DEA-C01 Data Security and Governance Practice Test 9 — 15 Questions

Question 1

A company runs an Amazon EMR cluster that processes sensitive data stored in Amazon S3. The security team requires that all data in transit between the EMR cluster and S3 be encrypted. Which configuration ensures this requirement is met?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure the S3 endpoint to use TLS and ensure the EMR cluster uses HTTPS for S3 access.. To ensure data in transit between EMR and S3 is encrypted, you must configure the S3 endpoint to use TLS and ensure the EMR cluster uses HTTPS for S3 access. This enforces encryption via TLS (HTTPS) for all data transferred between EMR and S3.

Answer

Enable in-transit encryption within the EMR cluster using EMRFS.

Answer

Enable server-side encryption with S3 managed keys (SSE-S3) on the S3 bucket.

Answer

Use an S3 access point with a bucket policy that denies HTTP requests.

Question 2

A company uses AWS Glue DataBrew to clean and normalize data. The data contains sensitive columns that must be masked before being written to the output. Which DataBrew action should be applied?

Accepted Answer

Apply a Mask transform to the sensitive columns.. In AWS Glue DataBrew, the Mask transform is designed to obfuscate sensitive data by replacing characters with a masking character (e.g., asterisks) while preserving the data format. This is the appropriate action to protect sensitive columns before writing output. Hash and Encrypt are not native DataBrew transforms; Delete would remove data entirely, which may not be desired if the column is needed for analysis.

Answer

Apply a Hash transform to the sensitive columns.

Answer

Apply an Encrypt transform to the sensitive columns.

Answer

Apply a Delete transform to remove the sensitive columns.

Question 3

A data engineer is configuring an Amazon Redshift cluster for compliance. The cluster must encrypt data at rest and automatically rotate the encryption key every year. Which steps should the engineer take? (Choose THREE.)

Accepted Answer

Create the Redshift cluster with encryption enabled.. Option A is correct because a Redshift cluster must be created with encryption enabled (or modified to enable it) so that data at rest is encrypted using AWS KMS; encryption at rest is a prerequisite for compliance. Option B is correct because automatic key rotation is a property of the AWS KMS customer-managed key, not of Redshift itself, so the engineer must enable yearly automatic rotation on that KMS key to satisfy the annual rotation requirement. Option E is correct because Redshift encryption at rest uses an AWS KMS key, and to control and rotate the key the engineer should specify a customer-managed KMS key rather than the default AWS-managed key, which does not support customer-configured yearly rotation. Option C is incorrect because Redshift has no cluster-level setting to rotate its encryption key; key rotation is handled by KMS. Option D is incorrect because although an existing unencrypted cluster can be modified to enable encryption, the scenario calls for creating a compliant cluster and this step alone does not provide automatic yearly key rotation.

Answer

Configure the Redshift cluster to rotate its encryption key every year.

Answer

Modify an existing unencrypted cluster to enable encryption.

Question 4

Refer to the exhibit. A data engineer runs the commands shown. What can be determined about the key with ID 1234abcd-12ab-34cd-56ef-1234567890ab?

Accepted Answer

It is an AWS managed key.. The command output shows that the key's KeyManager is 'AWS', indicating it is an AWS managed key, which corresponds to option D. Option A is incorrect because the key state is 'Enabled', not 'PendingDeletion'. Option B is incorrect because the ARN does not specify a region; the key was created in us-east-1 by default. Option C is incorrect because AWS managed keys have KeyManager set to 'AWS', not 'CUSTOMER'.

Answer

It is pending deletion.

Answer

It was created in us-west-2.

Answer

It is a customer managed key.

Question 5

A data engineer needs to ensure that all data in an S3 bucket is encrypted at rest. The bucket contains objects uploaded by various applications. What is the simplest method to enforce encryption for all new objects?

Accepted Answer

Configure an S3 bucket policy that denies PutObject requests without the x-amz-server-side-encryption header.. The simplest method to enforce encryption for all new objects is to configure an S3 bucket policy that denies PutObject requests without the x-amz-server-side-encryption header. This ensures that any upload must include the encryption header, thereby enforcing encryption at rest. While default encryption also encrypts new objects, a bucket policy provides explicit enforcement and can be used to require specific encryption types.

Answer

Enable S3 Block Public Access to block public access to the bucket.

Answer

Enable default encryption on the S3 bucket using S3-Managed Keys (SSE-S3).

Answer

Enable S3 Object Lock on the bucket.

Question 6

A company uses AWS KMS to encrypt sensitive data in S3. The security team requires that the KMS key must be rotated automatically every year. Which key type should be used?

