DEA-C01 Data Security and Governance Practice Test 5 — 15 Questions

Question 1

Refer to the exhibit. A data engineer applied this bucket policy to an S3 bucket. What is the effect of this policy?

Accepted Answer

Blocks HTTP requests to get objects. The bucket policy shown denies requests where aws:SecureTransport is false, which means any request not using HTTPS (i.e., HTTP) is denied. Since the policy targets the s3:GetObject action, the effect is that HTTP requests to get objects are blocked, while HTTPS requests remain allowed.

Answer

Allows only HTTPS requests to get objects

Answer

Allows only HTTP requests to get objects

Answer

Blocks all access to the bucket

Question 2

Refer to the exhibit. A data engineer runs this CLI command to investigate a recent change to an S3 bucket policy. What information does the command return?

Accepted Answer

A list of event IDs for PutBucketPolicy calls. The command uses CloudTrail's lookup-events to find all PutBucketPolicy API calls in a 24-hour period. It returns a list of events, each containing details like who made the call, when, and the request parameters. Option A is wrong because the command returns a list of event IDs, not an evaluation of compliance. Option B is wrong because the command does not show the current policy, only past events. Option C is wrong because the command does not evaluate compliance.

Answer

An evaluation of bucket policy compliance

Answer

The current bucket policy for all buckets

Answer

A report of all S3 bucket policy changes

Question 3

Refer to the exhibit. This KMS key policy is attached to a customer managed key. A data engineer finds that the DataEngineer role can encrypt but cannot decrypt data. What is the most likely cause?

Accepted Answer

The role does not have an IAM policy allowing kms:Decrypt. For a customer managed KMS key, both the key policy AND the IAM policy of the calling principal must allow the action (unless the key policy grants the account root full access and delegates to IAM). If the role can encrypt but not decrypt, the most likely cause is that the role's IAM policy grants kms:Encrypt and kms:GenerateDataKey but omits kms:Decrypt.

Answer

The key policy does not include kms:Decrypt in the IAM policy section

Answer

The key policy does not allow kms:Decrypt

Answer

The key policy does not allow kms:GenerateDataKey

Question 4

A company is using AWS Glue to process data stored in an S3 bucket that is encrypted with SSE-KMS. The Glue job fails with an 'Access Denied' error when trying to read the data. The IAM role used by the Glue job has permissions to read from the S3 bucket and to use the KMS key. What is the most likely cause of the failure?

Accepted Answer

The S3 bucket policy denies access to the Glue job. Although the IAM role has permissions to read from the S3 bucket and to use the KMS key, the S3 bucket policy might explicitly deny access to the Glue job. Bucket policies can override IAM permissions. The 'Access Denied' error often occurs when a bucket policy denies access even if the IAM role is authorized. Option A is incorrect because the bucket uses SSE-KMS as stated. Option C is possible but not necessarily the most likely without cross-account context. Option D is incorrect because the premise states the role has permissions to use the KMS key, which includes kms:Decrypt.

Answer

The S3 bucket is using SSE-S3 instead of SSE-KMS

Answer

The KMS key is in a different AWS account

Answer

The IAM role is missing the kms:Decrypt permission

Question 5

A data engineer needs to ensure that data in an S3 bucket is encrypted at rest. The bucket policy includes a condition that denies PutObject requests if the object is not encrypted. Which S3 encryption feature does this enforce?

Accepted Answer

S3 Bucket Policy. The S3 bucket policy enforces encryption at rest by denying PutObject requests that do not include encryption headers, effectively requiring encryption. This is an example of using a bucket policy to enforce encryption, not a separate S3 encryption feature. The policy condition checks for the presence of encryption headers (e.g., x-amz-server-side-encryption) and denies the request if absent.

Answer

S3 Object Lock

Answer

S3 MFA Delete

Answer

S3 Default Encryption

Question 6

A company must encrypt all data at rest in their Amazon RDS for MySQL instance. Which THREE steps are required to achieve this? (Select THREE.)

