DEA-C01 Data Security and Governance Practice Test 8 — 15 Questions

Question 1

A data engineer needs to audit who accessed specific objects in an S3 bucket over the past 30 days. Which AWS service should be used?

Accepted Answer

Amazon S3 server access logs. Amazon S3 server access logs provide detailed records of requests made to an S3 bucket, including object-level access (e.g., who accessed which object, when, and from where). Option A (AWS Config) is used for resource inventory and compliance, not access auditing. Option B (Amazon CloudWatch Logs) can store and monitor logs but does not generate S3 access logs. Option D (AWS CloudTrail) logs API calls to S3, but by default it records bucket-level operations, not object-level access; CloudTrail can be enabled for data events to log object-level operations, but S3 server access logs are specifically designed for detailed object access auditing and are simpler to enable for this requirement.

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Answer

AWS CloudTrail

Question 2

A company has an AWS Glue ETL job that reads data from an S3 bucket encrypted with SSE-S3. The job runs successfully, but the output written to another S3 bucket with SSE-KMS fails. The IAM role for the Glue job has s3:PutObject and kms:GenerateDataKey permissions. What is the most likely cause?

Accepted Answer

The IAM role is missing kms:Encrypt permission. For SSE-KMS, the IAM role needs both kms:GenerateDataKey and kms:Encrypt permissions to write objects. The role already has kms:GenerateDataKey, but missing kms:Encrypt causes the write to fail. Option A is correct. Option B is incorrect because if the bucket policy denied s3:PutObject, the job would fail on the PutObject action itself, not on encryption. Option C is incorrect because the role already has kms:GenerateDataKey; the missing permission is kms:Encrypt. Option D is incorrect because the source bucket's encryption (SSE-S3) is irrelevant to the write operation; the error occurs on the target bucket with SSE-KMS.

Answer

The target S3 bucket policy denies s3:PutObject

Answer

The KMS key policy does not grant the Glue role kms:GenerateDataKey

Answer

The source bucket's encryption type is incompatible with the target

Question 3

Refer to the exhibit.

Exhibit:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::123456789012:role/DataEngineer"
      },
      "Action": [
        "kms:Decrypt",
        "kms:ReEncrypt*"
      ],
      "Resource": "*"
    }
  ]
}

A data engineer tries to encrypt data using the KMS key associated with this key policy and receives an access denied error. What is the cause?

Accepted Answer

The policy does not include kms:Encrypt action. The key policy grants only kms:Decrypt and kms:ReEncrypt* to the DataEngineer role. KMS key policies must explicitly allow the kms:Encrypt action for a principal to encrypt data with the key. Since kms:Encrypt is absent, the encryption request is denied.

Answer

The principal is an IAM role, which is not allowed

Answer

There is an explicit deny in the policy

Answer

The Resource element is set to "*", which is invalid for KMS key policies

Question 4

A data engineer runs an AWS Glue ETL job that reads from a table in the AWS Glue Data Catalog. The job fails with the error shown. The IAM role used by the Glue job has the following policy attached:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "glue:GetTable",
                "glue:GetDatabase"
            ],
            "Resource": "*"
        }
    ]
}

What should be added to the IAM role's policy to resolve the error?

Accepted Answer

lakeformation:GetDataAccess on the table resource. When a Glue Data Catalog table is governed by AWS Lake Formation, the Glue job's IAM role must have lakeformation:GetDataAccess permission on the table resource in addition to glue:GetTable and glue:GetDatabase. Lake Formation intercepts data access requests and requires this explicit permission grant, which is separate from standard Glue catalog permissions. Without it, the job fails with an AccessDenied error even though the IAM policy allows catalog metadata reads.

Answer

s3:GetObject on the underlying S3 bucket

Answer

glue:GetTable on the specific table resource

Answer

kms:Decrypt on the KMS key

Question 5

A data engineer applies the above bucket policy to an S3 bucket containing sensitive data. The goal is to allow only encrypted (HTTPS) requests. However, a user reports being able to access an object using an HTTP (non-HTTPS) request. What is the most likely reason?

Accepted Answer

The condition key aws:SecureTransport is used with BoolIfExists instead of Bool. The condition key aws:SecureTransport with BoolIfExists evaluates to true when the key is absent from the request context, so requests that do not include the key (such as some HTTP requests) can still satisfy the condition and be allowed. Using Bool instead of BoolIfExists ensures the condition only evaluates true when the key is present and equals the specified value, correctly denying non-HTTPS requests. This is the classic S3 policy pitfall for enforcing TLS-only access.

