DEA-C01 Data Security and Governance Practice Test 9 — 15 Questions

Question 1

A data engineer needs to securely store database credentials for an RDS instance. Which TWO AWS services can be used?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is a dedicated service for managing secrets, including automatic rotation. AWS Systems Manager Parameter Store can also securely store secrets like database credentials as secure string parameters. AWS KMS is used for encryption key management, not for storing secrets. AWS IAM is for identity and access management. AWS CloudFormation is for infrastructure as code and does not natively store secrets.

Answer

AWS KMS

Answer

AWS IAM

Answer

AWS CloudFormation

Question 2

Refer to the exhibit. A data engineer applied this bucket policy to an S3 bucket. What is the effect of this policy?

Accepted Answer

Blocks HTTP requests to get objects. The bucket policy denies the s3:GetObject action when the request is made over HTTP (i.e., when aws:SecureTransport equals false). This effectively blocks HTTP requests to get objects, while allowing HTTPS requests. Therefore, Option B is correct. Option A is incorrect because the policy blocks HTTP, not allows it. Option C is incorrect because the policy blocks HTTP, not allows it. Option D is incorrect because the policy only blocks insecure transport, not all access.

Answer

Allows only HTTPS requests to get objects

Answer

Allows only HTTP requests to get objects

Answer

Blocks all access to the bucket

Question 3

Refer to the exhibit. A data engineer runs this CLI command to investigate a recent change to an S3 bucket policy. What information does the command return?

Accepted Answer

A list of event IDs for PutBucketPolicy calls. The command uses CloudTrail's lookup-events to find all PutBucketPolicy API calls in a 24-hour period. It returns a list of events, each containing details like who made the call, when, and the request parameters. Option A is wrong because the command returns a list of event IDs, not an evaluation of compliance. Option B is wrong because the command does not show the current policy, only past events. Option C is wrong because the command does not evaluate compliance.

Answer

An evaluation of bucket policy compliance

Answer

The current bucket policy for all buckets

Answer

A report of all S3 bucket policy changes

Question 4

Refer to the exhibit. This KMS key policy is attached to a customer managed key. A data engineer finds that the DataEngineer role can encrypt but cannot decrypt data. What is the most likely cause?

Accepted Answer

The role does not have an IAM policy allowing kms:Decrypt. The key policy allows kms:Decrypt and kms:GenerateDataKey for the DataEngineer role, so the role can encrypt. However, KMS requires both key policy and IAM policy permissions for IAM roles. Since the role lacks an IAM policy that grants kms:Decrypt, it cannot decrypt. Option A is incorrect because the key policy does include kms:Decrypt. Option C is incorrect because the key policy explicitly allows kms:Decrypt. Option D is incorrect because kms:GenerateDataKey is allowed in the policy; the issue is with decrypt.

Answer

The key policy does not include kms:Decrypt in the IAM policy section

Answer

The key policy does not allow kms:Decrypt

Answer

The key policy does not allow kms:GenerateDataKey

Question 5

A data engineer is configuring an S3 bucket for storing sensitive customer data. The bucket must be encrypted at rest using an AWS Key Management Service (KMS) key that is managed by the data engineering team. The team wants to ensure that only users with explicit permission can decrypt the data. Which S3 encryption option should be used?

Accepted Answer

SSE-KMS. SSE-KMS is the correct option because it uses a customer-managed AWS KMS key, allowing the data engineering team to control access and permissions for decryption. Client-side encryption is not an S3 server-side encryption option and does not use KMS. SSE-S3 uses Amazon S3-managed keys, which do not provide customer-controlled access. SSE-C requires the customer to manage their own encryption keys and does not use KMS, nor does it allow the same level of access control as a CMK.

Answer

Client-side encryption

Answer

SSE-S3

Answer

SSE-C

Question 6

A data engineer needs to ensure that data in transit between an Amazon RDS for PostgreSQL database and an application is encrypted. Which configuration should be used?

Accepted Answer

Enable SSL/TLS for the database connection. Enabling SSL/TLS for the database connection encrypts the data in transit between the application and the RDS PostgreSQL instance, ensuring confidentiality. Option A (VPC peering) provides network connectivity but does not encrypt traffic. Option C (encryption at rest) protects data stored on disk, not in transit. Option D (IAM database authentication) controls access but does not encrypt the connection.

Answer

Use VPC peering to connect the application to the database

Answer

Enable encryption at rest for the RDS instance

Answer

Use IAM database authentication

Question 7

An organization needs to audit all access to their S3 buckets for compliance purposes. They want to log both successful and failed API calls. Which AWS service should be used?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records all API calls made to S3, including both successful and failed requests, and delivers log files to an S3 bucket for auditing and compliance. CloudTrail captures management events (e.g., CreateBucket) and, when enabled, data events (e.g., GetObject, PutObject) for S3, providing a complete audit trail of access.

Answer

Amazon CloudWatch Logs

Answer

AWS Config

Answer

VPC Flow Logs

Question 8

A company has multiple AWS accounts and wants to centrally manage permissions and access to data lakes. They have enabled AWS Organizations and want to use a single set of policies that apply to all accounts. Which policy type should be used at the organization level?

