Courseiva

CCNA Data Security and Governance Questions

75 of 318 questions · Page 1/5 · Data Security and Governance · Answers revealed

Practice these questionsDomain overviewAll questions
1
Multi-Selectmedium

A data engineer needs to securely store database credentials used by an AWS Glue ETL job. Which THREE steps should the engineer take?

Select 3 answers
A.Hardcode the credentials in the Glue job script.
B.Store the credentials in AWS Secrets Manager.
C.Grant the Glue job's IAM role permission to read the secret.
D.Configure the Glue job to use the Secrets Manager connector to retrieve credentials.
E.Use AWS Systems Manager Parameter Store with a SecureString parameter.
AnswersB, C, D

Secrets Manager provides secure storage and rotation.

Why this answer

Options B, C, and D are correct. AWS Secrets Manager securely stores credentials with automatic rotation. The Glue job's IAM role must have permission to read the secret (C), and the job uses the Secrets Manager connector to retrieve credentials (D).

Option A is incorrect because hardcoding credentials is insecure and violates best practices. Option E is incorrect because while Parameter Store can store secrets, Secrets Manager is the recommended service for managing database credentials due to its built-in rotation and tighter integration with Glue.

Practice this question →
2
MCQhard

Refer to the exhibit. A data engineer is troubleshooting a permissions issue. The IAM role 'DataEngineerRole' is used by an AWS Glue job that needs to read data from an S3 bucket encrypted with a customer managed KMS key. The above key policy is attached to the KMS key. The Glue job fails with an AccessDenied error when trying to read the data. What is the MOST likely cause?

A.The key policy requires requests to originate from a VPC endpoint, but the Glue job is not using one.
B.The key policy denies requests that are not using HTTPS, but the Glue job is using HTTPS.
C.The key policy condition 'kms:ViaService' restricts KMS actions to only when they are made through S3, but AWS Glue calls KMS directly, not via S3.
D.The Glue job is running in a different AWS region than the S3 bucket.
AnswerC

Glue does not use S3 to make KMS calls; it calls KMS directly, so the condition fails.

Why this answer

The key policy includes a condition `kms:ViaService` that restricts KMS actions to only when they are made through the S3 service. However, AWS Glue does not call KMS via S3; it calls KMS directly to decrypt the S3 object's data key. Because the Glue job's KMS request does not originate from the S3 service, the condition fails, resulting in an AccessDenied error.

Exam trap

AWS often tests the nuance that `kms:ViaService` only applies when the KMS API call is made through the specified service's endpoint, not when a service like Glue calls KMS directly to decrypt an S3 object's key.

How to eliminate wrong answers

Option A is wrong because the key policy does not contain any VPC endpoint condition; the condition shown is `kms:ViaService`, not `aws:SourceVpce`. Option B is wrong because the key policy does not include an HTTPS condition, and even if it did, AWS Glue uses HTTPS by default, so this would not cause an AccessDenied error. Option D is wrong because cross-region access to an S3 bucket is allowed as long as the KMS key is in the same region as the bucket; the error is not region-related.

Practice this question →
3
MCQmedium

A company uses AWS Glue to process sensitive customer data stored in S3. The data engineer must ensure that the Glue ETL jobs do not write any data to S3 buckets that lack encryption. Which approach meets this requirement?

A.Use AWS CloudTrail to monitor and alert on unencrypted writes
B.Attach an S3 bucket policy that denies s3:PutObject unless the request includes the x-amz-server-side-encryption header
C.Enable S3 default encryption on the bucket
D.Configure an IAM role for Glue with a policy that denies s3:PutObject without encryption
AnswerB

S3 bucket policies can enforce encryption on uploads.

Why this answer

An S3 bucket policy with a condition key such as s3:x-amz-server-side-encryption can deny s3:PutObject requests that do not specify encryption, thereby preventing unencrypted writes. Option A is incorrect because AWS CloudTrail is an auditing service that logs API calls but does not actively prevent writes. Option C is incorrect because while S3 default encryption automatically encrypts objects at rest, it does not enforce that write requests include encryption headers; the bucket policy approach ensures encryption is explicitly requested.

Option D is incorrect because an IAM role policy can also enforce encryption, but a bucket policy is more comprehensive as it applies to all principals accessing the bucket, including the Glue service role.

