DEA-C01 Data Security and Governance — Timed 25 Questions

Question 1

A data engineer needs to ensure that an Amazon S3 bucket used for sensitive data is encrypted at rest using a customer-managed AWS KMS key. The bucket policy must enforce encryption for all PUT requests. Which policy statement should be added to the bucket policy?

25 minute time limit — choose an answer to begin.

Accepted Answer

{"Effect":"Deny","Principal":"*","Action":"s3:PutObject","Resource":"arn:aws:s3:::bucket/*","Condition":{"StringNotEquals":{"s3:x-amz-server-side-encryption":"aws:kms"},"Null":{"s3:x-amz-server-side-encryption-aws-kms-key-id":"true"}}}. It uses a Deny effect with a condition that blocks PUT requests unless the encryption header specifies 'aws:kms' (SSE-KMS) AND the KMS key ID matches the required customer-managed key. The combination of StringNotEquals on the encryption type and Null on the key ID ensures that any request not using the specified KMS key is denied, enforcing both encryption at rest and the use of the customer-managed key.

Answer

{"Effect":"Deny","Principal":"*","Action":"s3:PutObject","Resource":"arn:aws:s3:::bucket/*","Condition":{"Null":{"s3:x-amz-server-side-encryption":"true"}}}

Answer

{"Effect":"Allow","Principal":"*","Action":"s3:PutObject","Resource":"arn:aws:s3:::bucket/*","Condition":{"StringEquals":{"s3:x-amz-server-side-encryption-aws-kms-key-id":"arn:aws:kms:us-east-1:123456789012:key/abc123"}}}

Answer

{"Effect":"Deny","Principal":"*","Action":"s3:PutObject","Resource":"arn:aws:s3:::bucket/*","Condition":{"StringNotEquals":{"s3:x-amz-server-side-encryption-aws-kms-key-id":"arn:aws:kms:us-east-1:123456789012:key/abc123"}}}

Question 2

A data engineer is troubleshooting an AWS Lake Formation permissions issue. A user is able to query an Amazon Athena table but cannot see the underlying S3 data in the AWS Glue Data Catalog. The user has been granted SELECT permission on the table in Lake Formation. What is the most likely cause?

Accepted Answer

The user does not have DESCRIBE permission on the table in Lake Formation.. In AWS Lake Formation, the ability to query a table via Athena (which requires SELECT permission) is separate from the ability to view the table's metadata in the Glue Data Catalog. To see the underlying S3 data location or table properties in the catalog, a user needs DESCRIBE permission on the table. Without DESCRIBE, the table appears invisible in the Glue console or API, even though SELECT queries succeed.

Answer

The data location is not registered with Lake Formation.

Answer

The S3 bucket policy does not grant the user access.

Answer

The user does not have the aws:SourceArn condition in the IAM policy.

Question 3

A company is designing a data lake on Amazon S3. The security policy requires that all data be encrypted at rest using AWS KMS with automatic key rotation. Which encryption option meets these requirements? (Select THREE.)

Accepted Answer

Enable automatic key rotation on the KMS key.. Option A is correct because AWS KMS automatic key rotation is a property you enable on the KMS key itself, rotating the backing key material every year (or a custom period of 90–2560 days), which satisfies the policy's rotation requirement. Option C is correct because configuring the S3 bucket's default encryption to SSE-KMS with the CMK ensures every new object is automatically encrypted at rest with that KMS key without relying on per-request headers. Option D is correct because SSE-KMS with a customer-managed key (CMK) is required to have a KMS key you control and can configure for automatic rotation, unlike AWS managed keys. Option B is not correct because AWS managed keys (aws/s3) cannot have automatic key rotation enabled or configured, so they fail the rotation requirement. Option E is not correct because SSE-C uses a customer-provided key managed outside AWS KMS, so it does not use AWS KMS or support KMS automatic key rotation.

Answer

Use SSE-KMS with an AWS managed key.

Answer

Use SSE-C with a customer-provided key.