Accepted Answer

Customer managed key with automatic rotation enabled. Only customer managed KMS keys support automatic annual rotation, which can be enabled in the key policy or via the console/API. AWS managed keys rotate automatically every three years (not one), and asymmetric keys do not support automatic rotation at all. Therefore a customer managed key with automatic rotation enabled is the correct choice to meet the one-year requirement.

Answer

Asymmetric customer managed key

Answer

AWS managed key (aws/s3)

Answer

Custom key store backed by CloudHSM

Question 7

A data engineer needs to allow a Lambda function to read data from an S3 bucket in the same account. The Lambda function's execution role has the required permissions, but access is denied. The S3 bucket has a bucket policy that explicitly denies access to any principal that is not from the organization. What is the most likely issue?

Accepted Answer

The Lambda execution role is not part of the AWS organization.. The most likely issue is that the Lambda execution role is not part of the AWS organization. The S3 bucket policy explicitly denies access to any principal that is not from the organization, so even though the execution role has the required permissions, the explicit deny in the bucket policy overrides the allow, resulting in access denied.

Answer

The Lambda function is in a VPC without an S3 VPC endpoint.

Answer

The S3 bucket is in a different AWS account.

Answer

The Lambda function does not have kms:Decrypt permission.

Question 8

A data engineer is designing a data lake on S3 that must be encrypted at rest using customer-managed keys in AWS KMS. The security team requires that the key be used only for S3 operations and that the key be rotated every 180 days. Which solution meets these requirements?

Accepted Answer

Create a customer managed key with a key policy that grants usage only to S3, and enable automatic rotation with a 180-day period.. Customer managed keys (CMKs) in AWS KMS allow you to set a key policy that restricts the key's usage to S3 operations, and you can enable automatic key rotation with a custom period of 180 days (the minimum is 90 days, but 180 is supported as a custom rotation period using AWS KMS automatic rotation or by creating a custom rotation schedule). Option B is incorrect because AWS managed keys (aws/s3) rotate automatically every year (365 days), not 180 days, and you cannot customize the rotation period. Option C is incorrect because S3 bucket policies can enforce SSE-KMS, but CloudHSM keys are not directly integrated with S3; CloudHSM is used with custom key stores, but those do not support automatic rotation. Option D is incorrect because custom key stores backed by CloudHSM do not support automatic key rotation, and manual rotation does not meet the requirement for automatic rotation every 180 days.

Answer

Use an AWS managed key (aws/s3) and enable automatic rotation.

Answer

Use an S3 bucket policy to enforce SSE-KMS with a CloudHSM key.

Answer

Use a custom key store backed by CloudHSM and rotate the key manually.

Question 9

A company wants to ensure that only encrypted connections are used when data is transferred to S3. Which policy condition should be used in an S3 bucket policy?

Accepted Answer

Condition: { Bool: { aws:SecureTransport: false } }. The [CORRECT] answer uses the aws:SecureTransport condition key with a Bool value of false inside a Deny statement, which blocks any request not made over HTTPS/TLS. AWS evaluates aws:SecureTransport as true when the request arrives via TLS and false when it arrives over plain HTTP. By denying when the value is false, the bucket policy effectively enforces encryption in transit for all S3 API operations. This is the canonical AWS-recommended pattern for enforcing TLS-only access to S3.

Answer

Condition: { Null: { s3:x-amz-server-side-encryption: true } }

Answer

Condition: { StringEquals: { s3:signatureversion: ["AWS4-HMAC-SHA256"] } }

Answer

Condition: { StringNotEquals: { aws:SourceIp: ["0.0.0.0/0"] } }

Question 10

A company is using AWS Glue to process data stored in Amazon S3. The data includes personally identifiable information (PII) that must be masked before being written to a separate output bucket. Which AWS service or feature can be used to automatically detect and mask sensitive data in the Glue ETL job?

Accepted Answer

Use Amazon Macie to identify sensitive data and apply masking logic in the Glue job.. Amazon Macie is a data security service that uses machine learning to automatically discover, classify, and protect sensitive data in S3. It can identify PII and other sensitive data. In a Glue ETL job, you can use Macie to detect sensitive data and then apply masking logic, such as using Glue's built-in transforms or custom scripts, before writing to the output bucket.

Answer

Configure CloudWatch Logs to filter and mask PII.

Answer

Use an IAM policy to restrict access to the PII columns.

Answer

Enable S3 Object Lock on the output bucket.

Question 11

A company needs to securely store and manage database credentials used by a data pipeline. Which AWS services can be used to store and rotate secrets automatically? (Choose TWO.)