Accepted Answer

Service control policies (SCPs). Service Control Policies (SCPs) are used in AWS Organizations to centrally manage permissions across accounts. Option A (IAM policies) are attached to IAM users/roles within an account, not across accounts. Option B (KMS key policies) control access to KMS keys. Option C (S3 bucket policies) are specific to S3 buckets.

Answer

IAM policies

Answer

KMS key policies

Answer

S3 bucket policies

Question 9

A data engineer needs to ensure that data stored in Amazon S3 is automatically deleted after 30 days. Which S3 feature should be used?

Accepted Answer

S3 Lifecycle policy. S3 Lifecycle policies can automatically delete objects after a specified time period, such as 30 days. Option B (MFA Delete) requires multi-factor authentication for deletion but does not automate deletion. Option C (Versioning) keeps multiple versions but does not delete. Option D (Object Lock) prevents deletion or modification but does not schedule automatic deletion.

Answer

S3 MFA Delete

Answer

S3 Versioning

Answer

S3 Object Lock

Question 10

A company is using AWS Lake Formation to manage access to a data lake in S3. They want to grant a data analyst access to specific columns in a table, but not to the entire table. Which Lake Formation feature should be used?

Accepted Answer

Column-level filtering. Lake Formation column-level filtering allows granting access to specific columns in a table without granting access to the entire table. Option A (row-level security) controls access to rows, not columns. Option B (IAM policies on the S3 bucket) would grant access to the entire dataset or bucket, not specific columns. Option D (tag-based access control) uses tags to manage permissions but does not provide column-level granularity.

Answer

Row-level security (cell-level filtering)

Answer

IAM policies on the S3 bucket

Answer

Tag-based access control (TBAC)

Question 11

A data engineer is designing a solution to securely store and rotate database credentials used by an application. The credentials should be automatically rotated every 90 days. Which AWS service should be used?

Accepted Answer

AWS Secrets Manager. (AWS Secrets Manager) is correct because it can automatically rotate secrets, including database credentials, with built-in rotation support. Option B (AWS Systems Manager Parameter Store) can store secrets but lacks automatic rotation capability. Option C (AWS Key Management Service) manages encryption keys, not secrets. Option D (AWS Identity and Access Management) manages users and roles, not credential rotation.

Answer

AWS Systems Manager Parameter Store

Answer

AWS Key Management Service (KMS)

Answer

AWS Identity and Access Management (IAM)

Question 12

A data engineer needs to ensure that data in an S3 bucket is encrypted at rest. The bucket policy includes a condition that denies PutObject requests if the object is not encrypted. Which S3 encryption feature does this enforce?

Accepted Answer

S3 Bucket Policy. S3 bucket policies can require server-side encryption by denying PutObject without encryption headers. Option C (default encryption) is a bucket-level setting that automatically encrypts objects, but it does not enforce encryption via policy. Option A (object lock) prevents deletion. Option B (MFA delete) requires multi-factor authentication.

Answer

S3 Object Lock

Answer

S3 MFA Delete

Answer

S3 Default Encryption

Question 13

Which TWO actions should a data engineer take to protect sensitive data in an Amazon S3 bucket from being accessed by unauthorized users? (Select TWO.)

Accepted Answer

Add a bucket policy with a Deny effect for unauthorized principals. Options C and E are correct. Option C (bucket policy with Deny effect) explicitly denies access to unauthorized users, preventing unauthorized access. Option E (S3 Block Public Access) prevents public access to the bucket, ensuring it is not publicly accessible. Option A (VPC endpoint) is for network connectivity, not access control. Option B (server access logging) is for auditing, not prevention. Option D (CloudTrail) is for logging and monitoring, not access control.

Answer

Create a VPC endpoint for S3

Answer

Enable S3 server access logging

Answer

Enable AWS CloudTrail for the bucket

Question 14

A company must encrypt all data at rest in their Amazon RDS for MySQL instance. Which THREE steps are required to achieve this? (Select THREE.)

Accepted Answer

Use an AWS KMS key to encrypt the instance. To encrypt data at rest in Amazon RDS for MySQL, you must enable encryption when creating the DB instance (option C). This uses an AWS KMS key (option B) to manage the encryption. Encrypted instances require that automated backups and snapshots are also encrypted (option E). Option A (SSL/TLS) encrypts data in transit, not at rest. Option D (modifying the DB parameter group) does not enable encryption at rest.

Answer

Enable SSL/TLS for database connections

Answer

Modify the DB parameter group to require encryption

Question 15

Which THREE AWS services can be used to centrally manage and govern data across multiple AWS accounts? (Select THREE.)

Accepted Answer

AWS Control Tower. The correct answers are AWS Control Tower, AWS Organizations, and AWS Lake Formation. AWS Control Tower provides a pre-configured environment for governance and compliance across accounts. AWS Organizations enables centralized management of multiple accounts. AWS Lake Formation helps manage and govern data lake permissions across accounts. Amazon S3 (Option A) is a storage service, not a central governance service. Amazon Redshift (Option D) is a data warehouse, not a governance service.

Answer

Amazon S3

Answer

Amazon Redshift