DEA-C01 Data Security and Governance Practice Test 6 — 15 Questions

Question 1

A data engineer is setting up an Amazon EMR cluster to process sensitive data. The data is stored in S3 with SSE-S3. The company policy requires that data in transit between the EMR cluster and S3 be encrypted. Which configuration should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable S3 encryption in transit using TLS. Enabling S3 encryption in transit using TLS encrypts data between the EMR cluster and S3. Amazon S3 supports HTTPS (TLS) endpoints by default, and this ensures that data is encrypted during transfer. Option B is wrong because disabling encryption is not allowed per policy. Option C is incorrect because EMRFS with SSE-KMS encrypts data at rest, not in transit. Option D is wrong because SSE-C is also an at-rest encryption mechanism, not for transit.

Answer

Disable encryption and use VPC endpoints

Answer

Configure EMRFS to use SSE-KMS

Answer

Use SSE-C for S3 objects

Question 2

A data engineer needs to enforce that all data in an Amazon S3 bucket is encrypted at rest. Which of the following can be used to achieve this? (Choose TWO.)

Accepted Answer

Configure a bucket policy to deny PutObject if encryption headers are missing. Options C and D are correct. Configuring a bucket policy to deny PutObject requests that lack encryption headers (C) enforces encryption at upload time. Enabling default encryption on the S3 bucket using SSE-S3 (D) automatically encrypts objects at rest, even if uploaded without encryption headers. Together, these ensure all data at rest is encrypted. Option A is incorrect because CloudTrail only logs API calls and does not enforce encryption. Option B is incorrect because VPC endpoints provide network isolation, not encryption. Option E is incorrect because KMS generating keys alone does not enforce encryption on S3; the bucket must be configured to use those keys.

Answer

Use AWS CloudTrail to monitor for unencrypted objects

Answer

Use VPC endpoints to restrict access

Answer

Use AWS KMS to generate encryption keys for the bucket

Question 3

A company is using AWS Lake Formation to manage permissions on a data lake. Which of the following are valid ways to grant access to a user or role? (Choose THREE.)

Accepted Answer

Grant permissions to a SAML or SCIM group. Options A, B, and C are correct. Lake Formation can grant permissions directly to IAM users/roles (C), to SAML/SCIM groups (A), and via tag-based access control using LF-Tags (B). Option D is incorrect because AWS Organizations units manage accounts, not individual permissions. Option E is incorrect because S3 bucket policies are separate from Lake Formation and cannot be used to grant Lake Formation permissions.

Answer

Grant permissions to an AWS Organizations unit

Answer

Grant permissions via an S3 bucket policy

Question 4

A data engineer is troubleshooting an Amazon Redshift cluster that is unable to access an S3 bucket for COPY operations. The cluster has an IAM role attached. Which of the following could be causing the failure? (Choose TWO.)

Accepted Answer

The S3 bucket policy denies access to the IAM role. Options B and D are correct. The IAM role must have permission to the S3 bucket, and the bucket policy must allow the role. Option A is wrong because VPC security groups control network traffic, not S3 access. Option C is wrong because encryption is not required for COPY. Option E is wrong because Redshift does not need KMS permissions unless using SSE-KMS.

Answer

The VPC security group does not allow outbound HTTPS traffic

Answer

The S3 bucket has default encryption enabled

Answer

The KMS key used for encryption is not shared with Redshift

Question 5

The IAM policy shown in the exhibit is attached to a user. The user tries to upload an object to my-bucket using the AWS CLI without specifying encryption. What will happen?

Accepted Answer

The upload will fail with an access denied error. The IAM policy allows s3:PutObject only if the request includes the encryption header x-amz-server-side-encryption with value AES256. Since the user does not specify any encryption, the condition is not met, and the request is denied with an access denied error. Option A is wrong because the condition is not optional. Option B is wrong because default encryption applies only when the policy does not explicitly require a header; here the policy enforces the header. Option C is wrong because the policy does not require a KMS key; it requires AES256 encryption, which is SSE-S3.

Answer

The upload will succeed because the bucket has default encryption

Answer

The upload will succeed but the object will not be encrypted

Answer

The upload will fail because a KMS key is required

Question 6

A data engineer runs the command shown in the exhibit to check the bucket policy. A user from another AWS account is trying to download an object using HTTP (not HTTPS). What will happen?