Question 4

Refer to the exhibit. A data engineer is running an AWS Glue job that reads from an S3 bucket encrypted with a customer-managed KMS key. The job fails with the error shown. What is the most likely cause?

Accepted Answer

The IAM role used by the Glue job is missing the kms:Decrypt permission.. The error indicates that the AWS Glue job cannot access the S3 bucket because it lacks the necessary KMS permissions. Since the bucket is encrypted with a customer-managed KMS key, the IAM role assigned to the Glue job must include the kms:Decrypt permission to read the encrypted objects. Without this permission, the job fails when attempting to decrypt the data.

Answer

The S3 bucket policy denies the kms:Decrypt action.

Answer

The Glue job does not have permission to call kms:GenerateDataKey.

Answer

The KMS key policy does not grant the Glue service principal access.

Question 5

Refer to the exhibit. A security analyst is reviewing CloudTrail logs and notices a PutObject event to the 'company-data-lake' bucket. The bucket policy requires all objects to be encrypted with SSE-KMS. What should the analyst conclude?

Accepted Answer

The object was encrypted with SSE-S3, which violates the bucket policy.. The bucket policy requires all objects to be encrypted with SSE-KMS. The CloudTrail log shows a PutObject event, but the encryption context (not shown in the exhibit) would indicate the encryption method used. Since the correct answer states the object was encrypted with SSE-S3, this violates the bucket policy, which mandates SSE-KMS. Therefore, the analyst should conclude that the request succeeded but violated the policy, as SSE-S3 does not meet the requirement.

Answer

The object was uploaded by the bucket owner, bypassing the policy.

Answer

The request succeeded because SSE-S3 is acceptable.

Answer

The object was encrypted with SSE-KMS as required.

Question 6

A company is using Amazon Redshift Spectrum to query data in Amazon S3. The S3 bucket uses SSE-KMS encryption. The Redshift cluster has an IAM role that allows access to S3 and KMS. However, queries fail with an 'Access Denied' error. What is the most likely cause?

Accepted Answer

The external schema does not have the IAM role specified.. When using Redshift Spectrum with SSE-KMS encrypted data in S3, the IAM role must be explicitly associated with the external schema via the `CREATE EXTERNAL SCHEMA` command using the `IAM_ROLE` parameter. Even if the cluster has the IAM role attached, Spectrum queries fail with 'Access Denied' if the role is not specified at the schema level, because Redshift needs to pass that role to S3 and KMS for each query execution. Option B correctly identifies this missing configuration as the most likely cause.

Answer

The Redshift cluster does not have the IAM role attached.

Answer

The IAM role does not have the kms:Decrypt permission.

Answer

The external table is not defined in the schema.

Question 7

A financial services company uses AWS KMS to encrypt data in Amazon S3. The compliance team requires that all encryption keys be rotated automatically every 365 days. The data engineer needs to implement this requirement without manual intervention. Which solution meets the requirement with the LEAST operational overhead?

Accepted Answer

Use the AWS managed key for Amazon S3 (aws/s3) for server-side encryption.. The AWS managed key for Amazon S3 (aws/s3) is automatically rotated by AWS every 365 days (or less) with no configuration or maintenance required. This satisfies the compliance requirement with zero operational overhead, as the rotation is handled entirely by the AWS KMS service without any manual intervention or custom automation.

Answer

Create a customer managed key (CMK) in KMS with automatic rotation enabled every 365 days. Use this CMK to encrypt S3 objects.

Answer

Create a customer managed key with imported key material and configure a Lambda function to rotate the key every 365 days.

Answer

Use S3 server-side encryption with S3 managed keys (SSE-S3).

Question 8

Refer to the exhibit. A data engineer is troubleshooting a permissions issue. The IAM role 'DataEngineerRole' is used by an AWS Glue job that needs to read data from an S3 bucket encrypted with a customer managed KMS key. The above key policy is attached to the KMS key. The Glue job fails with an AccessDenied error when trying to read the data. What is the MOST likely cause?

