DEA-C01 Data Security and Governance Practice Question
A company wants to implement least privilege access for its data lake on S3. Which THREE practices should be followed? (Choose THREE.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use S3 bucket policies for cross-account access
Option B is correct because S3 bucket policies are resource-based policies that explicitly define which principals (including cross-account identities) may perform which s3: actions on the bucket, allowing tightly scoped cross-account access instead of broad grants. Option C is correct because S3 access points provide dedicated endpoints with their own access point policies and can be restricted to a VPC via network origin controls, enforcing network-level least privilege for data lake access. Option E is correct because IAM policies attached to users and roles grant only the specific S3 actions and resources needed, which is the core mechanism for implementing least privilege. Option A is incorrect because granting s3:* violates least privilege by allowing all S3 operations. Option D is incorrect because disabling S3 Block Public Access increases exposure risk and does not support least privilege.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Grant s3:* to all users for simplicity
Why it's wrong here
Granting s3:* to all users gives every principal full control over every bucket and object, violating least privilege outright. It is tempting during initial setup or troubleshooting, where broad permissions quickly unblock development, but production data lakes require scoped actions per role, such as read-only for analysts and write-only for ingestion pipelines.
- ✓
Use S3 bucket policies for cross-account access
Why this is correct
S3 bucket policies are resource-based and evaluate the bucket owner's permissions, so they grant cross-account principals access without sharing long-lived IAM credentials. This satisfies least privilege by scoping access to specific buckets or prefixes, and by letting the data lake owner retain control over who may read or write.
- ✓
Use S3 access points to enforce network policies
Why this is correct
S3 access points provide dedicated hostnames with their own resource policies, letting you restrict each application's access to a specific prefix and enforce network controls such as VPC endpoints. This satisfies least privilege by scoping permissions per workload rather than granting broad bucket-wide access through a single shared policy.
- ✗
Disable S3 Block Public Access to allow flexibility
Why it's wrong here
Disabling Block Public Access removes the account-level and bucket-level guardrails that prevent accidental public exposure, directly contradicting least privilege. It is tempting because temporarily disabling it can help diagnose access-denied errors, but least privilege requires keeping it enabled and scoping access through bucket policies and IAM.
- ✓
Use IAM policies to grant specific permissions to users and roles
Why this is correct
IAM policies granting specific, scoped permissions to users and roles directly enforce least privilege on the S3 data lake, satisfying the stem's constraint by limiting each principal to only the actions and resources it requires. Wildcard or broad permissions are avoided, so access is minimised per identity rather than granted wholesale.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 1,321 original DEA-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DEA-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DEA-C01 exam.