DEA-C01 Data Security and Governance Practice Test 7 — 15 Questions

Question 1

A company uses S3 to store sensitive data. Which TWO S3 features can be used to protect data at rest?

Accepted Answer

Server-Side Encryption with S3 Managed Keys (SSE-S3). Server-Side Encryption with S3 Managed Keys (SSE-S3) and Server-Side Encryption with AWS KMS (SSE-KMS) both encrypt data at rest. Option A (S3 Versioning) protects against accidental deletion or overwrite, not encryption. Option D (S3 Transfer Acceleration) speeds up data transfers, not encryption. Option E (S3 Object Lock) prevents deletion or overwrite for compliance, not encryption.

Answer

S3 Versioning

Answer

S3 Transfer Acceleration

Answer

S3 Object Lock

Question 2

A company needs to implement a data encryption strategy for data in transit between an Amazon EC2 instance and an Amazon RDS for MySQL database. Which THREE actions should be taken?

Accepted Answer

Configure the RDS instance to require SSL connections. Options A, D, and E are correct. To encrypt data in transit between EC2 and RDS MySQL, you need to enforce SSL/TLS connections. Option A configures the RDS instance to require SSL connections. Option D uses a JDBC driver with useSSL=true to enforce SSL from the client side. Option E enables the rds.force_ssl parameter in the RDS parameter group to force SSL connections at the database level. Option B is incorrect because VPC peering establishes network connectivity but does not encrypt data. Option C is incorrect because encryption at rest secures stored data, not data in transit.

Answer

Set up VPC peering between the EC2 and RDS subnets

Answer

Enable encryption at rest using KMS on the RDS instance

Question 3

A data engineer is designing a data lake on S3 with fine-grained access control using AWS Lake Formation. Which FOUR permissions can be managed by Lake Formation?

Accepted Answer

SELECT on a table. AWS Lake Formation supports fine-grained permissions including SELECT, INSERT, DESCRIBE, and DELETE on tables. ALTER TABLE is not a Lake Formation permission; it is managed by other services like IAM. Therefore, the correct answers are A, B, C, and E.

Answer

ALTER TABLE on a table

Question 4

Refer to the exhibit. The S3 bucket policy above is applied to the bucket "example-bucket". An IAM user attempts to upload an object to the bucket without specifying any encryption header. What is the outcome?

Accepted Answer

The upload fails with an Access Denied error. The Deny statement in the bucket policy denies PutObject if the encryption header is not AES256. Since the user did not specify any encryption header, the condition StringNotEquals 'AES256' evaluates to true, causing the request to be denied with an Access Denied error. Option A is wrong because the Deny overrides the Allow. Option B is wrong because the Deny applies to PutObject, not GetObject. Option C is wrong because the Deny is conditional on encryption header, not default encryption.

Answer

The upload succeeds but the object is not encrypted

Answer

The upload fails because GetObject requires encryption

Answer

The object is uploaded successfully with SSE-S3 encryption by default

Question 5

Refer to the exhibit. A data engineer runs the command above. The DataAdminRole is used by an application to decrypt data. The security team wants to ensure that a SecurityAdminRole can revoke the grant. What must be done to allow the SecurityAdminRole to retire the grant?

Accepted Answer

No action needed; the SecurityAdminRole can retire the grant. The grant's RetiringPrincipal field is already set to SecurityAdminRole, so no additional action is needed. Option A is incorrect because setting the RetiringPrincipal to the root user would not grant SecurityAdminRole the ability to retire. Option B is incorrect because a Revoke grant is not required; retire is handled by the RetiringPrincipal. Option D is incorrect because creating a new grant is unnecessary when the existing grant already has the correct RetiringPrincipal.

Answer

Set the RetiringPrincipal to the root user

Answer

Add a grant with Revoke operation for the SecurityAdminRole

Answer

Create a new grant with SecurityAdminRole as GranteePrincipal

Question 6

Refer to the exhibit. An IAM policy includes the above statement to allow decryption of a KMS key under specific conditions. What does this policy allow?

Accepted Answer

Decrypt data that was encrypted with the encryption context {"aws:pi":"db-123"}. The policy allows the Decrypt action on the KMS key only when the encryption context condition is met, specifically the key 'aws:pi' with value 'db-123'. This means only data encrypted with that encryption context can be decrypted. Option A is incorrect because the condition restricts to a specific encryption context, not any KMS key. Option C is incorrect because the action is Decrypt, not Encrypt. Option D is incorrect because decryption without the required encryption context would not satisfy the condition.