Accepted Answer

The key policy condition 'kms:ViaService' restricts KMS actions to only when they are made through S3, but AWS Glue calls KMS directly, not via S3.. The key policy includes a condition `kms:ViaService` that restricts KMS actions to only when they are made through the S3 service. However, AWS Glue does not call KMS via S3; it calls KMS directly to decrypt the S3 object's data key. Because the Glue job's KMS request does not originate from the S3 service, the condition fails, resulting in an AccessDenied error.

Answer

The key policy requires requests to originate from a VPC endpoint, but the Glue job is not using one.

Answer

The key policy denies requests that are not using HTTPS, but the Glue job is using HTTPS.

Answer

The Glue job is running in a different AWS region than the S3 bucket.

Question 9

A data engineer is designing a data lake on Amazon S3 with AWS Lake Formation. The data lake contains personally identifiable information (PII). The company has a policy that only users who have completed data privacy training can access the PII data. The training status is stored in an external identity provider (IdP) as an attribute. The data engineer needs to enforce this policy using Lake Formation. Which THREE steps should the data engineer take? (Choose THREE.)

Accepted Answer

Create an LF-tag called 'trainingCompleted' with values 'true' and 'false'. Grant 'SELECT' permission on the LF-tag 'trainingCompleted=true' to the federated users.. LF-tags allow Lake Formation to manage access based on metadata attributes. By creating an LF-tag 'trainingCompleted' with values 'true' and 'false', and granting SELECT permission on the tag value 'true' to federated users, the data engineer can enforce that only users with the training attribute can access the tagged resources. This approach decouples access control from IAM roles and leverages tag-based authorization, which is the recommended method for attribute-based access control (ABAC) in Lake Formation.

Answer

Create a column-level filter on the PII columns that limits access based on the user's training attribute.

Answer

Create an IAM role for each user and attach a policy that allows 'lakeformation:GetDataAccess' only if the user has the training attribute.

Question 10

A healthcare company uses AWS Glue to process patient data stored in Amazon S3. The data is encrypted at rest using SSE-KMS with a customer managed key. The Glue ETL job runs on a schedule and reads from an S3 bucket, transforms the data, and writes to another S3 bucket also encrypted with the same KMS key. Recently, the security team rotated the KMS key. After the rotation, the Glue job started failing with 'AccessDenied' errors when trying to read from the source bucket. The Glue job's IAM role has permissions to use the KMS key (kms:Decrypt, kms:GenerateDataKey). The S3 bucket policies allow the role to read/write. What is the MOST likely cause of the failure?

Accepted Answer

The KMS key rotation created a new backing key, but the Glue job's IAM role does not have permission to decrypt with the old backing key.. When you rotate a customer managed KMS key, AWS KMS retains the old backing key to allow decryption of data encrypted before the rotation. However, the Glue job's IAM role must have permission to use the old backing key via the kms:Decrypt action. If the key policy or IAM policy does not explicitly allow decryption with the old backing key (or if the key policy was inadvertently updated to remove access to the old key material), the Glue job will fail with AccessDenied when reading SSE-KMS encrypted objects that were encrypted with the previous key version.

Answer

The Glue job's IAM role is missing the kms:Encrypt permission on the KMS key.

Answer

The Glue job is using the wrong encryption context when calling KMS.

Answer

The S3 bucket policy has a condition that requires the request to use the latest version of the KMS key.

Question 11

Refer to the exhibit. A data engineer applies this bucket policy to an S3 bucket named my-data-bucket. The bucket contains sensitive data. The company's security team reports that data was accessed from an IP address outside the allowed range. What is the MOST likely reason that the policy failed to block the unauthorized access?

Accepted Answer

The Deny statement does not restrict access based on IP address; it only denies non-HTTPS requests.. The Deny statement in the policy only denies requests that are not using HTTPS (SecureTransport: false). It does not include any condition to restrict access based on IP address. Therefore, a request made from an IP outside the allowed range but using HTTPS would not be denied by this policy, allowing unauthorized access to the sensitive data.

Answer

The Deny statement's condition on SecureTransport overrides the IP condition.

Answer

The policy has a syntax error in the Condition element.

