWS Glue ETL job fails when trying to read data from an S3 bucket encrypted with SSE-KMS. The job has an IAM role that includes `kms:Decrypt` permission. What is the most likely reason for the failure?

Accepted Answer

The KMS key policy does not allow the Glue job to use the key. The most likely reason for the failure, even with kms:Decrypt permission in the IAM role, is that the KMS key policy explicitly denies the Glue job's IAM role access to the key. AWS Glue ETL jobs can read SSE-KMS encrypted S3 objects without additional configuration; the job's IAM role must be allowed by the key policy. Option A is incorrect because the IAM role likely has s3:GetObject permission. Option C is incorrect because cross-region S3 access is permitted with proper permissions. Option D is incorrect because Glue does not require explicit KMS key configuration for reading; the key is identified in the S3 object metadata, and the job's IAM role is trusted to use the key based on key policy.

Answer

The IAM role does not have s3:GetObject permission

Answer

The S3 bucket is in a different AWS region than the Glue job

Answer

The Glue job is not configured to use the KMS key for decryption

Question 15

A company uses Amazon DynamoDB to store session data. The security team requires that all data be encrypted at rest using a customer-managed KMS key. The data engineer has enabled encryption with a KMS key, but discovers that old data remains encrypted with the previous AWS-managed key. How can the engineer re-encrypt all existing data with the new key?

Accepted Answer

Export the table to S3 using DynamoDB Export to S3, then import using DynamoDB Import from S3 with the new encryption key specified. Exporting the table to S3 and then importing it with a new KMS key re-encrypts all data at rest using the new key. Option A is wrong because disabling and re-enabling encryption does not re-encrypt existing data; DynamoDB does not support in-place re-encryption of existing items. Option B is wrong because AWS Backup restores the table with the original encryption; it does not allow specifying a new key for existing data. Option C is wrong because changing the encryption key only applies to new writes; there is no 'Apply to existing data' option in the DynamoDB console.

Answer

Disable and re-enable encryption with the new KMS key

Answer

Use AWS Backup to back up the table and restore it with the new encryption key

Answer

Use the DynamoDB console to change the encryption key and select 'Apply to existing data'