Practice this question →
4
MCQmedium

A company uses AWS KMS to encrypt data in Amazon S3. The security team requires that all encryption keys be rotated automatically every year. Which key type should the company use?

A.Use a customer managed key with automatic rotation enabled
B.Use the default S3 managed encryption key (SSE-S3)
C.Use an AWS managed key (aws/s3)
D.Use a customer managed key with manual rotation
AnswerA

Correct: Customer managed keys with automatic rotation enabled rotate automatically every year, meeting the requirement while maintaining customer control.

Why this answer

AWS KMS allows customer managed keys to have automatic rotation enabled, which rotates the key material annually. This satisfies the security team's requirement for automatic yearly rotation while keeping customer control over the key. Option D (manual rotation) does not meet the automatic rotation requirement.

AWS managed keys (C) also rotate automatically but are not customer managed, and SSE-S3 (B) is not a KMS key type.

Exam trap

Candidates may incorrectly think that only AWS managed keys support automatic rotation, overlooking that customer managed keys also offer automatic rotation. They might also confuse manual rotation as acceptable despite the explicit 'automatic' requirement.

Practice this question →
5
MCQhard

A data engineer notices that an S3 bucket policy allows access to a user from another AWS account, but the access is being denied. What could be the reason?

A.The bucket policy does not include KMS permissions
B.The other account's IAM user does not have permissions to access the bucket
C.S3 does not support cross-account access
D.The bucket is in a different region
AnswerB

Cross-account access requires IAM permissions in the other account.

Why this answer

For cross-account S3 access to succeed, both the bucket policy (resource-based policy) and the IAM user policy (identity-based policy) in the other account must grant the necessary permissions. Option B is correct because even if the bucket policy allows access from the other account, the IAM user in that account must have an explicit IAM policy that permits the S3 action (e.g., s3:GetObject) on the bucket. Without this, the request is denied by the other account's own IAM evaluation.

Exam trap

The trap here is that candidates assume a bucket policy alone is sufficient for cross-account access, forgetting that the requesting account's IAM user must also have explicit permissions, which is a classic AWS cross-account authorization nuance.

How to eliminate wrong answers

Option A is wrong because KMS permissions are only required if the bucket uses SSE-KMS encryption; the question does not mention encryption, and a missing KMS permission would cause a different error (e.g., AccessDenied with KMS key context). Option C is wrong because S3 fully supports cross-account access via bucket policies and ACLs, as documented in the AWS S3 User Guide. Option D is wrong because S3 is a global service and cross-region access is allowed; region does not inherently block cross-account access.

Practice this question →
6
MCQhard

A company has a multi-account AWS environment with a centralized data lake in the Security account. Data producers in other accounts use AWS Glue to write data to S3 buckets in the Security account. The Security account uses AWS Lake Formation to manage permissions. The data engineer is setting up cross-account access so that users in the Producer account can query the data using Athena in their own account. The engineer has registered the S3 buckets and Data Catalog tables in Lake Formation. The IAM roles in the Producer account have the necessary permissions. However, when a user in the Producer account tries to query the table, they get an AccessDenied error. The error message indicates that the principal is not authorized to perform lakeformation:GetTable on the resource. What is the most likely cause?

A.The Glue Data Catalog resource policy is missing a statement to allow cross-account access.
B.The S3 bucket policy does not allow the Producer account's IAM role to read the data.
C.The KMS key policy does not allow the Producer account's IAM role to decrypt objects.
D.The Lake Formation permissions in the Security account do not include a grant to the Producer account's IAM role.
AnswerD

Lake Formation must grant cross-account access to the external IAM role.

Why this answer

Lake Formation requires explicit cross-account grants to the producer account's IAM role for the Data Catalog tables. Even if the S3 buckets and Data Catalog tables are registered, the producer account's role must be granted SELECT and DESCRIBE permissions on the table in Lake Formation. Option A is incorrect because a Glue Data Catalog resource policy is not required when Lake Formation is used for cross-account access; Lake Formation handles the authorization.

Option B is incorrect because the S3 bucket policy must allow the producer account's role, but the error specifically mentions lakeformation:GetTable, not S3 access. Option C is incorrect because the KMS key policy is not relevant to the lakeformation:GetTable error.

Practice this question →
7
MCQeasy

A company wants to audit all data access events in their S3 buckets, including who accessed objects and from which IP address. Which AWS service should be used to capture these events?