Answer

The policy uses Allow instead of Deny

Answer

The resource ARN does not include the bucket itself

Answer

The principal is set to "*", which allows anonymous access

Question 6

A company uses Amazon DynamoDB with encryption at rest using an AWS managed KMS key. The security team requires that the encryption key be rotated every 90 days. What should the data engineer do to meet this requirement?

Accepted Answer

Use a customer managed KMS key and configure automatic rotation. AWS managed keys (used with DynamoDB encryption at rest by default) are automatically rotated every three years, but this rotation schedule cannot be changed. To meet a 90-day rotation requirement, the company must switch to using a customer managed KMS key, which allows them to enable automatic rotation (though automatic rotation is yearly) or manually rotate the key as needed. Option A is incorrect because AWS CloudHSM provides hardware-based key storage but does not directly integrate with DynamoDB's encryption at rest in a way that allows the required rotation schedule. Option B is incorrect because AWS managed keys cannot be rotated on demand via Lambda; the rotation policy is controlled by AWS. Option C is incorrect because DynamoDB does not support custom encryption contexts; encryption contexts are used with KMS to add additional authenticated data, but they do not trigger key rotation.

Answer

Switch to AWS CloudHSM to manage the encryption key

Answer

Create a scheduled AWS Lambda function to rotate the AWS managed key

Answer

Enable a custom encryption context in DynamoDB to trigger rotation

Question 7

A company has a multi-account strategy using AWS Organizations. The data engineering team needs to share a central S3 bucket across multiple accounts while maintaining fine-grained access control. Which solution should be used?

Accepted Answer

Use S3 access points with a policy per account. S3 access points simplify managing access to a shared bucket across many accounts by creating a unique endpoint with its own access point policy. You can create one access point per account (or per application) and delegate access control to each account's access point policy, enabling fine-grained, scalable permissions without a monolithic bucket policy.

Answer

Use IAM roles in each account with cross-account access

Answer

Use Amazon CloudFront to serve the data

Answer

Create a bucket policy with principal ARNs for each account

Question 8

A company uses Amazon EMR to process data stored in S3 with server-side encryption using AWS KMS. The EMR cluster fails with a "403 Access Denied" error when reading data from S3. The IAM role for the EMR cluster has s3:GetObject and kms:Decrypt permissions. What is the most likely issue?

Accepted Answer

The EC2 instance profile does not have kms:Decrypt permission. The most likely issue is that the EC2 instance profile (the role attached to the EMR cluster's EC2 instances) lacks kms:Decrypt permission. Even if the EMR service role has the permission, EMRFS running on the instances uses the instance profile credentials to call KMS, so the instance profile must also have kms:Decrypt on the key. This is a classic dual-role permission gap in EMR.

Answer

The S3 bucket policy denies access to the EMR cluster's IAM role

Answer

The EMRFS consistent view is not enabled

Answer

The EMR cluster is using an incorrect KMS key ID

Question 9

A company needs to tag all resources created in a specific AWS account to enforce data governance policies. Which AWS service can automatically enforce tagging rules?

Accepted Answer

AWS Organizations SCPs. AWS Organizations Service Control Policies (SCPs) are the only mechanism listed that can automatically enforce tagging rules across an entire AWS account. SCPs allow you to define guardrails that restrict what actions and resources are allowed, including requiring specific tags on resource creation. By attaching an SCP that denies the creation of resources without mandatory tags, you ensure compliance with data governance policies. This enforcement is automatic and applies to all principals in the account (except the management account).

Answer

AWS Service Catalog

Answer

AWS Resource Access Manager

Answer

AWS Systems Manager

Question 10

A company wants to audit all changes to IAM policies in their AWS account. Which AWS service should be used to record these changes?

Accepted Answer

AWS Config. AWS Config records configuration changes to AWS resources, including IAM policies. CloudTrail records API calls, not configuration snapshots. GuardDuty is for threat detection. Inspector is for vulnerability assessment.

Answer

AWS CloudTrail

Answer

Amazon GuardDuty

Answer

Amazon Inspector

Question 11

A data engineer is tasked with implementing data masking for a non-production environment. The source data contains credit card numbers stored in an Amazon RDS for PostgreSQL database. The engineer wants to automatically mask the credit card numbers when copying data to the non-production database. Which AWS service can be used to achieve this?