Accepted Answer

The download will fail with an access denied error. The bucket policy denies all actions when aws:SecureTransport is false (i.e., HTTP). Therefore, HTTP requests are denied. Option A is wrong because the policy denies HTTP requests. Option C is wrong because the policy does not require encryption at rest. Option D is wrong because the policy explicitly denies HTTP.

Answer

The download will succeed because the principal is not specified

Answer

The download will succeed if the object is encrypted at rest

Answer

The download will succeed because the policy only denies write operations

Question 7

A data engineer receives the error shown in the exhibit when trying to upload a file to my-bucket. The engineer uses the AWS CLI with the following command: aws s3 cp file.txt s3://my-bucket/. What is the most likely cause of the error?

Accepted Answer

The object is not encrypted with SSE-KMS. The error indicates that the upload was denied because the object is not encrypted with SSE-KMS. The bucket policy likely requires SSE-KMS for all PutObject requests, but the AWS CLI command `aws s3 cp file.txt s3://my-bucket/` does not specify the `--sse aws:kms` flag, so the object is uploaded without the required encryption header. This causes the policy condition to evaluate to false, resulting in an access denied error. Option A is wrong because the command does not specify any KMS key; the error is about encryption header, not key validity. Option B is wrong because the error is not related to VPC endpoint policies. Option D is wrong because a default encryption configuration would automatically apply encryption, but the error suggests the upload attempted to skip encryption entirely, which is denied by the explicit policy requirement.

Answer

The KMS key specified in the command is incorrect

Answer

The VPC endpoint policy is blocking the request

Answer

The bucket does not have a default encryption configuration

Question 8

A data engineer needs to ensure that an S3 bucket is encrypted at rest using AWS KMS. The bucket policy must allow only a specific IAM role to access the bucket and enforce encryption in transit. Which combination of bucket policy statements should be used?

Accepted Answer

Use kms:ViaService: s3.*.amazonaws.com and aws:SecureTransport: true. Option A uses the kms:ViaService condition key to restrict the use of the KMS key to requests that come through Amazon S3 (s3.*.amazonaws.com) and the aws:SecureTransport condition to enforce encryption in transit. This ensures that only requests made via S3 and using HTTPS/TLS are allowed to use the key. Option B uses s3:x-amz-server-side-encryption: AES256, which enforces SSE-S3 (AES-256) encryption, not KMS encryption. Option C uses s3:x-amz-server-side-encryption-aws-kms-key-id, which requires a specific KMS key ID, but the aws:SourceIp condition does not enforce encryption in transit. Option D uses kms:EncryptionContext, which can be used to enforce KMS encryption but does not include the aws:SecureTransport condition, so encryption in transit is not enforced.

Answer

Use s3:x-amz-server-side-encryption: AES256 and aws:SecureTransport: true

Answer

Use s3:x-amz-server-side-encryption-aws-kms-key-id and aws:SourceIp

Answer

Use kms:EncryptionContext: service:s3 and aws:SecureTransport: true

Question 9

A company uses AWS Lake Formation to manage permissions on a data lake in S3. A data analyst reports that queries using Amazon Athena return zero rows for a table that the analyst has been granted SELECT permission on. The table is registered in Lake Formation and uses a partition projection. What is the most likely cause?

Accepted Answer

The analyst lacks GetObject and ListBucket permissions on the underlying S3 location. When a table in Lake Formation uses partition projection, Athena bypasses the Glue Data Catalog for partition discovery and directly accesses the S3 location. This requires explicit S3 permissions (GetObject and ListBucket) on the underlying data, which Lake Formation does not automatically grant. The analyst likely can see the table metadata but cannot read the data, resulting in zero rows. Option A is incorrect because the table is registered in Lake Formation (otherwise it wouldn't appear in Athena). Option B is incorrect because DESCRIBE permission is not required for SELECT queries; SELECT alone should suffice. Option D is incorrect because encryption permission issues would cause an error message, not a silent return of zero rows.

Answer

The table is not registered as a resource in Lake Formation

Answer

The analyst does not have DESCRIBE permission on the table

Answer

The table uses server-side encryption with KMS and the analyst lacks kms:Decrypt permission

Question 10

A data engineer needs to audit all AWS KMS key usage in the account. Which AWS service should be used to record KMS API calls?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records API calls for KMS. Option B (AWS Config) is wrong because it records resource changes, not API calls. Option C (Amazon CloudWatch Logs) is wrong because it stores logs but does not record API calls. Option D (Amazon GuardDuty) is wrong because it is for threat detection.

