DEA-C01 Data Security and Governance Practice Test 7 — 15 Questions

Question 1

A company uses Amazon EMR to process large datasets stored in Amazon S3. The data is encrypted at rest using SSE-S3. The security team now requires that all data at rest be encrypted with customer-managed KMS keys (SSE-KMS). The data engineer needs to migrate existing data to use SSE-KMS without downtime. The engineer plans to use S3 Batch Operations to copy objects in place. However, the Batch Operations job fails with a KMS access denied error. The engineer has confirmed that the Batch Operations service role has the necessary KMS permissions. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The Batch Operations service role is missing the kms:GenerateDataKey permission for the destination KMS key.. The most likely cause is that the Batch Operations service role lacks the kms:GenerateDataKey permission on the destination KMS key. When S3 Batch Operations copies objects and applies SSE-KMS encryption, it must call KMS GenerateDataKey to create a new data key for encrypting the destination object. Even if the role has other KMS permissions like kms:Decrypt for the source, without kms:GenerateDataKey on the destination key, the operation fails with an access denied error. The question states the role has 'necessary KMS permissions' but that likely refers to source decryption, not destination encryption.

Answer

The KMS key policy does not allow the S3 service to use the key.

Answer

The Batch Operations job is using the wrong IAM role.

Answer

The source objects are encrypted with SSE-S3, which cannot be copied to SSE-KMS.

Question 2

A company uses Amazon DynamoDB to store session data. The security team requires that all data be encrypted at rest using a customer-managed KMS key. The data engineer has enabled DynamoDB encryption with a customer-managed key. However, the security team notices that the key is not being used for all tables; some tables still use the default AWS-managed key. The engineer needs to ensure that all new tables are automatically encrypted with the customer-managed key. The company has hundreds of developers who create tables using various methods (console, CLI, SDK, CloudFormation). What is the most efficient way to enforce this policy?

Accepted Answer

Use an AWS Config rule to check for tables not using the customer-managed key and trigger auto-remediation.. AWS Config rules can evaluate whether DynamoDB tables use customer-managed KMS keys and take remediation actions. Option A is wrong because it requires updating all existing code. Option B is wrong because CloudFormation templates can be bypassed. Option D is wrong because SCPs cannot enforce encryption configuration for DynamoDB.

Answer

Create a CloudFormation template that all developers must use to create tables.

Answer

Attach an SCP to deny creating DynamoDB tables without the customer-managed key.

Answer

Update the company's internal documentation and require all developers to specify the KMS key in their code.

Question 3

A healthcare organization uses AWS Lake Formation to manage a data lake in Amazon S3. The data lake contains sensitive patient information that must be encrypted at rest. The organization uses AWS KMS with a customer-managed key (CMK) for encryption. Recently, the security team noticed that a new IAM user was able to query the data lake using Amazon Athena without explicit permissions in Lake Formation. The data lake administrator suspects that the IAM user might have been granted access through an IAM policy that allows 'lakeformation:GetDataAccess' without proper resource restrictions. The organization wants to enforce that only Lake Formation permissions control access to the data lake, and IAM policies should not grant access directly. What should they do?

Accepted Answer

Revoke the 'lakeformation:GetDataAccess' permission from all IAM users and groups, and require that access be granted only through Lake Formation permissions.. To ensure only Lake Formation permissions control access, the organization must revoke the 'lakeformation:GetDataAccess' permission from all IAM users and groups. This permission is what allows IAM principals to bypass Lake Formation and access data directly via services like Athena. Once revoked, access must be granted through Lake Formation grants (database/table/column-level), which enforce the intended permission model.

Answer

Change the KMS key policy to require that any request to decrypt data must come from the Lake Formation service role.

Answer

Remove the IAM policy that grants 'lakeformation:GetDataAccess' from the specific user and ensure Lake Formation permissions are correctly set.

Answer

Add an S3 bucket policy that denies all principals except the Lake Formation service role.

Question 4

A gaming company uses Amazon Redshift for analytics. The Redshift cluster stores user data that must be encrypted at rest using a customer-managed KMS key. The company has enabled audit logging using AWS CloudTrail. The security team wants to ensure that any attempt to disable or delete the KMS key is immediately detected and triggers an automated response. They have set up a CloudWatch Events rule that triggers an SNS notification when the KMS key is scheduled for deletion. However, they also want to prevent the key from being deleted accidentally. What should they do?

Accepted Answer

Add a statement to the KMS key policy that denies 'kms:ScheduleKeyDeletion' for all principals except the root user.. Adding a statement to the KMS key policy that denies 'kms:ScheduleKeyDeletion' for all principals except the root user explicitly prevents any user (including IAM users with full admin permissions) from scheduling deletion of the key. This is the most direct and authoritative control to prevent accidental deletion. Option A is incorrect because automatic key rotation does not prevent the key from being deleted; it only changes the backing key material. Option C is incorrect because an IAM policy attached to the Redshift cluster role does not affect permissions on the KMS key; the key policy is the authoritative control for actions on a customer-managed key. Option D is incorrect because CloudTrail monitoring only detects deletion events but does not prevent the deletion itself.

