DEA-C01 Data Security and Governance Practice Test 5 — 15 Questions

Question 1

A company is using Amazon S3 to store sensitive data. The security team requires that all objects be encrypted using server-side encryption with AWS KMS (SSE-KMS) and that the bucket policy denies any PutObject request that does not include the required encryption header. Which bucket policy condition should be added?

Accepted Answer

s3:x-amz-server-side-encryption-aws-kms-key-id. Option A is correct because s3:x-amz-server-side-encryption-aws-kms-key-id can be used to enforce a specific KMS key. Option B is wrong because s3:x-amz-server-side-encryption only enforces SSE-S3 or SSE-KMS, not a specific key. Option C is wrong because kms:EncryptionContext is for KMS, not S3. Option D is wrong because aws:SecureTransport is for in-transit encryption.

Answer

s3:x-amz-server-side-encryption

Answer

kms:EncryptionContext

Answer

aws:SecureTransport

Question 2

A data engineer is setting up an Amazon EMR cluster to process sensitive data. The data is stored in S3 with SSE-S3. The company policy requires that data in transit between the EMR cluster and S3 be encrypted. Which configuration should be used?

Accepted Answer

Enable S3 encryption in transit using TLS. Option C is correct because enabling S3 encryption in transit uses TLS to encrypt data between EMR and S3. Option A is wrong because SSE-S3 encrypts at rest, not in transit. Option B is wrong because EMRFS with SSE-KMS is for at-rest encryption. Option D is wrong because disabling encryption is not an option.

Answer

Disable encryption and use VPC endpoints

Answer

Configure EMRFS to use SSE-KMS

Answer

Use SSE-C for S3 objects

Question 3

A data engineer needs to enforce that all data in an Amazon S3 bucket is encrypted at rest. Which of the following can be used to achieve this? (Choose TWO.)

Accepted Answer

Configure a bucket policy to deny PutObject if encryption headers are missing. Option B and D are correct. S3 bucket policies can deny PutObject requests without encryption headers, and SSE-S3 ensures encryption at rest. Option A is wrong because CloudTrail logs API calls but does not enforce encryption. Option C is wrong because VPC endpoints provide network isolation, not encryption. Option E is wrong because KMS alone does not enforce encryption on S3.

Answer

Use AWS CloudTrail to monitor for unencrypted objects

Answer

Use VPC endpoints to restrict access

Answer

Use AWS KMS to generate encryption keys for the bucket

Question 4

A company is using AWS Lake Formation to manage permissions on a data lake. Which of the following are valid ways to grant access to a user or role? (Choose THREE.)

Accepted Answer

Grant permissions to a SAML or SCIM group. Options A, B, and E are correct. Lake Formation can grant directly to IAM users/roles, to SAML/SCIM groups, and through tag-based access control. Option C is wrong because AWS Organizations is for account management, not individual permissions. Option D is wrong because S3 bucket policies are separate from Lake Formation.

Answer

Grant permissions to an AWS Organizations unit

Answer

Grant permissions via an S3 bucket policy

Question 5

A data engineer is troubleshooting an Amazon Redshift cluster that is unable to access an S3 bucket for COPY operations. The cluster has an IAM role attached. Which of the following could be causing the failure? (Choose TWO.)

Accepted Answer

The S3 bucket policy denies access to the IAM role. Options B and D are correct. The IAM role must have permission to the S3 bucket, and the bucket policy must allow the role. Option A is wrong because VPC security groups control network traffic, not S3 access. Option C is wrong because encryption is not required for COPY. Option E is wrong because Redshift does not need KMS permissions unless using SSE-KMS.

Answer

The VPC security group does not allow outbound HTTPS traffic

Answer

The S3 bucket has default encryption enabled

Answer

The KMS key used for encryption is not shared with Redshift

Question 6

The IAM policy shown in the exhibit is attached to a user. The user tries to upload an object to my-bucket using the AWS CLI without specifying encryption. What will happen?

Accepted Answer

The upload will fail with an access denied error. Option C is correct because the policy allows s3:PutObject only if the request includes the header x-amz-server-side-encryption: AES256. Without that header, the condition is not met and the request is denied. Option A is wrong because the condition is not optional. Option B is wrong because default encryption applies to objects uploaded without encryption headers, but the policy explicitly requires the header. Option D is wrong because the policy does not require a specific KMS key.

Answer

The upload will succeed because the bucket has default encryption

Answer

The upload will succeed but the object will not be encrypted

Answer

The upload will fail because a KMS key is required

Question 7

A data engineer runs the command shown in the exhibit to check the bucket policy. A user from another AWS account is trying to download an object using HTTP (not HTTPS). What will happen?

Accepted Answer

The download will fail with an access denied error. Option B is correct because the bucket policy denies all actions when aws:SecureTransport is false (i.e., HTTP). Therefore, HTTP requests are denied. Option A is wrong because the policy denies HTTP requests. Option C is wrong because the policy does not require encryption at rest. Option D is wrong because the policy explicitly denies HTTP.

Answer

The download will succeed because the principal is not specified

Answer

The download will succeed if the object is encrypted at rest

Answer

The download will succeed because the policy only denies write operations

Question 8

A data engineer receives the error shown in the exhibit when trying to upload a file to my-bucket. The engineer uses the AWS CLI with the following command: aws s3 cp file.txt s3://my-bucket/. What is the most likely cause of the error?