A.AWS CloudTrail with data events enabled
B.Amazon CloudWatch Logs
C.AWS Config
D.Amazon S3 Server Access Logs
AnswerA

CloudTrail can log S3 object-level operations and capture user identity and source IP.

Why this answer

AWS CloudTrail can log S3 API calls such as GetObject, PutObject, and ListObjects when data events are enabled, capturing details like who accessed an object and from which IP address. Option D is incorrect because S3 Server Access Logs provide object-level logs but do not include IAM user or role details. Option B is incorrect because Amazon CloudWatch Logs can store and monitor logs but does not capture S3 data events directly.

Option C is incorrect because AWS Config records resource configuration changes, not data access events.

Practice this question →
8
MCQmedium

A data engineer needs to grant cross-account access to an S3 bucket. The engineer wants to use a role in the source account and assume that role from the target account. Which permissions are required?

A.Role in source account with trust policy allowing target account, and bucket policy granting access to the role
B.Bucket policy in source account allowing the target account's root user
C.Role in target account with trust policy allowing source account
D.IAM policy in target account allowing s3:GetObject on the bucket
AnswerA

This is the correct cross-account access pattern using role assumption.

Why this answer

Cross-account access via role assumption requires the source account to have an IAM role with a trust policy that explicitly allows the target account's AWS account ID to assume it. The bucket policy must then grant the necessary S3 actions (e.g., s3:GetObject) to that role's ARN, enabling the target account's assumed role session to access the bucket. This two-step mechanism—trust policy for authentication and bucket policy for authorization—is the standard AWS pattern for secure cross-account S3 access.

Exam trap

The trap here is that candidates often confuse the direction of the trust policy—thinking the role must be in the target account—or incorrectly assume that a bucket policy alone (without a role) is sufficient for cross-account access, missing the requirement for the target account to authenticate via role assumption.

How to eliminate wrong answers

Option B is wrong because granting access to the target account's root user in the bucket policy is overly permissive and violates the principle of least privilege; it also does not involve a role, so the target account would need to use its root user credentials directly, which is insecure and not the requested role-based approach. Option C is wrong because a role in the target account with a trust policy allowing the source account would enable the source account to assume a role in the target account, which is the reverse of the required direction—here, the target account needs to assume a role in the source account. Option D is wrong because an IAM policy in the target account alone cannot grant access to a resource in the source account; S3 bucket policies are resource-based policies that must explicitly allow the principal (the role ARN) to access the bucket, and a target account IAM policy only controls permissions within the target account.

Practice this question →
9
MCQeasy

A company needs to audit all API calls made in their AWS account, including actions performed by the root user. Which AWS service should be used?

A.VPC Flow Logs
B.AWS CloudTrail
C.Amazon CloudWatch Logs
D.AWS Config
AnswerB

AWS CloudTrail is the service designed to record all API calls for auditing and governance.

Why this answer

AWS CloudTrail records all API calls made in an AWS account, including root user actions, for auditing and compliance. Option A is incorrect because VPC Flow Logs capture network traffic metadata, not API calls. Option C is incorrect because Amazon CloudWatch Logs stores log data but does not natively capture API calls; it can ingest logs from other sources.

Option D is incorrect because AWS Config tracks configuration changes to AWS resources, not API calls.

Practice this question →
10
MCQhard

A company stores sensitive data in S3 and uses VPC Endpoints to restrict access. They want to ensure that data can only be accessed from their VPC. What configuration is required?

A.Configure VPC Flow Logs to monitor access
B.Add a bucket policy condition aws:SourceVpce
C.Enable S3 Block Public Access
D.Associate a security group with the S3 bucket
AnswerB

This condition restricts access to requests originating from the specified VPC endpoint.

Why this answer

To restrict S3 bucket access to a specific VPC, use a bucket policy with the aws:SourceVpce condition key to specify the VPC endpoint ID. Option A (VPC Flow Logs) logs traffic but does not restrict access. Option B is correct.

Option C (S3 Block Public Access) prevents public access but does not limit access to a specific VPC. Option D (security groups) are used for EC2 instances, not S3 buckets.

Practice this question →
11
Multi-Selecthard

A company uses AWS KMS to encrypt data in multiple services. They want to ensure that only specific IAM roles can decrypt data using a particular KMS key. Which TWO steps are necessary?

