DEA-C01 Data Security and Governance Practice Question
A data engineer maintains an AWS Glue Data Catalog with databases for several lines of business. Auditors require that every change to table definitions, partition additions, and schema edits in the catalog be recorded with the identity of the caller and that the records be retained for 365 days in a dedicated S3 bucket. Which solution should the data engineer implement?
⚠ Common exam trap
Watch out — candidates often confuse CloudTrail data events with management events, when Data Catalog changes are management events and are not captured by enabling data events.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure an AWS CloudTrail trail that logs management events, including AWS Glue Data Catalog API calls, and deliver the trail to the dedicated S3 bucket with a 365-day lifecycle rule.
AWS Glue Data Catalog mutations such as CreateTable, UpdateTable, and BatchCreatePartition are management events, and a CloudTrail trail that logs management events records the caller identity and request details for each. Delivering that trail to a dedicated S3 bucket with a 365-day lifecycle rule satisfies both the identity-capture and retention requirements, whereas data events, job logs, and AWS Config do not cover these catalog operations.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable AWS Glue job metrics and continuous logging, then export the logs to Amazon CloudWatch Logs with a retention period of 365 days.
Why it's wrong here
Glue job metrics and continuous logging describe ETL job execution, not Data Catalog mutations. They would not record who called CreateTable or UpdateTable, and CloudWatch Logs retention is capped below the 365-day requirement for log groups in many configurations, so this does not satisfy the audit scope or retention.
- ✓
Configure an AWS CloudTrail trail that logs management events, including AWS Glue Data Catalog API calls, and deliver the trail to the dedicated S3 bucket with a 365-day lifecycle rule.
Why this is correct
Data Catalog operations such as CreateTable, UpdateTable, and BatchCreatePartition are management events recorded by CloudTrail. A trail that logs management events captures the caller identity and request details, and delivering to a dedicated S3 bucket with a 365-day lifecycle rule meets the retention requirement for auditors.
- ✗
Turn on AWS Config recording for the AWS::Glue::Table resource type and store configuration snapshots in the dedicated S3 bucket for 365 days.
Why it's wrong here
AWS Config does not provide a configuration item type for Glue Data Catalog tables, so recording AWS::Glue::Table is not supported. Even where Config tracks related resources, it records configuration state changes rather than the calling identity for each catalog API call, which is what the auditors require.
- ✗
Enable AWS CloudTrail data events for the AWS Glue Data Catalog and deliver the logs to the dedicated S3 bucket with a 365-day lifecycle retention policy.
Why it's wrong here
CloudTrail data events cover data-plane operations on resources such as S3 objects and Lambda invocations, but Data Catalog changes like CreateTable and UpdateTable are management events. Enabling data events would not capture catalog changes, so the audit requirement for table and partition modifications would be unmet.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 1,321 original DEA-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This DEA-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DEA-C01 exam.