DEA-C01 Data Security and Governance Practice Test 8 — 15 Questions

Question 1

A data engineer is setting up a data pipeline using AWS DMS to migrate data from an on-premises database to Amazon RDS for MySQL. The data must be encrypted in transit. Which TWO options can the engineer use? (Choose TWO.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable SSL encryption on the DMS endpoint. DMS supports SSL/TLS for encrypting connections. Option A (VPC peering) is incorrect because VPC peering does not encrypt traffic. Option B (Enable SSL encryption on the DMS endpoint) is correct because SSL/TLS encrypts the data in transit. Option C (Set up a VPN connection) is correct because VPN creates an encrypted tunnel. Option D (Use KMS) is incorrect because KMS is for encryption at rest, not in transit. Option E (VPC endpoint) is incorrect because VPC endpoints provide private connectivity but do not encrypt transit.

Answer

Use VPC peering between on-premises and AWS

Answer

Use KMS to encrypt the DMS connection

Answer

Use a VPC endpoint for DMS

Question 2

Refer to the exhibit. A data engineer applies the following S3 bucket policy to an S3 bucket. What does this policy enforce?

Accepted Answer

Requires that all objects uploaded to the bucket be encrypted with SSE-KMS. The bucket policy uses a Deny effect with a condition that checks if the s3:x-amz-server-side-encryption header is not 'aws:kms'. This means any PutObject request that does not use SSE-KMS will be denied. Therefore, the policy enforces that all objects uploaded must be encrypted with SSE-KMS. Option A is incorrect because the policy does not mention SSE-S3; it denies if not SSE-KMS. Option B is incorrect because it requires SSE-KMS, not SSE-S3. Option C is incorrect because the policy only allows SSE-KMS, not any type of server-side encryption. Option D is correct.

Answer

Denies all uploads unless SSE-S3 is used

Answer

Allows only SSE-S3 encrypted uploads

Answer

Allows any type of server-side encryption

Question 3

Refer to the exhibit. A data engineer configured CloudTrail to log data events for an S3 bucket. However, the engineer notices that no data events are being logged for objects in the 'logs/' prefix. What is the most likely reason?

Accepted Answer

The S3 bucket policy does not allow CloudTrail to write logs. The data resource value is missing a trailing slash (should be 'logs/')? Actually it has a trailing slash. Wait, the issue is that the ARN is for a prefix, but CloudTrail data event selectors for S3 require a bucket ARN or prefix ARN with a trailing slash. The provided ARN 'arn:aws:s3:::my-bucket/logs/' is correct format. However, the likely issue is that the bucket is in a different region, but the trail is in a different region? No, more common: the IAM role for CloudTrail lacks permissions to log to S3. But the exhibit shows a correct selector. Actually, common mistake: the selector must have a trailing slash, which it does. The most likely cause is that the trail is not logging because the S3 bucket policy does not grant CloudTrail write access. Option A is plausible. Option B is wrong because prefix is correct. Option C is wrong because it includes trailing slash. Option D is wrong because data events are enabled. So option A is correct.

Answer

The data resource should specify the bucket ARN without a prefix

Answer

The prefix 'logs/' must not include a trailing slash

Answer

Data events are not supported for S3

Question 4

Refer to the exhibit. A data engineer creates an IAM policy for a service role used by AWS Glue. What does the condition in the policy enforce?

Accepted Answer

The role can only use the KMS key when the request comes from S3. The condition uses the `kms:ViaService` key with value `s3.amazonaws.com`, which restricts KMS actions to requests originating from Amazon S3. Therefore, the role can only use the KMS key when the request comes from S3, making option D correct. Option A is incorrect because it does not allow any service; option B is incorrect because it specifies Glue instead of S3; option C is incorrect because it limits to decrypting only, but the condition does not specify the action.

Answer

The role can use the KMS key from any AWS service

Answer

The role can only use the KMS key when the request comes from Glue

Answer

The role can only use the KMS key for decrypting data

Question 5

A company wants to encrypt data at rest in Amazon S3 using server-side encryption. They need to manage the encryption keys themselves and rotate them annually. Which S3 encryption option should they use?