Accepted Answer

Use an AWS KMS key to encrypt the instance. Option B is correct because RDS encryption at rest is implemented with AWS KMS: you must specify a KMS customer master key (CMK) that RDS uses to encrypt the underlying storage, and this key is required when enabling encryption. Option C is correct because encryption at rest for an RDS for MySQL instance can only be enabled at creation time (via the console, CreateDBInstance API, or --storage-encrypted in the CLI); it cannot be turned on afterward for an existing unencrypted instance. Option E is correct because RDS automatically encrypts automated backups, read replicas, and snapshots using the same KMS key as the encrypted DB instance, so ensuring those artifacts are encrypted is part of achieving full data-at-rest encryption. Option A does not belong because SSL/TLS secures data in transit between clients and the DB instance, not data at rest. Option D does not belong because DB parameter groups control engine configuration settings and cannot enable or require storage encryption.

Answer

Enable SSL/TLS for database connections

Answer

Modify the DB parameter group to require encryption

Question 7

The IAM policy shown is attached to an IAM role. When a user assumes this role and tries to read an object in example-bucket that has no tags, what will happen?

Accepted Answer

The request will be denied because the Deny statement applies when the tag is missing. The Deny statement denies s3:GetObject if the object does not have the tag 'classification' (i.e., the tag is null). Since the object has no tags, the condition evaluates to true, and the action is denied. The Allow statement only allows if the tag equals 'public', which is not the case. The explicit Deny overrides any Allow, so access is denied.

Answer

The request will be denied because the object does not have the 'public' tag

Answer

The request will be allowed because the Allow statement grants access to all objects

Answer

The request will be allowed because there is no explicit Deny

Question 8

A data engineer uses the AWS CLI to list KMS keys and describe one. The output shows two keys. The described key has KeyState 'Enabled' and Origin 'AWS_KMS'. Which statement is true about this key?

Accepted Answer

The key is a KMS managed key that is enabled and ready for use. The key has KeyState 'Enabled' and Origin 'AWS_KMS', which means it is a KMS-managed key (created by AWS KMS) that is enabled and ready for use. The Origin 'AWS_KMS' indicates that the key material was generated by AWS KMS, not imported. The KeyState 'Enabled' means the key is active and can be used for cryptographic operations.

Answer

The key material was imported from an external source

Answer

The key is scheduled for deletion

Answer

The key is disabled and cannot be used

Question 9

A company uses AWS KMS to encrypt data in Amazon S3. The security team requires that all encryption keys be rotated automatically every year. Which key type should the company use?

Accepted Answer

Use a customer managed key with automatic rotation enabled. AWS KMS customer managed keys (CMKs) support automatic annual rotation, which the security team requires. Enabling automatic rotation on a customer managed key rotates the backing key material every year while preserving the key ID and ARN, so existing ciphertext remains decryptable. This satisfies the 'rotate automatically every year' requirement without manual intervention.

Answer

Use the default S3 managed encryption key (SSE-S3)

Answer

Use an AWS managed key (aws/s3)

Answer

Use a customer managed key with manual rotation

Question 10

A company stores sensitive data in Amazon S3. The security team requires that all data be encrypted at rest and that the encryption keys be stored in AWS CloudHSM. Which S3 encryption option should be used?

Accepted Answer

SSE-C. SSE-C (Server-Side Encryption with Customer-Provided Keys) is the correct choice because it allows the customer to provide their own encryption keys, which can be stored in AWS CloudHSM. With SSE-C, the customer retains full control over the keys, and AWS does not store them. This meets the requirement that encryption keys be stored in AWS CloudHSM, as the customer can manage the keys in CloudHSM and provide them to S3 during upload/download requests.

