DEA-C01 Data Security and Governance Practice Test 9 — 15 Questions

Question 1

A data engineer is designing a solution to securely store and rotate database credentials used by an application. The credentials should be automatically rotated every 90 days. Which AWS service should be used?

Accepted Answer

AWS Secrets Manager. Option C is correct because AWS Secrets Manager can automatically rotate secrets, including database credentials. Option A (IAM) manages users and roles, not credentials rotation. Option B (AWS KMS) manages encryption keys, not secrets. Option D (Parameter Store) can store secrets but does not have built-in automatic rotation.

Answer

AWS Systems Manager Parameter Store

Answer

AWS Key Management Service (KMS)

Answer

AWS Identity and Access Management (IAM)

Question 2

A data engineer needs to ensure that data in an S3 bucket is encrypted at rest. The bucket policy includes a condition that denies PutObject requests if the object is not encrypted. Which S3 encryption feature does this enforce?

Accepted Answer

S3 Bucket Policy. Option D is correct because S3 bucket policies can require server-side encryption by denying PutObject without encryption headers. Option A (default encryption) is a bucket-level setting that automatically encrypts objects, but it does not enforce encryption via policy. Option B (object lock) prevents deletion. Option C (MFA delete) requires multi-factor authentication.

Answer

S3 Object Lock

Answer

S3 MFA Delete

Answer

S3 Default Encryption

Question 3

Which TWO actions should a data engineer take to protect sensitive data in an Amazon S3 bucket from being accessed by unauthorized users? (Select TWO.)

Accepted Answer

Add a bucket policy with a Deny effect for unauthorized principals. Options A and C are correct. Option A (S3 Block Public Access) prevents public access to the bucket. Option C (bucket policy with Deny effect) explicitly denies access to unauthorized users. Option B (S3 server access logs) is for auditing, not prevention. Option D (CloudTrail) is for logging, not prevention. Option E (VPC endpoint) is for network connectivity, not access control.

Answer

Create a VPC endpoint for S3

Answer

Enable S3 server access logging

Answer

Enable AWS CloudTrail for the bucket

Question 4

A company must encrypt all data at rest in their Amazon RDS for MySQL instance. Which THREE steps are required to achieve this? (Select THREE.)

Accepted Answer

Use an AWS KMS key to encrypt the instance. Options A, C, and D are correct. Option A (enable encryption at rest) is required. Option C (use KMS key) is needed to manage encryption keys. Option D (ensure backups are encrypted) is necessary because encrypted instances require encrypted backups. Option B (enable SSL) is for encryption in transit, not at rest. Option E (use parameter groups) does not enable encryption.

Answer

Enable SSL/TLS for database connections

Answer

Modify the DB parameter group to require encryption

Question 5

Which THREE AWS services can be used to centrally manage and govern data across multiple AWS accounts? (Select THREE.)

Accepted Answer

AWS Control Tower. Options A, C, and E are correct. Option A (AWS Organizations) provides centralized management. Option C (AWS Lake Formation) can manage data lake permissions across accounts. Option E (AWS Control Tower) offers a pre-configured environment for governance. Option B (Amazon S3) is a storage service, not central governance. Option D (Amazon Redshift) is a data warehouse, not a governance service.

Answer

Amazon S3

Answer

Amazon Redshift

Question 6

The IAM policy shown is attached to an IAM role. When a user assumes this role and tries to read an object in example-bucket that has no tags, what will happen?

Accepted Answer

The request will be denied because the Deny statement applies when the tag is missing. Option D is correct. The Deny statement denies s3:GetObject if the object does not have the tag 'classification' (i.e., the tag is null). Since the object has no tags, the condition evaluates to true, and the action is denied. The Allow statement only allows if the tag equals 'public', which is not the case. The explicit Deny overrides any Allow, so access is denied.

Answer

The request will be denied because the object does not have the 'public' tag

Answer

The request will be allowed because the Allow statement grants access to all objects

Answer

The request will be allowed because there is no explicit Deny

Question 7

A data engineer uses the AWS CLI to list KMS keys and describe one. The output shows two keys. The described key has KeyState 'Enabled' and Origin 'AWS_KMS'. Which statement is true about this key?

Accepted Answer

The key is a KMS managed key that is enabled and ready for use. Option C is correct. The key has Origin 'AWS_KMS', which means it is a KMS managed key (not imported). The KeyState 'Enabled' means it can be used for encryption and decryption. Option A is incorrect because it is not imported (Origin 'AWS_KMS'). Option B is incorrect because the key is not disabled. Option D is incorrect because the key is not pending deletion.

