20+ practice questions focused on Data Security and Governance — one of the most tested topics on the AWS Certified Data Engineer Associate DEA-C01 exam. Each question includes a detailed explanation so you learn why the right answer is correct.
Start Data Security and Governance PracticeA data engineer needs to ensure that an Amazon S3 bucket used for sensitive data is encrypted at rest using a customer-managed AWS KMS key. The bucket policy must enforce encryption for all PUT requests. Which policy statement should be added to the bucket policy?
Explanation: It uses a Deny effect with a condition that blocks PUT requests unless the encryption header specifies 'aws:kms' (SSE-KMS) AND the KMS key ID matches the required customer-managed key. The combination of StringNotEquals on the encryption type and Null on the key ID ensures that any request not using the specified KMS key is denied, enforcing both encryption at rest and the use of the customer-managed key.
A data engineer is troubleshooting an AWS Lake Formation permissions issue. A user is able to query an Amazon Athena table but cannot see the underlying S3 data in the AWS Glue Data Catalog. The user has been granted SELECT permission on the table in Lake Formation. What is the most likely cause?
Explanation: In AWS Lake Formation, the ability to query a table via Athena (which requires SELECT permission) is separate from the ability to view the table's metadata in the Glue Data Catalog. To see the underlying S3 data location or table properties in the catalog, a user needs DESCRIBE permission on the table. Without DESCRIBE, the table appears invisible in the Glue console or API, even though SELECT queries succeed.
A company is designing a data lake on Amazon S3. The security policy requires that all data be encrypted at rest using AWS KMS with automatic key rotation. Which encryption option meets these requirements? (Select THREE.)
Explanation: Option A is correct because AWS KMS automatic key rotation is a property you enable on the KMS key itself, rotating the backing key material every year (or a custom period of 90–2560 days), which satisfies the policy's rotation requirement. Option C is correct because configuring the S3 bucket's default encryption to SSE-KMS with the CMK ensures every new object is automatically encrypted at rest with that KMS key without relying on per-request headers. Option D is correct because SSE-KMS with a customer-managed key (CMK) is required to have a KMS key you control and can configure for automatic rotation, unlike AWS managed keys. Option B is not correct because AWS managed keys (aws/s3) cannot have automatic key rotation enabled or configured, so they fail the rotation requirement. Option E is not correct because SSE-C uses a customer-provided key managed outside AWS KMS, so it does not use AWS KMS or support KMS automatic key rotation.
Refer to the exhibit. A data engineer is running an AWS Glue job that reads from an S3 bucket encrypted with a customer-managed KMS key. The job fails with the error shown. What is the most likely cause?
Explanation: The error indicates that the AWS Glue job cannot access the S3 bucket because it lacks the necessary KMS permissions. Since the bucket is encrypted with a customer-managed KMS key, the IAM role assigned to the Glue job must include the kms:Decrypt permission to read the encrypted objects. Without this permission, the job fails when attempting to decrypt the data.
Refer to the exhibit. A security analyst is reviewing CloudTrail logs and notices a PutObject event to the 'company-data-lake' bucket. The bucket policy requires all objects to be encrypted with SSE-KMS. What should the analyst conclude?
Explanation: The bucket policy requires all objects to be encrypted with SSE-KMS. The CloudTrail log shows a PutObject event, but the encryption context (not shown in the exhibit) would indicate the encryption method used. Since the correct answer states the object was encrypted with SSE-S3, this violates the bucket policy, which mandates SSE-KMS. Therefore, the analyst should conclude that the request succeeded but violated the policy, as SSE-S3 does not meet the requirement.
+15 more Data Security and Governance questions available
Practice all Data Security and Governance questions1. Baseline your knowledge
Start with 10 questions to gauge your current understanding of Data Security and Governance. This tells you whether you need a concept refresher or just practice.
2. Review every explanation
For each question — right or wrong — read the full explanation. Understanding why an answer is correct is more valuable than knowing the answer itself.
3. Focus on exam traps
Data Security and Governance questions on the DEA-C01 frequently use trap wording. Look for subtle differences in answers that test your precision, not just general knowledge.
4. Reach 80% consistently
Do repeated sessions until you score 80%+ three times in a row. Then move to mixed-mode practice to test cross-topic recall under realistic conditions.
The exact number varies per candidate. Data Security and Governance is tested as part of the AWS Certified Data Engineer Associate DEA-C01 blueprint. Practicing with targeted Data Security and Governance questions ensures you can handle any format or difficulty that appears.
Yes. Courseiva provides free DEA-C01 practice questions across all exam topics and domains. The platform includes topic-based practice, mock exams, missed-question review, bookmarked questions, and readiness tracking — no account required.
Difficulty is subjective, but Data Security and Governance is a high-priority exam concept tested in multiple ways — direct recall, scenario analysis, and command-output interpretation. Consistent practice is the best way to build confidence.
Launch a full Data Security and Governance practice session with instant scoring and detailed explanations.
Start Data Security and Governance Practice →