Answer

SSE-S3

Answer

SSE-KMS with an AWS managed key

Answer

SSE-KMS with a customer managed key

Question 11

A data engineer needs to grant cross-account access to an S3 bucket. The engineer wants to use a role in the source account and assume that role from the target account. Which permissions are required?

Accepted Answer

Role in source account with trust policy allowing target account, and bucket policy granting access to the role. Cross-account access via role assumption requires the source account to have an IAM role with a trust policy that explicitly allows the target account's AWS account ID to assume it. The bucket policy must then grant the necessary S3 actions (e.g., s3:GetObject) to that role's ARN, enabling the target account's assumed role session to access the bucket. This two-step mechanism—trust policy for authentication and bucket policy for authorization—is the standard AWS pattern for secure cross-account S3 access.

Answer

Bucket policy in source account allowing the target account's root user

Answer

Role in target account with trust policy allowing source account

Answer

IAM policy in target account allowing s3:GetObject on the bucket

Question 12

A company uses Amazon Redshift for data warehousing. The security team requires that all data be encrypted at rest using a key managed by the company. Which Redshift encryption option should be used?

Accepted Answer

Specify a customer managed KMS key when enabling encryption. Amazon Redshift supports encryption at rest using AWS KMS. To use a key managed by the company (customer managed key), you must specify a customer managed KMS key when enabling encryption. Option D is correct. Option A uses an AWS managed key (default), which is not managed by the company. Option B refers to encryption in transit, not at rest. Option C: HSM is not directly supported for Redshift encryption; KMS is used.

Answer

Enable encryption using AWS managed key (default)

Answer

Use SSL/TLS encryption

Answer

Use hardware security module (HSM)

Question 13

Which TWO actions are required to enforce encryption in transit for data being loaded into Amazon Redshift from Amazon S3? (Choose two.)

Accepted Answer

Configure Redshift to require SSL connections. Option A is correct because setting the Redshift cluster parameter require_ssl to true forces all client and COPY connections to use SSL/TLS, which is the mechanism that enforces encryption in transit for data loaded into Redshift. Option E is correct because using an S3 VPC endpoint (gateway endpoint) with HTTPS ensures that traffic between the Redshift cluster and S3 travels over an encrypted TLS channel within the AWS network, satisfying encryption-in-transit for the COPY operation. Option B is incorrect because client-side encryption protects data at rest before upload, not the network transmission path. Option C is incorrect because encryption at rest on the Redshift cluster protects stored data, not data in transit. Option D is incorrect because S3 server-side encryption encrypts objects at rest in the bucket and does not encrypt the connection carrying the data.

Answer

Use client-side encryption for data in S3

Answer

Enable encryption at rest on Redshift cluster

Answer

Enable S3 server-side encryption

Question 14

A company wants to monitor and alert on any IAM user creation in their AWS account. Which THREE services should be used together to achieve this? (Choose three.)

Accepted Answer

AWS CloudTrail. AWS CloudTrail (option B) captures API calls such as IAM user creation. CloudWatch Logs (option C) stores those logs, enabling monitoring and alerting. Amazon CloudWatch Events (EventBridge) (option D) can create rules to trigger notifications or actions when specific API calls occur. Amazon SNS (option A) is a notification service but does not capture API calls. AWS Config (option E) assesses configuration compliance, not API activity.

Answer

Amazon Simple Notification Service (SNS)

Answer

AWS Config

Question 15

Which TWO AWS services can be used to protect sensitive data stored in Amazon S3 by preventing accidental public access? (Choose two.)

Accepted Answer

AWS Trusted Advisor. Amazon S3 Block Public Access (option D) is a service that blocks public access at the bucket or account level. AWS Trusted Advisor (option C) has a check for S3 bucket permissions that can identify publicly accessible buckets. Option A is for network security, not S3. Option B is for malware protection. Option E is for encryption at rest, not public access prevention.

Answer

AWS WAF

Answer

Amazon GuardDuty

Answer

AWS Key Management Service (KMS)