Accepted Answer

The object is not encrypted with SSE-KMS. Option B is correct because the bucket policy denies PutObject if the encryption header is not set to aws:kms (SSE-KMS). The CLI command does not specify encryption, so the condition StringNotEquals matches and denies the request. Option A is wrong because the bucket policy explicitly denies non-KMS encrypted uploads. Option C is wrong because the error is not a network issue. Option D is wrong because the policy does not require KMS key ID, just the header value.

Answer

The KMS key specified in the command is incorrect

Answer

The VPC endpoint policy is blocking the request

Answer

The bucket does not have a default encryption configuration

Question 9

A data engineer needs to ensure that an S3 bucket is encrypted at rest using AWS KMS. The bucket policy must allow only a specific IAM role to access the bucket and enforce encryption in transit. Which combination of bucket policy statements should be used?

Accepted Answer

Use kms:ViaService: s3.*.amazonaws.com and aws:SecureTransport: true. Option C is correct because it uses the kms:EncryptionContext condition to enforce KMS encryption and aws:SecureTransport for TLS. Option A is wrong because it requires SSE-S3, not KMS. Option B is wrong because it allows any KMS key. Option D is wrong because it allows access without encryption in transit.

Answer

Use s3:x-amz-server-side-encryption: AES256 and aws:SecureTransport: true

Answer

Use s3:x-amz-server-side-encryption-aws-kms-key-id and aws:SourceIp

Answer

Use kms:EncryptionContext: service:s3 and aws:SecureTransport: true

Question 10

A company uses AWS Lake Formation to manage permissions on a data lake in S3. A data analyst reports that queries using Amazon Athena return zero rows for a table that the analyst has been granted SELECT permission on. The table is registered in Lake Formation and uses a partition projection. What is the most likely cause?

Accepted Answer

The analyst lacks GetObject and ListBucket permissions on the underlying S3 location. Option B is correct because partition projection requires explicit S3 permissions to list the partition location, which Lake Formation may not automatically grant. Option A is wrong because SELECT permission is granted. Option C is wrong because encryption settings don't cause zero rows. Option D is wrong because the table is registered.

Answer

The table is not registered as a resource in Lake Formation

Answer

The analyst does not have DESCRIBE permission on the table

Answer

The table uses server-side encryption with KMS and the analyst lacks kms:Decrypt permission

Question 11

A data engineer needs to audit all AWS KMS key usage in the account. Which AWS service should be used to record KMS API calls?

Accepted Answer

AWS CloudTrail. Option A is correct because AWS CloudTrail records API calls for KMS. Option B is wrong because CloudWatch Logs stores logs but does not record API calls. Option C is wrong because AWS Config records resource changes, not API calls. Option D is wrong because Amazon GuardDuty is for threat detection.

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Answer

Amazon GuardDuty

Question 12

A company wants to enable automatic encryption for all new objects written to an S3 bucket. The bucket has existing objects that are unencrypted. Which solution meets these requirements with the least operational overhead?

Accepted Answer

Enable default encryption on the bucket using SSE-S3. Option C is correct because bucket default encryption automatically encrypts new objects. Option A is wrong because it only encrypts objects during upload, not after. Option B is wrong because S3 Batch Operations is more complex. Option D is wrong because it's not automatic.

Answer

Configure a lifecycle policy to transition objects to a new bucket with encryption

Answer

Use S3 server-side encryption with S3 managed keys (SSE-S3) and apply a bucket policy that denies writes without encryption

Answer

Use S3 Batch Operations to copy existing objects with SSE-S3

Question 13

A data engineer is designing a system to handle sensitive customer data in Amazon RDS for PostgreSQL. The compliance team requires that the data be encrypted at rest and that encryption keys be rotated every 90 days. Which solution meets these requirements?

Accepted Answer

Enable RDS encryption with a customer managed KMS key, enable automatic key rotation, and manually rotate the key every 90 days. Option D is correct because enabling RDS encryption with KMS and using automatic key rotation (annually) and manual rotation every 90 days meets the requirement. Option A is wrong because RDS does not support Transparent Data Encryption. Option B is wrong because CloudHSM is not integrated with RDS. Option C is wrong because KMS automatic rotation is yearly, not 90 days.

Answer

Use AWS CloudHSM to store the encryption key and create a custom key rotation Lambda function

Answer

Enable Transparent Data Encryption (TDE) on the RDS instance

Answer

Enable RDS encryption with a customer managed KMS key and enable automatic key rotation

Question 14

A company uses AWS Glue to process data. The security team requires that all data in transit between AWS Glue and Amazon S3 be encrypted using TLS. Which configuration should be used?

Accepted Answer

Enable S3 server-side encryption and use HTTPS endpoints. Option A is correct because AWS Glue uses TLS for data in transit by default. Option B is wrong because S3 default encryption is for at-rest. Option C is wrong because VPC endpoints use AWS PrivateLink but don't enforce encryption. Option D is wrong because it's not required for TLS.

Answer

Configure a bucket policy to require aws:SecureTransport

Answer

Enable default encryption on the S3 bucket using SSE-KMS

Answer

Use an S3 VPC endpoint

Question 15

A data engineer is troubleshooting an Amazon Redshift cluster that is not responding to queries. The engineer suspects that the cluster may have been accidentally deleted. Which AWS service should be used to investigate the deletion?

Accepted Answer

AWS CloudTrail. Option A is correct because AWS CloudTrail records DeleteCluster API calls. Option B is wrong because CloudWatch Logs stores logs but not API calls. Option C is wrong because AWS Config records resource changes, not deletions? Actually Config would show a deletion, but CloudTrail is more direct for API calls. The best answer is CloudTrail. Option D is wrong because AWS Trusted Advisor is for best practices.

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Answer

AWS Trusted Advisor