Answer

Enable automatic key rotation for the KMS key to ensure that even if the key is deleted, the data remains encrypted.

Answer

Attach an IAM policy to the Redshift cluster role that denies 'kms:ScheduleKeyDeletion'.

Answer

Set up a CloudTrail trail to monitor for 'ScheduleKeyDeletion' events and send an alert to the security team.

Question 5

A data engineering team uses AWS Glue Data Catalog to manage metadata for datasets in Amazon S3. The datasets contain personally identifiable information (PII). The team needs to implement column-level security so that only authorized users can access columns with PII. They use Amazon Athena for querying. The team has enabled AWS Lake Formation and defined data lake locations. They have created a Lake Formation tag called 'PII' and assigned it to the columns containing PII. They have also granted 'SELECT' permission on those columns to a specific IAM role. However, when a user assumes that role and queries the table using Athena, they can still see all columns, including the PII columns. What is the most likely cause?

Accepted Answer

The IAM role does not have the necessary Lake Formation permissions; it only has IAM permissions to the S3 data.. Even with Lake Formation tags and column-level grants configured, the IAM role must also be granted Lake Formation permissions (via Lake Formation GrantPermissions or an LF-Tag policy) on the tagged columns. If the role only has IAM permissions to S3 and no corresponding Lake Formation grants, Lake Formation does not enforce the column filter and the user sees all columns. The fix is to grant the role SELECT on the PII-tagged columns through Lake Formation, not just IAM.

Answer

The data in S3 is not encrypted, so Lake Formation cannot enforce column-level security.

Answer

The S3 bucket policy grants direct access to the IAM role, bypassing Lake Formation.

Answer

The Lake Formation tag 'PII' is not properly associated with the columns.

Question 6

A data engineer needs to audit all access to an S3 bucket containing sensitive customer data. The engineer must record the requester, timestamp, action, and whether the access was denied. Which AWS solution meets these requirements?

Accepted Answer

Enable S3 server access logs for the bucket, storing them in a different bucket.. S3 server access logs record detailed information about every request made to a bucket, including the requester, timestamp, action, response status (including denials), and object key. Storing them in a separate bucket is a best practice to avoid recursive logging and to preserve audit integrity. This directly meets the requirement to audit all access with requester, timestamp, action, and denial status.

Answer

Use AWS Config to record S3 bucket-level configuration changes.

Answer

Enable VPC Flow Logs for the VPC where the bucket resides.

Answer

Enable AWS CloudTrail Data Events for the S3 bucket.

Question 7

A company has an S3 bucket policy that allows access to a specific IAM role. However, an administrator notices that requests from that role are being denied. The bucket is encrypted with AES-256. What is the MOST likely reason for the denial?

Accepted Answer

The bucket policy allows access, but the VPC endpoint policy denies the action.. When an S3 bucket is accessed through a VPC endpoint, both the bucket policy and the VPC endpoint policy must allow the action. An explicit deny in the VPC endpoint policy overrides the bucket policy allow, causing the Access Denied even though the bucket policy grants access. This is the most likely cause given the scenario.

Answer

The IAM role does not have s3:Decrypt permission on the bucket.

Answer

The bucket policy has an explicit deny statement that overrides the allow.

Answer

The S3 Block Public Access settings are blocking the request.

Question 8

A data engineer is designing a data pipeline that processes sensitive financial data. The data must be encrypted at rest and in transit. The pipeline uses Amazon Kinesis Data Streams to ingest data and AWS Lambda to process it. Which combination of actions ensures the data is encrypted in transit? (Select TWO.)

Accepted Answer

Enable TLS for Kinesis Data Streams.. Options A and B are correct because they directly address encryption in transit for the two pipeline components: enabling TLS for Kinesis Data Streams secures data sent to and from the stream over HTTPS, and enabling Encryption in Transit for the Lambda function's VPC configuration secures network traffic between the Lambda function and other resources in the VPC. Option C is incorrect because SSE-S3 provides encryption at rest for S3 objects, not in transit. Option D is incorrect because AWS KMS encryption for Kinesis Data Streams protects data at rest, not in transit. Option E is incorrect because encrypting CloudWatch Logs with KMS protects log data at rest, not data moving through the pipeline.

Answer

Enable Server-Side Encryption (SSE-S3) on the S3 bucket used for data storage.

Answer

Use AWS KMS to encrypt data at rest in Kinesis Data Streams.

Answer

Encrypt the Lambda function's CloudWatch Logs using KMS.

Question 9

A company needs to enforce that all objects uploaded to an S3 bucket are encrypted at rest. Which bucket setting should be used?

Accepted Answer

Default encryption. Default encryption on an S3 bucket automatically encrypts all objects at rest using server-side encryption (SSE-S3, SSE-KMS, or DSSE-KMS) without requiring the uploader to specify encryption headers. Enabling default encryption ensures that every object is encrypted at rest by default, satisfying the requirement to enforce encryption for all uploaded objects.

