DEA-C01 Data Security and Governance Practice Test 5 — 15 Questions

Question 1

A data engineer needs to grant an IAM user access to query a specific table in Amazon Athena, but the user should not be able to view other tables in the same database. Which method should the engineer use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use AWS Lake Formation to grant SELECT permission on the specific table to the user. Lake Formation provides fine-grained table-level permissions. Option A is wrong because IAM policies alone cannot restrict access to a specific table in Athena without Lake Formation. Option C is wrong because S3 bucket policies do not control Athena table access. Option D is wrong because Workgroup policies do not provide table-level security.

Answer

Attach an IAM policy that allows athena:StartQueryExecution and restrict the query by table name

Answer

Apply an S3 bucket policy that restricts access to the table's underlying data

Answer

Create a separate Athena workgroup with a query limit that only allows queries on that table

Question 2

A company stores sensitive data in Amazon S3. The data engineer needs to implement a solution that automatically detects and redacts PII in new objects as they are uploaded. Which TWO AWS services should be used together?

Accepted Answer

Amazon Macie. Amazon Macie is a fully managed data security and data privacy service that uses machine learning and pattern matching to discover and protect sensitive data in Amazon S3. Amazon Comprehend is a natural language processing (NLP) service that can be used to detect and redact PII entities from text. Together, they enable automated detection and redaction of PII in newly uploaded S3 objects by triggering Macie to identify sensitive data and then using Comprehend to redact the PII.

Answer

AWS Glue ETL

Answer

Amazon DynamoDB

Answer

AWS Glue Data Catalog

Question 3

A company uses AWS KMS to encrypt data in Amazon Redshift. The data engineer needs to rotate the customer-managed KMS key annually. Which TWO actions must be taken to successfully rotate the key without data loss?

Accepted Answer

Create a new KMS key and update the Redshift cluster to use the new key. You must create a new KMS key and update the Redshift cluster to use the new key for encrypting future data. Option B is correct because the old key must remain enabled to allow decryption of data that was encrypted with it; without the old key, existing data becomes inaccessible. Option C is incorrect because CloudTrail is used for auditing API calls, not as a required action for key rotation. Option D is incorrect because storing the key in Amazon S3 is unnecessary; KMS already securely stores keys. Option E is incorrect because automatic key rotation on the existing key does not create a new key; it rotates the key material automatically, which is not the scenario described (a new key must be created and the cluster updated).

Answer

Use AWS CloudTrail to verify the key rotation was successful

Answer

Store the new key in Amazon S3 for backup

Answer

Enable automatic KMS key rotation on the existing key

Question 4

A data engineer is designing a data lake on Amazon S3 that must comply with GDPR. The engineer needs to ensure that individuals can request deletion of their personal data. Which THREE AWS services can be used together to automate the deletion of specific records?

Accepted Answer

AWS Lambda. AWS Lambda can be used to process deletion requests and trigger actions. Amazon S3 Batch Operations can perform bulk actions on S3 objects, such as deleting them. Amazon S3 Select can query specific records within S3 objects to identify which ones need deletion, enabling targeted removal. Together, these services automate the deletion of specific records to comply with GDPR. AWS Glue is an ETL service, not designed for selective deletion, and Amazon DynamoDB is a NoSQL database, not directly applicable to S3 data.

Answer

AWS Glue

Answer

Amazon DynamoDB

Question 5

Refer to the exhibit. A data engineer attaches this bucket policy to an S3 bucket. A developer tries to upload an object to the bucket using the AWS CLI with the command: `aws s3 cp file.txt s3://my-bucket/`. The upload fails. What is the most likely reason?

Accepted Answer

The CLI command does not specify the encryption header, so the request is denied by the policy. The correct answer. The bucket policy condition `aws:SecureTransport` or similar encryption requirement (e.g., `s3:x-amz-server-side-encryption`) denies requests that do not include the required encryption header. The `aws s3 cp` CLI command does not automatically include the `x-amz-server-side-encryption` header; it uses SSE-S3 by default without setting the header explicitly. Therefore, the request is denied because the header is missing. Option B is incorrect because the policy does not depend on region. Option C is incorrect because the policy does not require a specific KMS key ID; it only requires the encryption header. Option D is incorrect because the IAM user likely has `s3:PutObject` permission, but the bucket policy explicitly denies the request due to missing encryption header.