Answer

The bucket policy does not apply to requests made from within the same AWS account.

Question 12

A financial services company uses AWS Glue ETL jobs to process credit card transaction data stored in Amazon S3. The data includes PII such as names and credit card numbers. The security team requires that all PII be masked before the data is written to the curated zone of the data lake. The data engineer has implemented a Glue job that reads from the raw zone, applies a custom transform to mask credit card numbers using a regular expression, and writes to the curated zone. However, during a recent audit, the security team discovered that some masked data still contained partial credit card numbers (e.g., showing the last four digits) when viewed by analysts who should only see masked data. The company's policy is that credit card numbers must be completely masked, showing only asterisks or a fixed string like "XXXX-XXXX-XXXX-XXXX". The Glue job uses a DynamicFrame and applies a Map transform with a Python function that replaces digits with 'X'. The data is stored in Parquet format. What should the data engineer do to ensure complete masking of credit card numbers?

Accepted Answer

Replace the custom Python Map transform with a built-in Glue Transform for data masking, such as the Mask transform available in Glue Studio.. AWS Glue provides a built-in Mask transform that can be applied directly in Glue Studio or via the AWS Glue API. This transform is designed to reliably obfuscate sensitive data like credit card numbers by replacing them with a fixed string (e.g., 'XXXX-XXXX-XXXX-XXXX') or asterisks, ensuring complete masking regardless of input format. The custom Python Map transform in the current implementation is error-prone because it relies on a regular expression that may not catch all patterns or partial digits, whereas the Mask transform uses predefined logic to guarantee full masking.

Answer

Use an AWS Glue crawler to classify the data and apply a masking rule based on the classification.

Answer

Enable server-side encryption with AWS KMS on the curated S3 bucket.

Answer

Change the output format from Parquet to CSV and use a different write mode.

Question 13

Match each AWS networking concept to its definition.

Accepted Answer

VPC: A virtual network dedicated to your AWS account.. Networking fundamentals for AWS: VPC is a virtual network, subnets are subdivisions, security groups are instance-level firewalls, and NACLs are subnet-level stateless firewalls.

Answer

Security Group: A stateless firewall that controls traffic at the subnet level.

Answer

NACL: A virtual firewall that controls traffic at the instance level.

Question 14

A data engineer is configuring S3 bucket policies to restrict access to a specific VPC. Which condition key should be used in the bucket policy to enforce that requests originate only from the desired VPC?

Accepted Answer

aws:SourceVpc. The aws:SourceVpc condition key evaluates the VPC ID from which the request originates (via an S3 VPC endpoint), making it the correct key to enforce that requests come only from a specific VPC. It works in conjunction with a VPC endpoint policy and is evaluated based on the endpoint ID through which the request traverses. This is the standard mechanism for restricting S3 bucket access to a designated VPC.

Answer

aws:VpcSourceIp

Answer

aws:RequestedRegion

Answer

aws:SourceIp

Question 15

A company stores sensitive data in S3 and uses VPC endpoints to access the bucket. They need to ensure that only traffic from their VPC can access the data, and that the traffic cannot leave the AWS network. Which combination of bucket policy and endpoint policy should they use?

Accepted Answer

Use an S3 VPC Gateway endpoint and add a bucket policy with aws:SourceVpc condition. Using an S3 VPC Gateway endpoint with a bucket policy that includes the aws:SourceVpc condition restricts access to traffic originating from the specified VPC, and Gateway endpoints use AWS private network, ensuring traffic does not leave the AWS network. Option A is incorrect because aws:SourceIp checks IP addresses, not VPC origin, so it cannot enforce VPC-only access. Option C is incorrect because VPC Interface endpoints, while private, rely on aws:SourceVpce condition which checks the specific endpoint ID rather than the VPC; the requirement is to restrict to the entire VPC. Option D is incorrect because without any bucket policy, the bucket would be publicly accessible or accessible to any authenticated user, failing to restrict to the VPC.

