DEA-C01 Data Security and Governance Practice Test 6 — 15 Questions

Question 1

A company needs to share a dataset stored in an S3 bucket with a partner account. The dataset contains sensitive information, so the company wants to ensure that the partner account can only access the data using a specific VPC endpoint in the partner's account. Which S3 bucket policy condition key should be used?

Accepted Answer

aws:SourceVpce. Option C is correct because aws:SourceVpce restricts access to a specific VPC endpoint. Option A is wrong because aws:SourceIp is for IP addresses. Option B is wrong because aws:SourceArn is for resource ARNs. Option D is wrong because aws:SourceVpc is for VPC, not endpoint.

Answer

aws:SourceVpc

Answer

aws:SourceArn

Answer

aws:SourceIp

Question 2

A data engineer needs to grant an IAM user the ability to view Amazon CloudWatch Logs log groups and stream log events from a specific log group. Which IAM policy action should be used?

Accepted Answer

logs:DescribeLogGroups and logs:GetLogEvents. Option A is correct because logs:DescribeLogGroups and logs:GetLogEvents are the required actions. Option B is wrong because logs:PutLogEvents is for writing. Option C is wrong because logs:CreateLogGroup is for creation. Option D is wrong because logs:DeleteLogGroup is for deletion.

Answer

logs:PutLogEvents

Answer

logs:CreateLogGroup

Answer

logs:DeleteLogGroup

Question 3

A company uses S3 to store sensitive data. Which TWO S3 features can be used to protect data at rest?

Accepted Answer

Server-Side Encryption with S3 Managed Keys (SSE-S3). Options A and D are correct. SSE-S3 and SSE-KMS both encrypt data at rest. Option B is wrong because S3 Transfer Acceleration accelerates transfers, not encryption. Option C is wrong because S3 Versioning protects against deletion, not encryption. Option E is wrong because S3 Object Lock prevents deletion/overwrite, not encryption.

Answer

S3 Versioning

Answer

S3 Transfer Acceleration

Answer

S3 Object Lock

Question 4

A company needs to implement a data encryption strategy for data in transit between an Amazon EC2 instance and an Amazon RDS for MySQL database. Which THREE actions should be taken?

Accepted Answer

Configure the RDS instance to require SSL connections. Options A, B, and D are correct. Enforcing SSL/TLS, enabling SSL parameter, and using a JDBC driver with SSL property ensure encryption in transit. Option C is wrong because encryption at rest is separate. Option E is wrong because VPC peering doesn't encrypt data.

Answer

Set up VPC peering between the EC2 and RDS subnets

Answer

Enable encryption at rest using KMS on the RDS instance

Question 5

A data engineer is designing a data lake on S3 with fine-grained access control using AWS Lake Formation. Which THREE permissions can be managed by Lake Formation?

Accepted Answer

SELECT on a table. Options A, B, and D are correct. Lake Formation manages SELECT, INSERT, and DESCRIBE permissions. Option C is wrong because DELETE is not supported for S3 data lakes? Actually Lake Formation supports DELETE on tables? For data lakes, DELETE is not typically managed. Option E is wrong because ALTER TABLE is not managed by Lake Formation.

Answer

ALTER TABLE on a table

Answer

DELETE on a table

Question 6

Refer to the exhibit. The S3 bucket policy above is applied to the bucket "example-bucket". An IAM user attempts to upload an object to the bucket without specifying any encryption header. What is the outcome?

Accepted Answer

The upload fails with an Access Denied error. Option B is correct because the Deny statement denies PutObject if the encryption header is not AES256. Since the user did not specify encryption, the condition StringNotEquals evaluates to true, and the request is denied. Option A is wrong because the Deny overrides the Allow. Option C is wrong because the Deny is specific. Option D is wrong because the bucket policy does not require encryption for GetObject.

Answer

The upload succeeds but the object is not encrypted

Answer

The upload fails because GetObject requires encryption

Answer

The object is uploaded successfully with SSE-S3 encryption by default

Question 7

Refer to the exhibit. A data engineer runs the command above. The DataAdminRole is used by an application to decrypt data. The security team wants to ensure that a SecurityAdminRole can revoke the grant. What must be done to allow the SecurityAdminRole to retire the grant?

Accepted Answer

No action needed; the SecurityAdminRole can retire the grant. Option A is correct because the RetiringPrincipal field specifies which principal can retire the grant. It is already set to SecurityAdminRole. Option B is wrong because revoke is different from retire. Option C is wrong because the grant already exists. Option D is wrong because the retiring principal is already set.

Answer

Set the RetiringPrincipal to the root user

Answer

Add a grant with Revoke operation for the SecurityAdminRole

Answer

Create a new grant with SecurityAdminRole as GranteePrincipal

Question 8

Refer to the exhibit. An IAM policy includes the above statement to allow decryption of a KMS key under specific conditions. What does this policy allow?

Accepted Answer

Decrypt data that was encrypted with the encryption context {"aws:pi":"db-123"}. Option A is correct because the policy allows decryption only when the encryption context contains the key "aws:pi" with value "db-123". Option B is wrong because the condition requires a specific value. Option C is wrong because the action is Decrypt, not Encrypt. Option D is wrong because the resource is "*", not a specific key.

Answer

Decrypt any data encrypted with any KMS key

Answer

Encrypt data with the KMS key using the specified encryption context

Answer

Decrypt data encrypted with the KMS key without any encryption context

Question 9

A company uses S3 to store sensitive customer data. To prevent accidental public access, a data engineer needs to ensure that all S3 buckets block public access at the account level. Which AWS service should be used to enforce this policy?