Answer

The developer used the wrong AWS region

Answer

The CLI command does not include the required KMS key ID

Answer

The IAM user does not have s3:PutObject permission

Question 6

Refer to the exhibit. A data engineer reviews an Amazon S3 server access log entry for an object upload. The log shows a status of 200 and encryption status "AES256". The company policy requires that all data be encrypted with SSE-KMS. Which action should the engineer take to enforce this policy?

Accepted Answer

Attach an S3 bucket policy that denies s3:PutObject unless the request includes x-amz-server-side-encryption: aws:kms. The log shows the object was uploaded with SSE-S3 (AES256), not the required SSE-KMS. To enforce the policy, the engineer should attach an S3 bucket policy that denies s3:PutObject unless the request includes the x-amz-server-side-encryption header set to aws:kms. Option D (default encryption) would encrypt new objects with SSE-KMS, but it does not block uploads that explicitly use SSE-S3; default encryption only applies when no encryption header is specified. Options B and C do not enforce the policy: revoking IAM permissions is too broad and CloudTrail only logs events.

Answer

Revoke the IAM role's s3:PutObject permission

Answer

Enable AWS CloudTrail data events to monitor future uploads

Answer

Enable S3 default encryption with SSE-KMS on the bucket

Question 7

Refer to the exhibit. A data engineer runs the AWS CLI command and gets the output shown. The engineer wants to grant a data analyst read-only access to the 'sales_db' database in AWS Glue Data Catalog using IAM. Which IAM policy statement is required?

Accepted Answer

{"Effect": "Allow", "Action": "glue:GetDatabase", "Resource": "arn:aws:glue:us-east-1:123456789012:database/sales_db"}. To grant read-only access to a database in AWS Glue Data Catalog, the required IAM action is glue:GetDatabase. Option B correctly specifies this action and targets the specific database resource. Option A uses glue:GetTable, which is for tables, not databases. Option C uses glue:GetDatabases, which is for listing databases and requires broader permissions. Option D uses s3:GetObject, which is for S3 data access, not Glue catalog operations.

Answer

{"Effect": "Allow", "Action": "glue:GetTable", "Resource": "arn:aws:glue:us-east-1:123456789012:table/sales_db/*"}

Answer

{"Effect": "Allow", "Action": "glue:GetDatabases", "Resource": "*"}

Answer

{"Effect": "Allow", "Action": "s3:GetObject", "Resource": "arn:aws:s3:::data-lake-sales/*"}

Question 8

A data engineer needs to encrypt data in transit between an Amazon RDS for MySQL instance and an application. Which solution should be used?

Accepted Answer

Use SSL/TLS to connect to the RDS instance. SSL/TLS is used to encrypt data in transit between clients and RDS. Option A is wrong because KMS encrypts data at rest, not in transit. Option C is wrong because S3 is not involved in this scenario. Option D is wrong because CloudHSM provides hardware security modules for key storage, not encryption in transit.

Answer

Enable encryption at rest using AWS KMS

Answer

Store the data in Amazon S3 with server-side encryption

Answer

Use AWS CloudHSM to generate and store encryption keys

Question 9

A company is using AWS Lake Formation to manage access to data in a data lake stored in Amazon S3. A data engineer notices that users with SELECT permissions on a table can still query the underlying S3 data directly using Athena. What is the most likely cause?

Accepted Answer

The users are using a version of Athena that does not support Lake Formation. Athena workgroups using engine version 1 do not support integration with Lake Formation. In such cases, Lake Formation permissions are not enforced, and users can query the underlying S3 data directly through Athena, bypassing Lake Formation's access controls. Option A is incorrect: while a permissive S3 bucket policy could allow direct access, the most likely cause given Lake Formation integration is the Athena version. Option C is incorrect because server-side encryption does not affect Lake Formation's ability to enforce permissions. Option D is incorrect: Lake Formation does integrate with Athena, but only when using Athena engine version 2 or later.

Answer

The S3 bucket policy allows full access to all principals

Answer

The S3 bucket does not have server-side encryption enabled

Answer

Lake Formation does not support integration with Athena

Question 10

A data engineer is designing a data pipeline that ingests data from an on-premises system into Amazon S3 using AWS Transfer Family. The data must be encrypted at rest using a customer-managed key in AWS KMS. The S3 bucket policy must allow only encrypted connections. Which policy condition should be used?

