DEA-C01 Data Security and Governance Practice Test 7 — 15 Questions

Question 1

A company uses Amazon Redshift for data warehousing. The security team requires that all data stored in Redshift be encrypted at rest using a customer-managed KMS key. How should the data engineer configure this?

Accepted Answer

Enable encryption using a KMS key when creating the Redshift cluster. Redshift supports encryption at rest using KMS. You enable encryption when launching the cluster by choosing a KMS key. Option B is wrong because Redshift doesn't use S3 SSE-KMS for its own storage. Option C is wrong because you cannot encrypt an existing cluster without restoring from snapshot. Option D is wrong because cluster parameter groups do not control encryption. Option A is correct.

Answer

Configure S3 SSE-KMS on the underlying S3 storage

Answer

Use the AWS KMS console to encrypt the Redshift cluster after creation

Answer

Set a cluster parameter group with encryption enabled

Question 2

A data engineer is troubleshooting an issue where an IAM role used by AWS Glue cannot read data from an S3 bucket encrypted with SSE-KMS. The bucket policy allows the role to perform s3:GetObject. What additional permission is needed?

Accepted Answer

kms:Decrypt on the KMS key. For SSE-KMS, the IAM role must have kms:Decrypt permission on the KMS key. Option A is wrong because s3:GetObject is already allowed. Option B is wrong because SSE-KMS does not require s3:GetObjectAcl. Option D is wrong because kms:GenerateDataKey is used for writes. Option C is correct.

Answer

s3:GetObjectVersion

Answer

s3:GetObjectAcl

Answer

kms:GenerateDataKey on the KMS key

Question 3

A company uses AWS CloudTrail to log all API calls. The security team wants to ensure that log files are tamper-proof and cannot be deleted. Which TWO actions should the data engineer take? (Choose TWO.)

Accepted Answer

Enable CloudTrail log file validation. S3 Object Lock prevents deletion, and CloudTrail log file validation provides integrity verification. Option A is wrong because SSE-KMS encrypts but does not prevent deletion. Option B is wrong because MFA Delete is not set up by CloudTrail. Option D is wrong because versioning alone does not prevent deletion. Options C and E are correct.

Answer

Enable MFA Delete on the S3 bucket

Answer

Enable S3 Versioning on the S3 bucket

Answer

Enable SSE-KMS encryption on the S3 bucket

Question 4

A company uses Amazon EMR to process sensitive data. The data engineer needs to ensure that data in transit between EMR and S3 is encrypted. Which THREE configurations achieve this? (Choose THREE.)

Accepted Answer

Configure EMRFS to use server-side encryption with S3 (SSE-S3) and require HTTPS. EMR can use S3 SSE-C with HTTPS, VPC endpoints with policies, and EMRFS with SSE-S3 all support encryption in transit. Option A is wrong because SSE-KMS encrypts at rest. Option D is wrong because S3 Block Public Access is unrelated to transit. Options B, C, and E are correct.

Answer

Enable S3 Block Public Access on the bucket

Answer

Enable SSE-KMS on the S3 bucket

Question 5

A data engineer is setting up a data pipeline using AWS DMS to migrate data from an on-premises database to Amazon RDS for MySQL. The data must be encrypted in transit. Which TWO options can the engineer use? (Choose TWO.)

Accepted Answer

Enable SSL encryption on the DMS endpoint. DMS supports SSL/TLS for encrypting connections. Option A is wrong because VPN creates encrypted tunnel. Option D is wrong because VPC peering does not encrypt. Options B and C are correct (B uses SSL, C uses VPN). Option E is wrong because DMS does not use KMS for transit encryption.

Answer

Use VPC peering between on-premises and AWS

Answer

Use KMS to encrypt the DMS connection

Answer

Use a VPC endpoint for DMS

Question 6

Refer to the exhibit. A data engineer applies the following S3 bucket policy to an S3 bucket. What does this policy enforce?

Accepted Answer

Requires that all objects uploaded to the bucket be encrypted with SSE-KMS. The policy denies s3:PutObject if the object is not encrypted with SSE-KMS. Option A is wrong because it denies if not SSE-KMS, not allows only SSE-S3. Option B is wrong because it doesn't require SSE-S3. Option D is wrong because it doesn't allow any encryption. Option C is correct.

Answer

Denies all uploads unless SSE-S3 is used

Answer

Allows only SSE-S3 encrypted uploads

Answer

Allows any type of server-side encryption

Question 7

Refer to the exhibit. A data engineer configured CloudTrail to log data events for an S3 bucket. However, the engineer notices that no data events are being logged for objects in the 'logs/' prefix. What is the most likely reason?

Accepted Answer

The S3 bucket policy does not allow CloudTrail to write logs. The data resource value is missing a trailing slash (should be 'logs/')? Actually it has a trailing slash. Wait, the issue is that the ARN is for a prefix, but CloudTrail data event selectors for S3 require a bucket ARN or prefix ARN with a trailing slash. The provided ARN 'arn:aws:s3:::my-bucket/logs/' is correct format. However, the likely issue is that the bucket is in a different region, but the trail is in a different region? No, more common: the IAM role for CloudTrail lacks permissions to log to S3. But the exhibit shows a correct selector. Actually, common mistake: the selector must have a trailing slash, which it does. The most likely cause is that the trail is not logging because the S3 bucket policy does not grant CloudTrail write access. Option A is plausible. Option B is wrong because prefix is correct. Option C is wrong because it includes trailing slash. Option D is wrong because data events are enabled. So option A is correct.