Accepted Answer

AWS Database Migration Service (DMS). AWS Database Migration Service (DMS) supports data masking transformations natively through its table-mapping rules, allowing credit card numbers to be masked automatically as data is replicated from the source RDS PostgreSQL to the non-production target. DMS is purpose-built for heterogeneous and homogeneous migrations and replication, and its transformation rules can hash, mask, or replace sensitive columns during the copy. This makes it the correct service for automated masking during a database copy.

Answer

AWS Glue

Answer

AWS Lake Formation

Answer

Amazon Athena

Question 12

A company needs to enforce encryption at rest for all data stored in Amazon S3. The security team wants to ensure that no objects can be uploaded without encryption. Which THREE steps should be taken to meet this requirement?

Accepted Answer

Use AWS Key Management Service (KMS) to manage encryption keys. Option C is correct because AWS KMS provides centralized, auditable management of the encryption keys used for SSE-KMS, which is the recommended approach for enforcing encryption at rest with controlled key policies and rotation. Option D is correct because an S3 bucket policy that denies s3:PutObject when the x-amz-server-side-encryption header is absent blocks any unencrypted upload attempt, directly enforcing the requirement at the API level. Option E is correct because enabling default bucket encryption with SSE-S3 ensures that any object stored without explicit encryption headers is automatically encrypted at rest with AES-256, providing a baseline safeguard. Option A is not correct because CloudTrail only records API activity for auditing and does not enforce or apply encryption to objects. Option B is not correct because S3 Transfer Acceleration only speeds up uploads via AWS edge locations and has no bearing on encryption at rest.

Answer

Require all clients to use AWS CloudTrail for logging

Answer

Enable Amazon S3 Transfer Acceleration

Question 13

A data engineer is setting up an Amazon Redshift cluster. Which TWO measures can be taken to secure the data at rest?

Accepted Answer

Enable encryption on the Redshift cluster using AWS KMS. Option A is correct because enabling encryption on the Redshift cluster using AWS KMS provides at-rest encryption of the cluster's data and metadata, including backups, using keys managed by AWS KMS (or customer-managed keys). Option E is correct because Redshift supports using a hardware security module (HSM) to manage and store the encryption keys used for at-rest encryption, giving customers control over key material for compliance requirements. Option B is not correct in this context because client-side encryption protects data before it reaches Redshift but does not secure the data at rest within the Redshift cluster itself. Option C is not correct because IAM database authentication controls access to the database (authentication), not encryption of stored data. Option D is not correct because VPC security groups restrict network access to the cluster, which is a network-level control rather than data-at-rest encryption.

Answer

Encrypt data on the client side before loading into Redshift

Answer

Enable AWS IAM database authentication

Answer

Use VPC security groups to restrict network access

Question 14

Refer to the exhibit. A data engineer applies this S3 bucket policy to the bucket 'example-bucket'. What is the effect of this policy?

Accepted Answer

PutObject requests are denied unless they include the x-amz-server-side-encryption header set to AES256. The bucket policy uses a Deny effect on s3:PutObject with a condition that the request must include the x-amz-server-side-encryption header set to AES256. Because it is an explicit Deny, any PutObject request that does not carry that exact header (or carries a different value like aws:kms) is rejected. Requests that do include the header with AES256 are not denied by this statement and can proceed subject to other policies.

Answer

All PutObject requests are denied regardless of encryption

Answer

All PutObject requests are allowed only if they use SSE-KMS

Answer

The policy has no effect because it does not allow any action

Question 15

Refer to the exhibit. A data engineer creates this KMS key policy. An IAM role in account 123456789012 is granted decrypt access to the key. However, when the DataAnalystRole tries to decrypt an S3 object encrypted with this key, the operation fails. What is the most likely reason?

Accepted Answer

The S3 bucket policy does not allow the role to call s3:GetObject. For SSE-KMS encrypted objects, decryption requires both s3:GetObject authorization on the bucket and kms:Decrypt on the key. The scenario states the IAM role already has decrypt access via the key policy, so the failure must originate from the S3 side — the bucket policy does not permit the role to call s3:GetObject. Without that permission, S3 denies the request before KMS is ever invoked.

Answer

The KMS key is in a different region than the S3 bucket

Answer

The role does not have permission to call kms:DescribeKey

Answer

The KMS key policy does not grant kms:Decrypt permission to the role