Accepted Answer

aws:SecureTransport. The condition aws:SecureTransport is used to enforce that connections to S3 are encrypted in transit using TLS/HTTPS. This ensures data is encrypted during transmission. Option B is incorrect because kms:EncryptionContext is used to add encryption context to KMS operations, not to enforce encrypted connections. Option C is incorrect because s3:x-amz-server-side-encryption-aws-kms-key-id enforces the use of a specific KMS key for server-side encryption, not in-transit encryption. Option D is incorrect because s3:x-amz-server-side-encryption enforces server-side encryption (SSE) for objects at rest, not in-transit encryption.

Answer

kms:EncryptionContext

Answer

s3:x-amz-server-side-encryption-aws-kms-key-id

Answer

s3:x-amz-server-side-encryption

Question 11

A company is using Amazon Redshift for data warehousing. They need to ensure that all queries are logged for audit purposes. Which AWS service should be used to capture query logs?

Accepted Answer

Amazon CloudWatch Logs. Amazon Redshift can be configured to publish audit logs, including query logs, to Amazon CloudWatch Logs, which provides a centralized log management service. Option A is incorrect because AWS CloudTrail captures API activity within your AWS account, not specific database query logs. Option B is incorrect because Amazon S3 is a storage service, not a logging service. Option D is incorrect because Amazon Athena is an interactive query service used to analyze data in S3, not a logging service.

Answer

AWS CloudTrail

Answer

Amazon S3

Answer

Amazon Athena

Question 12

A data engineer needs to share a dataset stored in Amazon S3 with another AWS account. The bucket policy currently grants access only to the owning account. What is the simplest way to grant cross-account access?

Accepted Answer

Add a bucket policy that grants access to the other account's IAM role. The simplest way to grant cross-account access to an S3 bucket is to add a bucket policy that specifies the other AWS account's IAM role as the principal. This allows the role to access the bucket without requiring additional setup in the target account. Option B (public-read ACL) would make the data publicly accessible, which is not secure and not recommended for cross-account sharing. Option C (using an ACL) is less flexible and does not support granting access to specific IAM roles across accounts. Option D (creating an IAM role in the other account) is unnecessary because the bucket policy can directly grant access to the other account's role.

Answer

Set the object ACL to public-read

Answer

Use an S3 access control list (ACL) to grant access to the other account

Answer

Create an IAM role in the other account and attach a policy to it

Question 13

An organization is using AWS Glue to process sensitive data. The data is stored in S3 with server-side encryption using AWS KMS (SSE-KMS). The Glue job fails with an error indicating that it cannot read the data. The IAM role used by Glue has the following policy. What is missing?

Accepted Answer

The kms:Decrypt permission on the KMS key. The Glue job fails because the IAM role lacks the kms:Decrypt permission on the KMS key. While s3:GetObject is also required, the role already has that permission (or it is not the missing permission causing the error). The key missing permission for decrypting SSE-KMS encrypted data is kms:Decrypt. Option A is incorrect because s3:GetObject is present. Option B is correct. Options C and D are incorrect because they are not required for read operations.

Answer

The s3:GetObject permission on the bucket

Answer

The kms:GenerateDataKey permission on the KMS key

Answer

The kms:ReEncrypt permission on the KMS key

Question 14

A data engineer needs to audit all changes to IAM policies in an AWS account. Which AWS service should be used?

Accepted Answer

AWS CloudTrail. WS CloudTrail because it records API calls made in the account, including changes to IAM policies. AWS Config tracks resource configuration changes, not API calls. AWS Organizations is for multi-account management. Amazon CloudWatch Logs is for log storage and monitoring, not auditing API calls.

Answer

AWS Config

Answer

AWS Organizations

Answer

Amazon CloudWatch Logs

Question 15

A company is using Amazon S3 to store sensitive data. The security team requires that all objects be encrypted using server-side encryption with AWS KMS (SSE-KMS) and that the bucket policy denies any PutObject request that does not include the required encryption header. Which bucket policy condition should be added?

Accepted Answer

s3:x-amz-server-side-encryption-aws-kms-key-id. S3:x-amz-server-side-encryption-aws-kms-key-id can be used to enforce a specific KMS key. Option B is wrong because s3:x-amz-server-side-encryption only enforces SSE-S3 or SSE-KMS, not a specific key. Option C is wrong because kms:EncryptionContext is for KMS, not S3. Option D is wrong because aws:SecureTransport is for in-transit encryption.

Answer

s3:x-amz-server-side-encryption

Answer

kms:EncryptionContext

Answer

aws:SecureTransport