Answer

Use only a bucket policy with aws:SourceIp condition

Answer

Use an S3 VPC Interface endpoint and add a bucket policy with aws:SourceVpce condition

Answer

Use an S3 VPC Gateway endpoint with no bucket policy

Question 16

A data engineer needs to ensure that an S3 bucket is not publicly accessible. Which S3 block public access setting should be applied to achieve this?

Accepted Answer

BlockPublicPolicy. The S3 Block Public Access feature includes four settings: BlockPublicAcls, IgnorePublicAcls, BlockPublicPolicy, and RestrictPublicBuckets. To prevent a bucket from being publicly accessible via bucket policies, BlockPublicPolicy must be enabled. This setting blocks public bucket policies that grant access to the bucket.

Answer

BlockPublicAcls (both new and existing)

Answer

IgnorePublicAcls

Answer

BlockPublicAcls (new ACLs)

Question 17

A data engineer is designing a data pipeline that processes PII data in AWS Glue. They need to ensure data is encrypted at rest and in transit. Which TWO actions should they take? (Choose TWO.)

Accepted Answer

Configure S3 bucket server-side encryption for job output. Option B is correct because AWS Glue writes job output to Amazon S3, and configuring S3 server-side encryption (SSE-S3, SSE-KMS, or SSE-C) ensures that the resulting data is encrypted at rest, satisfying the at-rest requirement for pipeline output. Option E is correct because enabling encryption at rest for the AWS Glue Data Catalog protects the metadata (table definitions, schemas, partition info) stored in the catalog using a KMS key, which is a required part of securing the Glue environment for PII workloads. Option A is wrong because disabling SSL would remove encryption in transit, directly violating the requirement. Option C is wrong because Glue job bookmarks store state information and are not the mechanism for encrypting PII data at rest or in transit. Option D is wrong because CloudWatch Logs is a logging service and does not provide the encryption-at-rest/in-transit guarantee for the Glue pipeline data itself.

Answer

Disable SSL for Glue connections

Answer

Use a KMS key for Glue job bookmarks

Answer

Use CloudWatch Logs for encryption

Question 18

Refer to the exhibit. A data engineer attached this S3 bucket policy to the bucket 'example-bucket'. What is the effect of this policy?

Accepted Answer

It denies PutObject requests that do not use SSE-S3. The bucket policy denies PutObject requests that do not include the x-amz-server-side-encryption header with value AES256 (SSE-S3). This means any PutObject request without SSE-S3 encryption is denied. Therefore, the correct answer is B.

Answer

It allows all PutObject requests that do not use encryption

Answer

It denies all PutObject requests unless they use SSE-KMS

Answer

It denies all PutObject requests from anonymous users

Question 19

Refer to the exhibit. The exhibit shows output from AWS CLI commands. Which key can be used to enable automatic annual rotation?

Accepted Answer

The first key (1234abcd-...). (the first key) is correct because automatic annual rotation is only configurable for customer managed keys. The first key is customer managed, allowing the user to enable or disable automatic rotation with a specified frequency (e.g., annually). The second key is AWS managed, which rotates automatically every three years without user configuration, so its rotation cannot be enabled or disabled by the user. Options A and B are incorrect because the second key (AWS managed) does not support user-controlled automatic rotation, and both keys cannot have rotation configured independently. Option C is incorrect because the first key (customer managed) does support automatic annual rotation.

Answer

The second key (5678efgh-...)

Answer

Both keys

Answer

Neither key

Question 20

Refer to the exhibit. An IAM policy includes this statement. What access does it grant?

Accepted Answer

It allows GetObject access to the bucket only from IP addresses in 10.0.0.0/8. The IAM policy statement (not shown but implied) likely has an Effect of Allow, Action of s3:GetObject, Resource of the bucket, and a Condition with aws:SourceIp of 10.0.0.0/8. Therefore, it allows GetObject access only from IP addresses in that range. Option D correctly describes this.

Answer

It denies GetObject access to the bucket from IP addresses in 10.0.0.0/8

Answer

It allows GetObject access to the bucket only from a specific VPC

Answer

It allows PutObject access to the bucket from any IP address