Accepted Answer

AWS Systems Manager Parameter Store. AWS Secrets Manager (E) is correct because it is purpose-built to store database credentials and other secrets and provides built-in automatic rotation using Lambda rotation functions for supported databases such as Amazon RDS, Aurora, and Redshift. AWS Systems Manager Parameter Store (A) is also correct because it can store database credentials as SecureString parameters encrypted with AWS KMS, and it supports automatic rotation through scheduled Lambda functions or maintenance windows, making it suitable for managing pipeline secrets. AWS IAM (B) is not a secret store; it manages identities, roles, and policies, not arbitrary database credentials. AWS Key Management Service (C) provides encryption key management but does not itself store or rotate database credentials. AWS CloudHSM (D) offers dedicated hardware security modules for key operations but is not a secrets management or rotation service for database credentials.

Answer

AWS IAM

Answer

AWS Key Management Service (AWS KMS)

Answer

AWS CloudHSM

Question 12

A data engineer needs to ensure that an S3 bucket policy follows the principle of least privilege. Which of the following are valid conditions to restrict access based on the requester's identity? (Choose TWO.)

Accepted Answer

aws:PrincipalOrgID. Option A, aws:PrincipalOrgID, is correct because it is a global condition key that restricts access to principals belonging to a specific AWS Organizations organization ID, directly tying the grant to the requester's identity/organizational membership. Option E, aws:userId, is correct because it is a global condition key that matches the unique identifier of the IAM user making the request, which is an identity-based attribute of the requester. Option B, s3:x-amz-server-side-encryption, is not an identity condition; it constrains the encryption header the requester must supply for the object upload. Option C, aws:Referer, filters on the HTTP Referer header, which is a request-context attribute easily spoofed and not tied to identity. Option D, aws:SourceIp, restricts by the originating IP address of the request, which is a network-location condition rather than the requester's identity.

Answer

s3:x-amz-server-side-encryption

Answer

aws:Referer

Answer

aws:SourceIp

Question 13

Refer to the exhibit. An S3 bucket policy is shown. A data engineer using the DataEngineerRole tries to upload an object to s3://example-bucket/data/report.csv with SSE-S3 encryption. The upload fails. What is the most likely cause?

Accepted Answer

The condition requires SSE-S3 encryption header, but the upload did not include it.. The bucket policy includes a condition that the request must include the `x-amz-server-side-encryption` header with value `AES256` (SSE-S3). The upload did not include this header, so the policy condition was not met, resulting in a failed upload. Option A is incorrect because the resource ARN matches the object path. Option B is incorrect because the role has the `s3:PutObject` permission. Option D is incorrect because the principal (DataEngineerRole) is allowed by the policy.

Answer

The resource ARN does not match the object.

Answer

The role does not have s3:PutObject permission.

Answer

The principal is not authorized.

Question 14

A data engineer needs to ensure that an S3 bucket containing sensitive customer data is encrypted at rest. The company requires that all encryption keys be managed by AWS and rotated annually. Which encryption option meets these requirements?

Accepted Answer

Use server-side encryption with S3-managed keys (SSE-S3). SSE-S3 uses AWS-managed keys and automatically handles annual key rotation, meeting both requirements of encryption at rest and AWS-managed keys with rotation. SSE-KMS also uses AWS-managed keys but does not automatically rotate keys (unless using a custom KMS key with rotation enabled, but the question implies automatic rotation without extra configuration). SSE-C requires customer-provided keys, which violates the requirement that AWS manages the keys. Client-side encryption (B) is not server-side and also involves customer management. Thus, only SSE-S3 fully satisfies the requirements.

Answer

Use server-side encryption with AWS KMS (SSE-KMS)

Answer

Use client-side encryption with AWS KMS

Answer

Use server-side encryption with customer-provided keys (SSE-C)

Question 15

A company needs to audit access to their Amazon S3 buckets. Which TWO services can be used together to achieve this? (Choose two.)

Accepted Answer

Amazon CloudWatch Logs. AWS CloudTrail (E) is correct because it records S3 data events (GetObject, PutObject, DeleteObject) and management events, providing the detailed API-level audit trail of who accessed which bucket and when. Amazon CloudWatch Logs (C) is correct because CloudTrail can deliver its event logs to a CloudWatch Logs log group, where you can retain, query with CloudWatch Logs Insights, and set metric filters/alarms for auditing and alerting on access patterns. Together they form the standard S3 access-auditing solution: CloudTrail captures the access events and CloudWatch Logs centralizes and analyzes them. Amazon Macie (A) is a data-security service that discovers and classifies sensitive data, not an access-auditing service. Amazon S3 Inventory (B) produces scheduled reports of object metadata and encryption/status, not access events. AWS Config (D) tracks resource configuration changes and compliance, not individual object access requests.

Answer

Amazon Macie

Answer

Amazon S3 Inventory

Answer

AWS Config