Select 2 answers
A.Attach an IAM policy to each role with kms:Decrypt permission
B.Enable IAM policies in the key policy
C.Enable automatic key rotation
D.Ensure the key policy allows kms:GenerateDataKey for the roles
E.Add a statement to the KMS key policy allowing kms:Decrypt for the IAM roles
AnswersA, E

Correct. The IAM policy attached to the role must include kms:Decrypt to allow the role to decrypt using the key.

Why this answer

To allow specific IAM roles to decrypt data using a KMS key, two steps are required. First, each role must have an IAM policy that grants the kms:Decrypt permission (A). Second, the KMS key policy must include a statement that allows the IAM roles to perform kms:Decrypt (E).

The permission kms:GenerateDataKey (D) is not needed for decryption-only access; it is used for generating data keys during encryption. Options B (enabling IAM policies in key policy) and C (automatic key rotation) are unrelated to access control for decryption.

Practice this question →
12
MCQmedium

A data engineer is troubleshooting an issue where an AWS Glue ETL job fails when trying to read data from an S3 bucket encrypted with SSE-KMS. The job has an IAM role that includes `kms:Decrypt` permission. What is the most likely reason for the failure?

A.The IAM role does not have s3:GetObject permission
B.The KMS key policy does not allow the Glue job to use the key
C.The S3 bucket is in a different AWS region than the Glue job
D.The Glue job is not configured to use the KMS key for decryption
AnswerB

Correct. The most likely cause is that the KMS key policy does not grant the Glue job's IAM role permission to use the key. Even with kms:Decrypt in the role, the key policy must allow it.

Why this answer

The most likely reason for the failure, even with kms:Decrypt permission in the IAM role, is that the KMS key policy explicitly denies the Glue job's IAM role access to the key. AWS Glue ETL jobs can read SSE-KMS encrypted S3 objects without additional configuration; the job's IAM role must be allowed by the key policy. Option A is incorrect because the IAM role likely has s3:GetObject permission.

Option C is incorrect because cross-region S3 access is permitted with proper permissions. Option D is incorrect because Glue does not require explicit KMS key configuration for reading; the key is identified in the S3 object metadata, and the job's IAM role is trusted to use the key based on key policy.

Exam trap

Candidates often assume that kms:Decrypt on the IAM role is sufficient, but the KMS key policy is an additional layer that can deny access even when the role has the permission.

Practice this question →
13
MCQeasy

A company wants to use AWS Lake Formation to manage permissions on a data lake. What is the primary benefit of using Lake Formation for data security?

A.Automatically encrypts data at rest and in transit.
B.Replaces IAM for all data access policies.
C.Provides a unified view of data across all AWS regions.
D.Centralized fine-grained access control to data in S3, Redshift, and RDS.
AnswerD

Lake Formation provides column and row-level security.

Why this answer

AWS Lake Formation centralizes fine-grained access control for data lakes, allowing administrators to define column-level, row-level, and cell-level permissions on data stored in Amazon S3, and also extend those policies to Amazon Redshift and Amazon RDS via integrated resource links. This eliminates the need to manage separate IAM policies for each service, providing a single point of governance for data security across the data lake ecosystem.

Exam trap

The trap here is that candidates often assume Lake Formation replaces IAM entirely or handles encryption, but the exam tests the understanding that Lake Formation is a complementary governance layer for fine-grained access control, not a replacement for IAM or encryption services.

How to eliminate wrong answers

Option A is wrong because Lake Formation does not automatically encrypt data at rest or in transit; encryption is handled by the underlying services (e.g., S3 SSE, KMS, TLS) and must be configured separately. Option B is wrong because Lake Formation does not replace IAM; it works alongside IAM, with IAM still controlling authentication and service-level permissions while Lake Formation manages fine-grained data permissions. Option C is wrong because Lake Formation does not provide a unified view of data across all AWS regions; it operates within a single region and does not aggregate metadata or permissions globally.

Practice this question →
14
MCQeasy

A data engineer needs to ensure that an Amazon Redshift cluster encrypts all data at rest. Which setting must be enabled when creating the cluster?

A.Enable automated snapshots
B.Enable encryption
C.Enable SSL/TLS
D.Enable VPC
AnswerB

Redshift supports encryption at rest.

Why this answer

Amazon Redshift encryption at rest is enabled during cluster creation by selecting the encryption option. Option A is incorrect because enabling automated snapshots is for backup and recovery, not encryption. Option C is incorrect because SSL/TLS ensures encryption in transit, not at rest.