Answer

The data resource should specify the bucket ARN without a prefix

Answer

The prefix 'logs/' must not include a trailing slash

Answer

Data events are not supported for S3

Question 8

Refer to the exhibit. A data engineer creates an IAM policy for a service role used by AWS Glue. What does the condition in the policy enforce?

Accepted Answer

The role can only use the KMS key when the request comes from S3. The condition restricts KMS actions to requests that come from S3 via the kms:ViaService condition key. Option B is wrong because it says Glue, but the condition is for S3. Option C is wrong because it's not for any service. Option D is wrong because it restricts to S3, not any KMS key. Option A is correct.

Answer

The role can use the KMS key from any AWS service

Answer

The role can only use the KMS key when the request comes from Glue

Answer

The role can only use the KMS key for decrypting data

Question 9

A company wants to encrypt data at rest in Amazon S3 using server-side encryption. They need to manage the encryption keys themselves and rotate them annually. Which S3 encryption option should they use?

Accepted Answer

SSE-C. SSE-C allows the customer to provide and manage their own encryption keys. SSE-S3 uses AWS-managed keys, and SSE-KMS uses AWS KMS keys but with AWS managing the key material. Option A is wrong because SSE-S3 does not allow customer-managed keys. Option B is wrong because SSE-KMS still involves AWS management of the key material. Option D is wrong because client-side encryption is not server-side.

Answer

SSE-KMS

Answer

SSE-S3

Answer

Client-side encryption

Question 10

A data engineer needs to audit all access to an S3 bucket for compliance. They want to capture object-level operations such as GetObject and PutObject, as well as bucket-level operations like ListBucket. Which AWS service should be used?

Accepted Answer

S3 server access logs. S3 server access logs record object-level and bucket-level operations. CloudTrail can also record S3 API calls, but by default it logs bucket-level operations only; object-level logging requires enabling data events. Option A is wrong because CloudTrail management events do not include object-level operations. Option C is wrong because CloudWatch Logs alone does not capture S3 access. Option D is wrong because Config records resource configuration changes, not API calls.

Answer

Amazon CloudWatch Logs

Answer

AWS CloudTrail management events

Answer

AWS Config

Question 11

A company uses AWS KMS to encrypt data in Amazon S3 and RDS. They need to ensure that encryption keys are automatically rotated every year. Which KMS key type supports automatic annual rotation?

Accepted Answer

AWS managed keys (aws/xxx). AWS managed keys (AWS-managed KMS keys) have automatic rotation enabled by default every year. Customer managed keys can also have automatic rotation enabled optionally. AWS owned keys are not visible to the customer and cannot be managed. Custom key stores do not support automatic rotation. Option B is wrong because customer managed keys require explicit enabling of rotation. Option C is wrong because AWS owned keys are not customer-accessible. Option D is wrong because custom key stores do not support automatic rotation.

Answer

AWS owned keys

Answer

Customer managed keys

Answer

Custom key stores

Question 12

A data engineer needs to share an S3 bucket with another AWS account. They want to ensure that the objects in the bucket remain encrypted with SSE-KMS using a customer managed key. What additional step is required for cross-account access?

Accepted Answer

Modify the KMS key policy to grant the target account kms:Decrypt permission. When using SSE-KMS with a customer managed key, the key policy must grant the target account's IAM role or user permission to use the key. S3 bucket policy and IAM permissions are also required, but the key policy is the additional step specific to KMS. Option A is wrong because the bucket policy alone does not grant KMS permissions. Option B is wrong because the target account's IAM policy alone cannot override the key policy. Option D is wrong because disabling encryption is not required.

Answer

Add an IAM policy in the target account to allow kms:Decrypt

Answer

Disable SSE-KMS encryption on the bucket

Answer

Add a bucket policy that grants the target account s3:GetObject

Question 13

A company wants to enforce that all data in Amazon S3 is encrypted at rest. They want to automatically reject any PUT request that does not include encryption headers. What S3 feature should they use?

Accepted Answer

Bucket policy with a condition for encryption headers. S3 bucket policies can be used to deny requests that do not include the x-amz-server-side-encryption header. This enforces encryption. Option A is wrong because default encryption only encrypts objects that are uploaded without encryption headers, but it does not reject unencrypted requests. Option B is wrong because S3 Block Public Access is about public access, not encryption. Option D is wrong because MFA Delete is about deletion protection.

Answer

Default encryption

Answer

MFA Delete

Answer

S3 Block Public Access

Question 14

A company uses AWS Lake Formation to manage data lake permissions. A data engineer notices that a user can query tables in Athena even though the user does not have SELECT permission on the table in Lake Formation. What could be the cause?

Accepted Answer

The IAMAllowedPrincipals group has been granted Super permission on the database. By default, Lake Formation uses IAMAllowedPrincipals group which grants full access to IAM users and roles. If this group is present, Lake Formation permissions are bypassed. Option A is wrong because IAM policy granting Athena access is not sufficient without Lake Formation permissions. Option C is wrong because S3 permissions alone do not allow Athena queries. Option D is wrong because Lake Formation is a different service.

Answer

The user is using Redshift Spectrum

Answer

The user has S3 permissions to read the underlying data

Answer

The user has an IAM policy that allows Athena access

Question 15

A company needs to monitor and record all changes to IAM policies in their AWS account. Which AWS service should be used?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records API calls, including IAM policy changes. AWS Config records resource configuration changes and can evaluate compliance rules. Option A is wrong because IAM Access Analyzer is for analyzing resource policies for public access, not recording changes. Option C is wrong because GuardDuty is for threat detection. Option D is wrong because CloudWatch Logs does not directly record IAM changes.

Answer

Amazon CloudWatch Logs

Answer

Amazon GuardDuty

Answer

AWS IAM Access Analyzer