Answer

Decrypt any data encrypted with any KMS key

Answer

Encrypt data with the KMS key using the specified encryption context

Answer

Decrypt data encrypted with the KMS key without any encryption context

Question 7

A company uses S3 to store sensitive customer data. To prevent accidental public access, a data engineer needs to ensure that all S3 buckets block public access at the account level. Which AWS service should be used to enforce this policy?

Accepted Answer

Use an SCP in AWS Organizations to deny s3:PutBucketPublicAccessBlock. AWS Organizations with SCPs can centrally control permissions across all accounts, including blocking public access to S3 buckets. Option A is wrong because IAM policies are per-identity and not account-wide. Option B is wrong because S3 Block Public Access settings exist per bucket or account, but to enforce across all accounts, Organizations is needed. Option D is wrong because AWS Config can detect non-compliance but not enforce. Option C is correct.

Answer

Enable S3 Block Public Access at the account level in the management account

Answer

Create an IAM policy that denies s3:PutBucketPolicy

Answer

Set up AWS Config rules to automatically remediate public buckets

Question 8

A data engineer is designing a data lake on S3 and needs to ensure that data is encrypted at rest using customer-managed KMS keys. The engineer also needs to audit all access to the KMS keys. Which combination of services should be used?

Accepted Answer

SSE-KMS with AWS CloudTrail. SSE-KMS allows customer-managed KMS keys, and AWS CloudTrail logs all KMS API calls (e.g., Decrypt, GenerateDataKey), enabling auditing. Option B is incorrect because SSE-C uses customer-provided encryption keys, not KMS, and CloudWatch Logs is for application logs, not KMS access. Option C is incorrect because S3 Inventory provides object metadata but does not audit KMS access. Option D is incorrect because SSE-S3 uses AWS-managed keys, not customer-managed, and S3 server access logs do not capture KMS API calls.

Answer

SSE-C with CloudWatch Logs

Answer

SSE-KMS with S3 Inventory

Answer

SSE-S3 with S3 server access logs

Question 9

A company uses AWS Glue to process sensitive data. The security team requires that all data in transit between Glue and Amazon S3 be encrypted using TLS 1.2 or higher. Which configuration ensures this requirement is met?

Accepted Answer

Add a bucket policy that denies access unless aws:SecureTransport is true. S3 bucket policies can enforce aws:SecureTransport to require HTTPS. Glue by default uses HTTPS when accessing S3, but to enforce it, the bucket policy must deny requests without SecureTransport. Option A is wrong because VPC endpoints enforce private connectivity but not necessarily TLS version. Option B is wrong because S3 Block Public Access does not affect encryption in transit. Option D is wrong because KMS is for at-rest encryption. Option C is correct.

Answer

Configure a VPC endpoint for S3 and enable private DNS

Answer

Enable S3 Block Public Access at the bucket level

Answer

Use SSE-KMS encryption on the S3 bucket

Question 10

A company uses AWS Lake Formation to manage permissions on a data lake stored in S3. A data engineer notices that a new IAM user can query data via Athena but cannot see the tables in the Lake Formation console. What is the most likely cause?

Accepted Answer

The user has not been granted DESCRIBE or SELECT permissions on the tables in Lake Formation. Lake Formation permissions are separate from IAM permissions. Even if the IAM user has Athena access, Lake Formation must grant the user DESCRIBE and SELECT permissions on the tables to see them in the console and query them. Option B is incorrect because encryption settings do not affect table visibility. Option C is incorrect because the Glue Data Catalog is enabled (since the user can query data). Option D is incorrect because the user can query data, so they have s3:GetObject permissions implicitly.

Answer

The Athena workgroup is not encrypted

Answer

The Glue Data Catalog is not enabled for the account

Answer

The IAM user lacks s3:GetObject permissions

Question 11

A data engineer needs to grant an IAM user read-only access to a specific KMS key for decrypting S3 objects. Which policy element should be used?