Option D is incorrect because VPC is for network isolation, not encryption.

Practice this question →
15
MCQhard

A data engineer is troubleshooting an Amazon Redshift cluster that is not allowing connections from a specific IP range. The engineer verified that the cluster's security group allows inbound traffic from the IP range. What is the next step to resolve the issue?

A.Modify the Redshift cluster parameter group to enable public accessibility.
B.Verify that the cluster's security group is attached to the Redshift cluster.
C.Check the IAM role associated with the Redshift cluster.
D.Check the network ACL (NACL) associated with the Redshift cluster's subnet.
AnswerD

Network ACLs operate at the subnet level and can block inbound traffic even if security groups allow it, making this the correct next step.

Why this answer

Even if the security group allows inbound traffic from a specific IP range, the network ACL (NACL) associated with the Redshift cluster's subnet can block traffic at the subnet level. NACLs are stateless and can override security group rules. Option A is incorrect because modifying the cluster parameter group does not control network-level access; public accessibility is a separate setting.

Option B is incorrect because the engineer already verified the security group, but even if it is correctly attached, the NACL could still block traffic. Option C is incorrect because IAM roles control authentication and authorization, not network connectivity.

Practice this question →
16
Multi-Selectmedium

A company uses Amazon Redshift to store customer data. The security team requires that all queries are logged for auditing purposes. Which step should be taken to meet this requirement? (Select ONE.)

Select 1 answer
A.Enable AWS CloudTrail database audit logging.
B.Use AWS CloudTrail to log Redshift API calls.
C.Enable logging on the Redshift security group.
D.Enable VPC Flow Logs for the Redshift cluster.
E.Enable Amazon Redshift audit logging to an S3 bucket.
AnswersE

Amazon Redshift supports native audit logging that captures query logs, connection logs, and user activity logs, which can be exported to an S3 bucket. This directly meets the requirement.

Why this answer

The requirement is to log all queries for auditing. Amazon Redshift's native audit logging captures connection logs, user activity logs, and query logs, and can be exported to an S3 bucket. This is the only step that directly logs SQL queries.

AWS CloudTrail does not log SQL queries; it logs management API calls (e.g., CreateCluster, ModifyCluster). Therefore, only Option E meets the requirement.

Exam trap

The trap is that many candidates assume AWS CloudTrail can log SQL queries, but it only logs API calls. The correct answer is solely Amazon Redshift's native audit logging.

Practice this question →
17
Multi-Selectmedium

A company is designing a data lake on Amazon S3. The security policy requires that all data be encrypted at rest using AWS KMS with automatic key rotation. Which encryption option meets these requirements? (Select THREE.)

Select 3 answers
A.Enable automatic key rotation on the KMS key.
B.Use SSE-KMS with an AWS managed key.
C.Set the default encryption on the S3 bucket to SSE-KMS with the CMK.
D.Use SSE-KMS with a customer-managed key (CMK).
E.Use SSE-C with a customer-provided key.
AnswersA, C, D

This is a requirement.

Why this answer

AWS KMS customer-managed keys (CMKs) support automatic key rotation, which can be enabled to rotate the key material annually. This satisfies the security policy requirement for automatic key rotation. SSE-KMS with a CMK (Option D) is also required because AWS managed keys (Option B) do not support automatic key rotation, and SSE-C (Option E) does not use KMS at all.

Setting default encryption on the S3 bucket to SSE-KMS with the CMK (Option C) ensures all objects are encrypted with that key, meeting the encryption-at-rest requirement.

Exam trap

The trap here is that candidates often assume AWS managed keys (aws/s3) support automatic key rotation, but they do not; only customer-managed CMKs allow you to enable automatic rotation, and the question requires selecting three correct options that together meet both the KMS and automatic rotation requirements.

Practice this question →
18
MCQmedium

A company uses AWS KMS to encrypt sensitive data in S3. The security team requires that the KMS key must be rotated automatically every year. Which key type should be used?

A.Asymmetric customer managed key
B.AWS managed key (aws/s3)
C.Custom key store backed by CloudHSM
D.Customer managed key with automatic rotation enabled
AnswerD

Customer managed keys can have automatic rotation enabled with a yearly frequency, which aligns with the requirement.

