20+ practice questions focused on Data Security and Governance — one of the most tested topics on the AWS Certified Data Engineer Associate DEA-C01 exam. Each question includes a detailed explanation so you learn why the right answer is correct.
Start Data Security and Governance PracticeA data engineer needs to ensure that all data in an S3 bucket is encrypted at rest. The bucket currently contains unencrypted objects from past uploads. Which action will encrypt these existing objects without re-uploading them?
Explanation: S3 Batch Operations can apply server-side encryption to existing objects in a bucket, including those that are currently unencrypted. Option A is incorrect because a bucket policy can require encryption for new uploads but does not retroactively encrypt existing objects. Option B is incorrect because default encryption only applies to new objects uploaded after the setting is enabled. Option C is incorrect because the S3 console does not provide a built-in feature to batch-encrypt existing objects across a bucket.
A company needs to share a dataset stored in an S3 bucket with a partner account. The dataset contains sensitive information, so the company wants to ensure that the partner account can only access the data using a specific VPC endpoint in the partner's account. Which S3 bucket policy condition key should be used?
Explanation: The aws:SourceVpce condition key restricts access to a specific VPC endpoint, ensuring the partner can only access the data through that endpoint. Option A is wrong because aws:SourceVpc restricts to a VPC, not a VPC endpoint. Option B is wrong because aws:SourceArn restricts to a resource ARN, not a network endpoint. Option C is wrong because aws:SourceIp restricts to an IP address, which does not meet the requirement.
A data engineer needs to share a dataset from an S3 bucket in Account A with another AWS account (Account B). The data must remain encrypted at rest with KMS. Which steps are required?
Explanation: The correct steps are to update both the S3 bucket policy to grant Account B access to the objects and the KMS key policy to grant Account B the necessary decrypt permissions. Option A is insufficient because it only updates the KMS key policy; the bucket policy must also be updated to allow Account B's access to the S3 objects. Option B is also insufficient because creating an IAM role alone does not grant KMS decrypt permissions; the KMS key policy must be updated. Option C is correct as it includes both. Option D is insufficient because it only updates the bucket policy, not the KMS key policy.
A company has a requirement to store audit logs for 7 years for compliance. The logs are stored in S3 and must be immutable. Which S3 feature should be used?
Explanation: S3 Object Lock in compliance mode prevents objects from being deleted or overwritten for a specified retention period, ensuring immutability for compliance. Option A is wrong because a bucket policy denying s3:DeleteObject does not prevent overwrites or other actions that could modify the object. Option B is wrong because MFA Delete adds a protection layer but can be bypassed by the root user and does not prevent overwrites. Option C is wrong because versioning and lifecycle policies do not inherently prevent deletion or overwrite of all versions; they only manage object versions and transitions. Option D is correct.
A company is using AWS Glue to process data stored in an S3 bucket that is encrypted with SSE-KMS. The Glue job fails with an 'Access Denied' error when trying to read the data. The IAM role used by the Glue job has permissions to read from the S3 bucket and to use the KMS key. What is the most likely cause of the failure?
Explanation: Although the IAM role has permissions to read from the S3 bucket and to use the KMS key, the S3 bucket policy might explicitly deny access to the Glue job. Bucket policies can override IAM permissions. The 'Access Denied' error often occurs when a bucket policy denies access even if the IAM role is authorized. Option A is incorrect because the bucket uses SSE-KMS as stated. Option C is possible but not necessarily the most likely without cross-account context. Option D is incorrect because the premise states the role has permissions to use the KMS key, which includes kms:Decrypt.
+15 more Data Security and Governance questions available
Practice all Data Security and Governance questions1. Baseline your knowledge
Start with 10 questions to gauge your current understanding of Data Security and Governance. This tells you whether you need a concept refresher or just practice.
2. Review every explanation
For each question — right or wrong — read the full explanation. Understanding why an answer is correct is more valuable than knowing the answer itself.
3. Focus on exam traps
Data Security and Governance questions on the DEA-C01 frequently use trap wording. Look for subtle differences in answers that test your precision, not just general knowledge.
4. Reach 80% consistently
Do repeated sessions until you score 80%+ three times in a row. Then move to mixed-mode practice to test cross-topic recall under realistic conditions.
The exact number varies per candidate. Data Security and Governance is tested as part of the AWS Certified Data Engineer Associate DEA-C01 blueprint. Practicing with targeted Data Security and Governance questions ensures you can handle any format or difficulty that appears.
Yes. Courseiva provides free DEA-C01 practice questions across all exam topics and domains. The platform includes topic-based practice, mock exams, missed-question review, bookmarked questions, and readiness tracking — no account required.
Difficulty is subjective, but Data Security and Governance is a high-priority exam concept tested in multiple ways — direct recall, scenario analysis, and command-output interpretation. Consistent practice is the best way to build confidence.
Launch a full Data Security and Governance practice session with instant scoring and detailed explanations.
Start Data Security and Governance Practice →