Accepted Answer

SSE-C. SSE-C (Server-Side Encryption with Customer-Provided Keys) allows customers to provide their own encryption keys, manage them, and rotate them as needed. SSE-S3 uses AWS-managed keys, offering no customer control over key management. SSE-KMS uses AWS KMS keys, where AWS manages the key material, though customers can manage key policies and automatic rotation. Client-side encryption is not server-side and does not meet the requirement. Therefore, SSE-C is the correct option.

Answer

SSE-KMS

Answer

SSE-S3

Answer

Client-side encryption

Question 6

A data engineer needs to audit all access to an S3 bucket for compliance. They want to capture object-level operations such as GetObject and PutObject, as well as bucket-level operations like ListBucket. Which AWS service should be used?

Accepted Answer

S3 server access logs. S3 server access logs record both object-level operations (e.g., GetObject, PutObject) and bucket-level operations (e.g., ListBucket). AWS CloudTrail can also capture S3 API calls, but by default it logs bucket-level management events only; object-level data events must be explicitly enabled. Amazon CloudWatch Logs (Option A) is a log storage and monitoring service, not a source of S3 access logs; logs must be sent to it from another service. AWS CloudTrail management events (Option C) capture only bucket-level operations, not object-level. AWS Config (Option D) monitors resource configuration changes, not API calls. Therefore, the correct service for auditing all S3 access is S3 server access logs.

Answer

Amazon CloudWatch Logs

Answer

AWS CloudTrail management events

Answer

AWS Config

Question 7

A company uses AWS KMS to encrypt data in Amazon S3 and RDS. They need to ensure that encryption keys are automatically rotated every year. Which KMS key type supports automatic annual rotation?

Accepted Answer

AWS managed keys (aws/xxx). AWS managed keys (AWS-managed KMS keys) have automatic rotation enabled by default every year, making option B correct. AWS owned keys are not visible to the customer and cannot be managed. Customer managed keys require explicit enabling of rotation, so they are not automatically rotated. Custom key stores do not support automatic rotation. Therefore, only AWS managed keys provide automatic annual rotation without additional configuration.

Answer

AWS owned keys

Answer

Customer managed keys

Answer

Custom key stores

Question 8

A data engineer needs to share an S3 bucket with another AWS account. They want to ensure that the objects in the bucket remain encrypted with SSE-KMS using a customer managed key. What additional step is required for cross-account access?

Accepted Answer

Modify the KMS key policy to grant the target account kms:Decrypt permission. When using SSE-KMS with a customer managed key, cross-account access requires the KMS key policy to grant the target account's IAM role or user the necessary KMS permissions (kms:Decrypt, and optionally kms:GenerateDataKey). The S3 bucket policy must also grant s3:GetObject, and the target account's IAM policy must allow kms:Decrypt. However, the key policy is the additional step specific to KMS that is not covered by S3 policies alone. Without it, the target account cannot use the key. Option A is correct because modifying the key policy is essential. Option B is insufficient because the target account's IAM policy cannot override the key policy. Option C is unnecessary and breaks encryption. Option D provides S3 access but not KMS access.

Answer

Add an IAM policy in the target account to allow kms:Decrypt

Answer

Disable SSE-KMS encryption on the bucket

Answer

Add a bucket policy that grants the target account s3:GetObject

Question 9

A company wants to enforce that all data in Amazon S3 is encrypted at rest. They want to automatically reject any PUT request that does not include encryption headers. What S3 feature should they use?

Accepted Answer

Bucket policy with a condition for encryption headers. S3 bucket policies can include a condition that denies PutObject requests if they do not include the required encryption headers (e.g., x-amz-server-side-encryption). This enforces encryption at rest by rejecting unencrypted uploads. Default encryption only automatically encrypts objects that are uploaded without encryption headers, but does not reject them. MFA Delete is for requiring multi-factor authentication for delete operations, not for encryption. S3 Block Public Access controls public access to buckets, not encryption. Therefore, option A is correct.

Answer

Default encryption

Answer

MFA Delete

Answer

S3 Block Public Access

Question 10

A company uses AWS Lake Formation to manage data lake permissions. A data engineer notices that a user can query tables in Athena even though the user does not have SELECT permission on the table in Lake Formation. What could be the cause?