Accepted Answer

Add a statement to the KMS key policy allowing the IAM user to call kms:Decrypt. KMS key policies are resource-based policies that directly grant permissions to IAM users or roles to perform actions on the key. To grant an IAM user read-only access (kms:Decrypt) to a specific KMS key, the recommended approach is to add a statement in the key policy that allows that user to call kms:Decrypt. Option A is incorrect because an IAM policy alone cannot grant KMS permissions unless the key policy explicitly allows it (by default, key policies must allow IAM policies). Option C is incorrect because bucket policies cannot grant kms:Decrypt permissions; they can only specify conditions for using KMS keys. Option D is incorrect because SCPs are used in AWS Organizations to set permission boundaries, not to grant permissions.

Answer

Attach an IAM policy to the user allowing kms:Decrypt

Answer

Add a bucket policy that grants kms:Decrypt

Answer

Use an SCP in AWS Organizations to allow kms:Decrypt

Question 12

A company uses Amazon Redshift for data warehousing. The security team requires that all data stored in Redshift be encrypted at rest using a customer-managed KMS key. How should the data engineer configure this?

Accepted Answer

Enable encryption using a KMS key when creating the Redshift cluster. Redshift supports encryption at rest using KMS. You enable encryption when launching the cluster by choosing a KMS key. Option B is wrong because Redshift doesn't use S3 SSE-KMS for its own storage. Option C is wrong because you cannot encrypt an existing cluster without restoring from snapshot. Option D is wrong because cluster parameter groups do not control encryption. Option A is correct.

Answer

Configure S3 SSE-KMS on the underlying S3 storage

Answer

Use the AWS KMS console to encrypt the Redshift cluster after creation

Answer

Set a cluster parameter group with encryption enabled

Question 13

A data engineer is troubleshooting an issue where an IAM role used by AWS Glue cannot read data from an S3 bucket encrypted with SSE-KMS. The bucket policy allows the role to perform s3:GetObject. What additional permission is needed?

Accepted Answer

kms:Decrypt on the KMS key. For SSE-KMS, the IAM role needs kms:Decrypt permission on the KMS key to read encrypted objects. Option A (s3:GetObjectVersion) is not required because the bucket policy already allows s3:GetObject; versioning is not relevant here. Option C (s3:GetObjectAcl) is for access control lists, not encryption. Option D (kms:GenerateDataKey) is used for encrypting new objects, not reading existing ones. Therefore, the correct answer is B.

Answer

s3:GetObjectVersion

Answer

s3:GetObjectAcl

Answer

kms:GenerateDataKey on the KMS key

Question 14

A company uses AWS CloudTrail to log all API calls. The security team wants to ensure that log files are tamper-proof and cannot be deleted. Which TWO actions should the data engineer take? (Choose TWO.)

Accepted Answer

Enable CloudTrail log file validation. To ensure CloudTrail log files are tamper-proof and cannot be deleted, enable CloudTrail log file validation (option A) to verify integrity and detect tampering, and enable S3 Object Lock on the S3 bucket (option B) to prevent deletion or overwrites. Option C (MFA Delete) requires additional setup and is not automatically enforced by CloudTrail; it is not the primary mechanism for preventing deletion. Option D (S3 Versioning) alone does not prevent deletion; it preserves older versions but allows deletion of current versions. Option E (SSE-KMS) encrypts data but does not prevent deletion.

Answer

Enable MFA Delete on the S3 bucket

Answer

Enable S3 Versioning on the S3 bucket

Answer

Enable SSE-KMS encryption on the S3 bucket

Question 15

A company uses Amazon EMR to process sensitive data. The data engineer needs to ensure that data in transit between EMR and S3 is encrypted. Which THREE configurations achieve this? (Choose THREE.)

Accepted Answer

Configure EMRFS to use server-side encryption with S3 (SSE-S3) and require HTTPS. To ensure encryption in transit between Amazon EMR and S3, you can use server-side encryption with customer-provided keys (SSE-C) with HTTPS (Option D), configure EMRFS to use server-side encryption with S3 (SSE-S3) and require HTTPS (Option B), or use VPC endpoints for S3 with a policy that enforces HTTPS (Option E). Option A (S3 Block Public Access) controls public access, not transit encryption. Option C (SSE-KMS) encrypts data at rest, not in transit. Thus, correct answers are B, D, E.

Answer

Enable S3 Block Public Access on the bucket

Answer

Enable SSE-KMS on the S3 bucket