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Answer

Amazon GuardDuty

Question 11

A company wants to enable automatic encryption for all new objects written to an S3 bucket. The bucket has existing objects that are unencrypted. Which solution meets these requirements with the least operational overhead?

Accepted Answer

Enable default encryption on the bucket using SSE-S3. Enabling default encryption on the bucket using SSE-S3 automatically encrypts all new objects written to the bucket, with minimal operational overhead. Option A is incorrect because lifecycle policies do not encrypt objects; they manage transitions and deletions. Option C is redundant since bucket default encryption already denies unencrypted writes via policy, but the policy itself is additional overhead and not automatic. Option D is incorrect because S3 Batch Operations require manual initiation and only encrypt existing objects, not new ones automatically.

Answer

Configure a lifecycle policy to transition objects to a new bucket with encryption

Answer

Use S3 server-side encryption with S3 managed keys (SSE-S3) and apply a bucket policy that denies writes without encryption

Answer

Use S3 Batch Operations to copy existing objects with SSE-S3

Question 12

A data engineer is designing a system to handle sensitive customer data in Amazon RDS for PostgreSQL. The compliance team requires that the data be encrypted at rest and that encryption keys be rotated every 90 days. Which solution meets these requirements?

Accepted Answer

Enable RDS encryption with a customer managed KMS key, enable automatic key rotation, and manually rotate the key every 90 days. Amazon RDS for PostgreSQL encryption at rest uses AWS KMS with customer managed keys. Automatic key rotation in KMS rotates the key annually, but the requirement is every 90 days. Therefore, manual key rotation must be performed every 90 days in addition to enabling automatic key rotation. Option A is incorrect because AWS CloudHSM is not directly integrated with RDS for encryption at rest; RDS encryption uses KMS. Option C is incorrect because Transparent Data Encryption (TDE) is not supported for Amazon RDS PostgreSQL; RDS uses KMS for encryption. Option D is incorrect because KMS automatic key rotation alone rotates keys only once per year, not every 90 days as required.

Answer

Use AWS CloudHSM to store the encryption key and create a custom key rotation Lambda function

Answer

Enable Transparent Data Encryption (TDE) on the RDS instance

Answer

Enable RDS encryption with a customer managed KMS key and enable automatic key rotation

Question 13

A company uses AWS Glue to process data. The security team requires that all data in transit between AWS Glue and Amazon S3 be encrypted using TLS. Which configuration should be used?

Accepted Answer

Enable S3 server-side encryption and use HTTPS endpoints. AWS Glue uses TLS for data in transit by default. Option B is wrong because S3 default encryption is for at-rest. Option C is wrong because VPC endpoints use AWS PrivateLink but don't enforce encryption. Option D is wrong because it's not required for TLS.

Answer

Configure a bucket policy to require aws:SecureTransport

Answer

Enable default encryption on the S3 bucket using SSE-KMS

Answer

Use an S3 VPC endpoint

Question 14

A data engineer is troubleshooting an Amazon Redshift cluster that is not responding to queries. The engineer suspects that the cluster may have been accidentally deleted. Which AWS service should be used to investigate the deletion?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records API calls made to the AWS environment. To investigate if an Amazon Redshift cluster was accidentally deleted, you would use CloudTrail to review the DeleteCluster API call, including who made the call and when. AWS Config tracks resource configuration changes and can show that a cluster was deleted, but it does not directly record API calls; CloudTrail is the primary service for auditing API activity. Amazon CloudWatch Logs stores log data from applications and services, not API calls. AWS Trusted Advisor provides best practice recommendations, not deletion history.

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Answer

AWS Trusted Advisor

Question 15

A data engineer needs to grant an IAM user the ability to view Amazon CloudWatch Logs log groups and stream log events from a specific log group. Which IAM policy action should be used?

Accepted Answer

logs:DescribeLogGroups and logs:GetLogEvents. Logs:DescribeLogGroups and logs:GetLogEvents are the required actions. Option B is wrong because logs:PutLogEvents is for writing. Option C is wrong because logs:CreateLogGroup is for creation. Option D is wrong because logs:DeleteLogGroup is for deletion.

Answer

logs:PutLogEvents

Answer

logs:CreateLogGroup

Answer

logs:DeleteLogGroup