Accepted Answer

The IAMAllowedPrincipals group has been granted Super permission on the database. The IAMAllowedPrincipals group is a special group in Lake Formation that, when granted permissions (such as Super), allows IAM users and roles to bypass Lake Formation permissions and access data directly via services like Athena. This is a common misconfiguration that leads to unintended data access. Option A is incorrect because Redshift Spectrum uses its own permissions, not Athena. Option B is incorrect because S3 permissions allow reading the underlying data but not querying via Athena without proper Lake Formation grants. Option C is incorrect because an IAM policy granting Athena access does not override Lake Formation permissions; the IAMAllowedPrincipals group is the key bypass mechanism.

Answer

The user is using Redshift Spectrum

Answer

The user has S3 permissions to read the underlying data

Answer

The user has an IAM policy that allows Athena access

Question 11

A company needs to monitor and record all changes to IAM policies in their AWS account. Which AWS service should be used?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records API calls, including IAM policy changes, making it the correct choice for monitoring and recording changes to IAM policies. Option A is wrong because Amazon CloudWatch Logs is primarily for storing and monitoring log files, not for directly recording IAM changes. Option B is wrong because Amazon GuardDuty is a threat detection service, not designed for recording configuration changes. Option D is wrong because AWS IAM Access Analyzer analyzes resource policies for public or cross-account access, not for recording changes.

Answer

Amazon CloudWatch Logs

Answer

Amazon GuardDuty

Answer

AWS IAM Access Analyzer

Question 12

A data engineer wants to ensure that only users with a specific tag (e.g., "Department": "DataEngineering") can access an S3 bucket. How can this be enforced?

Accepted Answer

Use a bucket policy with aws:PrincipalTag condition. S3 bucket policies support condition keys like aws:PrincipalTag, which allow access control based on tags attached to IAM principals (users or roles). Option A is correct because it uses aws:PrincipalTag in the bucket policy to restrict access to users with the specific tag. Option B is incorrect because S3 object tags are for objects, not principals, and cannot be used to filter users. Option C is incorrect because attaching an IAM policy to each user is less scalable and does not leverage the bucket policy's centralized control. Option D is incorrect because S3 Object Lambda is for modifying data during retrieval, not for access control decisions.

Answer

Use S3 object tags and a bucket policy condition

Answer

Attach an IAM policy to each user with the tag

Answer

Use S3 Object Lambda to check user tags

Question 13

A company stores sensitive data in S3 and uses VPC Endpoints to restrict access. They want to ensure that data can only be accessed from their VPC. What configuration is required?

Accepted Answer

Add a bucket policy condition aws:SourceVpce. To restrict S3 bucket access to a specific VPC, use a bucket policy with the aws:SourceVpce condition key to specify the VPC endpoint ID. Option A (VPC Flow Logs) logs traffic but does not restrict access. Option B is correct. Option C (S3 Block Public Access) prevents public access but does not limit access to a specific VPC. Option D (security groups) are used for EC2 instances, not S3 buckets.

Answer

Configure VPC Flow Logs to monitor access

Answer

Enable S3 Block Public Access

Answer

Associate a security group with the S3 bucket

Question 14

A data engineer needs to protect sensitive data in an S3 bucket. Which TWO AWS services can be used to detect and prevent accidental public access?

Accepted Answer

AWS Trusted Advisor. AWS Trusted Advisor checks for S3 buckets with public access, helping to detect accidental public access. S3 Block Public Access can be enabled at the account or bucket level to prevent public access. AWS Config can evaluate rules but does not directly detect or prevent public access. AWS CloudTrail records API calls but does not prevent public access. Amazon Macie discovers sensitive data, not public access.

Answer

AWS Config

Answer

AWS CloudTrail

Answer

Amazon Macie

Question 15

A company uses AWS KMS to encrypt data in multiple services. They want to ensure that only specific IAM roles can decrypt data using a particular KMS key. Which TWO steps are necessary?

Accepted Answer

Attach an IAM policy to each role with kms:Decrypt permission. To allow specific IAM roles to decrypt data using a KMS key, two steps are required. First, each role must have an IAM policy that grants the kms:Decrypt permission (A). Second, the KMS key policy must include a statement that allows the IAM roles to perform kms:Decrypt (E). The permission kms:GenerateDataKey (D) is not needed for decryption-only access; it is used for generating data keys during encryption. Options B (enabling IAM policies in key policy) and C (automatic key rotation) are unrelated to access control for decryption.

Answer

Enable IAM policies in the key policy

Answer

Enable automatic key rotation

Answer

Ensure the key policy allows kms:GenerateDataKey for the roles