Answer

The key material was imported from an external source

Answer

The key is scheduled for deletion

Answer

The key is disabled and cannot be used

Question 8

A data engineer runs the command shown to check the encryption configuration of an S3 bucket. The output shows SSEAlgorithm: AES256. What does this mean?

Accepted Answer

The bucket uses SSE-S3 with Amazon S3-managed keys. Option A is correct. AES256 refers to SSE-S3, where Amazon S3 manages the encryption keys using AES-256. Option B (SSE-KMS) would show 'aws:kms'. Option C (SSE-C) would require the customer to provide keys. Option D (no encryption) is incorrect because encryption is enabled.

Answer

The bucket uses SSE-KMS with a customer-managed key

Answer

The bucket uses SSE-C with customer-provided keys

Answer

The bucket does not have encryption enabled

Question 9

A company uses AWS KMS to encrypt data in Amazon S3. The security team requires that all encryption keys be rotated automatically every year. Which key type should the company use?

Accepted Answer

Use a customer managed key with manual rotation. AWS managed keys (AWS-managed KMS keys) are automatically rotated every year. Customer managed keys do not rotate automatically unless configured with a custom rotation period. The correct answer is C because AWS managed keys satisfy the requirement of automatic yearly rotation without additional configuration.

Answer

Use a customer managed key with automatic rotation enabled

Answer

Use the default S3 managed encryption key (SSE-S3)

Answer

Use an AWS managed key (aws/s3)

Question 10

A data engineer needs to restrict access to an Amazon S3 bucket so that only objects encrypted with a specific AWS KMS key can be uploaded. Which S3 bucket policy condition should be used?

Accepted Answer

s3:x-amz-server-side-encryption-aws-kms-key-id. The kms:EncryptionContext condition key is used to enforce encryption context, not the key itself. The s3:x-amz-server-side-encryption-aws-kms-key-id condition key is used to require a specific KMS key ID for server-side encryption. Option C is correct.

Answer

kms:ViaService

Answer

s3:x-amz-server-side-encryption

Answer

kms:EncryptionContext

Question 11

A company wants to audit all changes to IAM policies in their AWS account. Which combination of services should be used to achieve this?

Accepted Answer

AWS CloudTrail and Amazon CloudWatch Logs. AWS CloudTrail records API calls for IAM policy changes (e.g., PutRolePolicy, PutUserPolicy). Amazon CloudWatch Logs can be the target for CloudTrail logs, and CloudWatch Events (now Amazon EventBridge) can trigger notifications or actions. Option D is correct. AWS Config records resource configuration changes but not all API calls.

Answer

AWS Config and Amazon SNS

Answer

Amazon CloudWatch Logs and Amazon SNS

Answer

AWS CloudTrail and Amazon DynamoDB

Question 12

A data engineer needs to allow an IAM user to rotate the secret in AWS Secrets Manager for an RDS database. Which IAM action should be included in the policy?

Accepted Answer

secretsmanager:RotateSecret. The secretmanager:RotateSecret action allows the user to initiate rotation of a secret. Option B is correct. secretmanager:GetSecretValue only retrieves the secret value, not rotate it.

Answer

secretsmanager:PutSecretValue

Answer

secretsmanager:UpdateSecret

Answer

secretsmanager:GetSecretValue

Question 13

A company stores sensitive data in Amazon S3. The security team requires that all data be encrypted at rest and that the encryption keys be stored in AWS CloudHSM. Which S3 encryption option should be used?

Accepted Answer

SSE-C. SSE-C allows customers to provide their own encryption keys, which can be stored in CloudHSM. SSE-S3 and SSE-KMS use AWS-managed keys or KMS keys, not CloudHSM. Option D is correct.

Answer

SSE-S3

Answer

SSE-KMS with an AWS managed key

Answer

SSE-KMS with a customer managed key

Question 14

A company wants to ensure that all S3 buckets are encrypted using server-side encryption. Which AWS service can be used to automatically remediate non-compliant buckets?

Accepted Answer

AWS Config. AWS Config can use managed rules like s3-bucket-server-side-encryption-enabled to check compliance and trigger auto-remediation via SSM Automation or Lambda. Option B is correct.

Answer

AWS CloudTrail

Answer

Amazon Inspector

Answer

AWS Trusted Advisor

Question 15

A data engineer needs to grant cross-account access to an S3 bucket. The engineer wants to use a role in the source account and assume that role from the target account. Which permissions are required?

Accepted Answer

Role in source account with trust policy allowing target account, and bucket policy granting access to the role. The target account needs sts:AssumeRole permission on the role ARN in the source account. The source account's bucket policy must also grant access to the assumed role. Option D is correct.

Answer

Bucket policy in source account allowing the target account's root user

Answer

Role in target account with trust policy allowing source account

Answer

IAM policy in target account allowing s3:GetObject on the bucket