Accepted Answer

Use an SCP in AWS Organizations to deny s3:PutBucketPublicAccessBlock. AWS Organizations with SCPs can centrally control permissions across all accounts, including blocking public access to S3 buckets. Option A is wrong because IAM policies are per-identity and not account-wide. Option B is wrong because S3 Block Public Access settings exist per bucket or account, but to enforce across all accounts, Organizations is needed. Option D is wrong because AWS Config can detect non-compliance but not enforce. Option C is correct.

Answer

Enable S3 Block Public Access at the account level in the management account

Answer

Create an IAM policy that denies s3:PutBucketPolicy

Answer

Set up AWS Config rules to automatically remediate public buckets

Question 10

A data engineer is designing a data lake on S3 and needs to ensure that data is encrypted at rest using customer-managed KMS keys. The engineer also needs to audit all access to the KMS keys. Which combination of services should be used?

Accepted Answer

SSE-KMS with AWS CloudTrail. S3 server-side encryption with KMS (SSE-KMS) uses customer-managed KMS keys. CloudTrail logs all KMS API calls, including Decrypt and GenerateDataKey. Option A is wrong because SSE-S3 uses AWS-managed keys, not customer-managed. Option B is wrong because S3 Inventory does not audit KMS access. Option D is wrong because S3 access logs do not capture KMS operations. Option C is correct.

Answer

SSE-C with CloudWatch Logs

Answer

SSE-KMS with S3 Inventory

Answer

SSE-S3 with S3 server access logs

Question 11

A company uses AWS Glue to process sensitive data. The security team requires that all data in transit between Glue and Amazon S3 be encrypted using TLS 1.2 or higher. Which configuration ensures this requirement is met?

Accepted Answer

Add a bucket policy that denies access unless aws:SecureTransport is true. S3 bucket policies can enforce aws:SecureTransport to require HTTPS. Glue by default uses HTTPS when accessing S3, but to enforce it, the bucket policy must deny requests without SecureTransport. Option A is wrong because VPC endpoints enforce private connectivity but not necessarily TLS version. Option B is wrong because S3 Block Public Access does not affect encryption in transit. Option D is wrong because KMS is for at-rest encryption. Option C is correct.

Answer

Configure a VPC endpoint for S3 and enable private DNS

Answer

Enable S3 Block Public Access at the bucket level

Answer

Use SSE-KMS encryption on the S3 bucket

Question 12

A data engineer needs to share a dataset from an S3 bucket in Account A with another AWS account (Account B). The data must remain encrypted at rest with KMS. Which steps are required?

Accepted Answer

Update the S3 bucket policy and the KMS key policy to allow Account B. To share S3 objects encrypted with a KMS key, you must grant the consuming account access to both the S3 bucket and the KMS key. Option A is wrong because a bucket policy alone does not grant KMS permissions. Option B is wrong because the KMS key policy must explicitly allow Account B. Option C is correct as it includes both. Option D is wrong because cross-account roles are not necessary if bucket policy and key policy are used.

Answer

Update the KMS key policy to allow Account B's root user

Answer

Create an IAM role in Account A and grant cross-account access

Answer

Update the S3 bucket policy to allow Account B's root user

Question 13

A company uses AWS Lake Formation to manage permissions on a data lake stored in S3. A data engineer notices that a new IAM user can query data via Athena but cannot see the tables in the Lake Formation console. What is the most likely cause?

Accepted Answer

The user has not been granted DESCRIBE or SELECT permissions on the tables in Lake Formation. Lake Formation permissions are separate from IAM permissions. Even if IAM allows Athena, Lake Formation must grant the user permissions on the tables. Option A is wrong because IAM policies are not sufficient for Lake Formation. Option B is irrelevant. Option D is wrong because the Glue Data Catalog may be accessible but Lake Formation can restrict visibility. Option C is correct.

Answer

The Athena workgroup is not encrypted

Answer

The Glue Data Catalog is not enabled for the account

Answer

The IAM user lacks s3:GetObject permissions

Question 14

A company has a requirement to store audit logs for 7 years for compliance. The logs are stored in S3 and must be immutable. Which S3 feature should be used?

Accepted Answer

Enable S3 Object Lock in compliance mode. S3 Object Lock prevents objects from being deleted or overwritten for a specified retention period. Option A is wrong because versioning does not prevent deletion. Option B is wrong because MFA Delete adds an extra step but can be bypassed by root. Option C is wrong because bucket policies do not enforce immutability. Option D is correct.

Answer

Use a bucket policy that denies s3:DeleteObject

Answer

Enable MFA Delete on the bucket

Answer

Enable S3 Versioning and set a lifecycle policy

Question 15

A data engineer needs to grant an IAM user read-only access to a specific KMS key for decrypting S3 objects. Which policy element should be used?

Accepted Answer

Add a statement to the KMS key policy allowing the IAM user to call kms:Decrypt. A KMS key policy can grant IAM users permissions directly. Option B is wrong because IAM policies can also grant KMS permissions, but the key policy must allow the IAM policy. Option C is wrong because SCPs are for Organizations. Option D is wrong because bucket policies do not grant KMS permissions. Option A is correct, though both A and B are possible; typically key policy is used for cross-account or specific grants.

Answer

Attach an IAM policy to the user allowing kms:Decrypt

Answer

Add a bucket policy that grants kms:Decrypt

Answer

Use an SCP in AWS Organizations to allow kms:Decrypt