Answer

S3 Object Lock

Answer

Bucket policy requiring s3:x-amz-server-side-encryption header

Answer

S3 Block Public Access

Question 10

Refer to the exhibit. An S3 bucket policy allows the DataEngineerRole to get objects only if the request uses HTTPS. However, requests from this role are being denied even when using HTTPS. What is the MOST likely reason?

Accepted Answer

The IAM role's attached policy does not allow s3:GetObject on the bucket.. The bucket policy grants s3:GetObject only when aws:SecureTransport is true, but IAM policies and bucket policies are evaluated together — both must allow the action. If the role's attached identity-based policy lacks s3:GetObject permission on the bucket, the request is denied regardless of HTTPS. This is the classic 'explicit allow in one policy, no allow in the other' scenario.

Answer

The IAM role does not have permission to use SSE-S3.

Answer

The condition key aws:SecureTransport is misspelled.

Answer

The bucket policy does not include a Deny statement for HTTP requests.

Question 11

Refer to the exhibit. A data engineer runs the AWS CLI command to look up GetObject events. The output shows an event from the DataEngineer role. However, the engineer suspects that some GetObject requests are not being logged. What is the MOST likely reason?

Accepted Answer

The CloudTrail trail is not configured to log data events.. CloudTrail logs management events by default, but S3 object-level operations like GetObject are data events, which are NOT logged unless explicitly enabled on the trail. The exhibit shows a GetObject event from the DataEngineer role, but if the trail isn't configured for data events, many GetObject requests will silently go unlogged. This is the most likely reason some requests are missing from the logs.

Answer

The IAM role does not have permission to read the CloudTrail logs.

Answer

The trail is not enabled in the us-east-1 region.

Answer

The S3 bucket is in a different region than the CloudTrail trail.

Question 12

Refer to the exhibit. An IAM policy allows kms:Decrypt and kms:GenerateDataKey on a specific KMS key. A data engineer is unable to upload an object to an S3 bucket that uses SSE-KMS with that key. What is the MOST likely missing permission?

Accepted Answer

s3:PutObject permission on the bucket.. The user is unable to upload an object to an S3 bucket that uses SSE-KMS. The IAM policy currently allows kms:Decrypt and kms:GenerateDataKey on the KMS key. However, to upload an object to an S3 bucket, the user also needs the s3:PutObject permission on the bucket. Therefore, the missing permission is s3:PutObject. Option A is incorrect because kms:Decrypt is already allowed. Option C is incorrect because kms:Encrypt is not required; GenerateDataKey is sufficient. Option D is incorrect because kms:CreateGrant is not required for uploading.

Answer

kms:Decrypt permission on the key.

Answer

kms:Encrypt permission on the key.

Answer

kms:CreateGrant permission on the key.

Question 13

A company uses Amazon Redshift for data warehousing. The security team requires that all data stored in Redshift be encrypted at rest. The current cluster is unencrypted. Which approach should the data engineer take to meet this requirement with minimal downtime?

Accepted Answer

Take a snapshot of the existing cluster and restore it to a new encrypted cluster.. Redshift allows restoring a snapshot to a new encrypted cluster. The engineer can take a snapshot of the existing cluster, restore it to a new cluster with encryption enabled, and then redirect traffic to the new cluster. Option A is wrong because encryption cannot be enabled on an existing cluster. Option B is wrong because COPY command does not encrypt the cluster. Option C is wrong because unloading and reloading data would cause significant downtime.

Answer

Modify the cluster to enable encryption.

Answer

Unload data to S3 and reload into a new encrypted cluster.

Answer

Use the COPY command to load data into a new encrypted table.

Question 14

A data engineer needs to ensure that all data stored in an S3 bucket is encrypted at rest. Which S3 bucket policy condition key should be used to enforce encryption using AWS KMS?

Accepted Answer

s3:x-amz-server-side-encryption-aws-kms-key-id. To enforce encryption using AWS KMS, the bucket policy must check for the specific KMS key ID in the request header. The condition key s3:x-amz-server-side-encryption-aws-kms-key-id ensures that the PutObject request includes the correct KMS key ID, thereby enforcing encryption with that key. This is more specific than just checking for server-side encryption.

Answer

s3:x-amz-server-side-encryption

Answer

kms:EncryptionContext

Answer

s3:x-amz-acl

Question 15

A company uses AWS Lake Formation to manage data lake permissions. A data analyst is unable to query a table in the data lake using Amazon Athena. The table is registered in Lake Formation, and the analyst has SELECT permission granted via Lake Formation. What is the most likely reason for the failure?

Accepted Answer

The IAM role used by Athena does not have necessary Lake Formation permissions. Lake Formation permissions are enforced in addition to IAM permissions, not instead of them. Even if the analyst has SELECT granted via Lake Formation, the IAM role that Athena assumes must also have the corresponding Lake Formation permissions (or be listed as a principal in the Lake Formation grant) for the query to succeed. The most common cause of 'Lake Formation permission granted but Athena fails' is that the IAM role used by Athena was not included as a principal in the Lake Formation grant.

Answer

Athena is configured to use encryption in transit

Answer

The S3 bucket policy does not grant access to the analyst's IAM role

Answer

The table is not registered in the AWS Glue Data Catalog