Why this answer

Customer managed keys can be configured with automatic rotation every year, meeting the security team's requirement. Option B is incorrect because AWS managed keys (aws/s3) rotate automatically every 3 years, not annually. Option A is incorrect because asymmetric keys do not support automatic rotation.

Option C is incorrect because custom key stores backed by CloudHSM do not offer automatic rotation.

Practice this question →
19
MCQmedium

A data engineer is designing a data lake on S3 and needs to ensure that data is encrypted at rest using customer-managed KMS keys. The engineer also needs to audit all access to the KMS keys. Which combination of services should be used?

A.SSE-KMS with AWS CloudTrail
B.SSE-C with CloudWatch Logs
C.SSE-KMS with S3 Inventory
D.SSE-S3 with S3 server access logs
AnswerA

SSE-KMS uses customer-managed KMS keys; CloudTrail records KMS API calls for auditing.

Why this answer

SSE-KMS allows customer-managed KMS keys, and AWS CloudTrail logs all KMS API calls (e.g., Decrypt, GenerateDataKey), enabling auditing. Option B is incorrect because SSE-C uses customer-provided encryption keys, not KMS, and CloudWatch Logs is for application logs, not KMS access. Option C is incorrect because S3 Inventory provides object metadata but does not audit KMS access.

Option D is incorrect because SSE-S3 uses AWS-managed keys, not customer-managed, and S3 server access logs do not capture KMS API calls.

Practice this question →
20
MCQeasy

A data engineer needs to ensure that an S3 bucket is not publicly accessible. Which S3 block public access setting should be applied to achieve this?

A.BlockPublicAcls (both new and existing)
B.IgnorePublicAcls
C.BlockPublicAcls (new ACLs)
D.BlockPublicPolicy
AnswerD

Correct. BlockPublicPolicy prevents public bucket policies, the most common vector for public access, especially with ACLs disabled by default.

Why this answer

(BlockPublicPolicy) prevents any public bucket policies from being applied, which is the primary way to grant public access to an S3 bucket. With public ACLs disabled by default for new buckets, blocking public policies effectively ensures the bucket is not publicly accessible. Option A (BlockPublicAcls both new and existing) only blocks public ACLs, leaving the bucket vulnerable to public policies, so it is insufficient by itself.

Practice this question →
21
MCQmedium

Refer to the exhibit. A data engineer has attached this KMS key policy to a customer-managed key. The policy is intended to allow the DataEngineer role to decrypt objects in S3 only when the request comes through S3. However, the role is unable to decrypt objects stored in an S3 bucket in the us-west-2 region. What is the most likely cause?

A.The key policy does not allow the role to use GenerateDataKey
B.The role does not have an IAM policy that allows kms:Decrypt
C.The condition restricts the permission to the us-east-1 region only
D.The role does not have permission to decrypt from S3
AnswerC

The kms:ViaService condition specifies s3.us-east-1.amazonaws.com, so it only works for S3 requests in us-east-1.

Why this answer

The condition in the policy restricts the permission to requests coming through S3 in us-east-1 only (s3.us-east-1.amazonaws.com). For buckets in us-west-2, the viaService would be s3.us-west-2.amazonaws.com, so the condition fails. The key policy does not allow decrypt from other services, but the issue is region mismatch.

Practice this question →
22
Multi-Selecteasy

A data engineer needs to enforce that all data in an Amazon S3 bucket is encrypted at rest. Which of the following can be used to achieve this? (Choose TWO.)

Select 2 answers
A.Use AWS CloudTrail to monitor for unencrypted objects
B.Use VPC endpoints to restrict access
C.Configure a bucket policy to deny PutObject if encryption headers are missing
D.Enable default encryption on the S3 bucket using SSE-S3
E.Use AWS KMS to generate encryption keys for the bucket
AnswersC, D

This policy enforces encryption on uploads.

Why this answer

Options C and D are correct. Configuring a bucket policy to deny PutObject requests that lack encryption headers (C) enforces encryption at upload time. Enabling default encryption on the S3 bucket using SSE-S3 (D) automatically encrypts objects at rest, even if uploaded without encryption headers.

Together, these ensure all data at rest is encrypted. Option A is incorrect because CloudTrail only logs API calls and does not enforce encryption. Option B is incorrect because VPC endpoints provide network isolation, not encryption.

Option E is incorrect because KMS generating keys alone does not enforce encryption on S3; the bucket must be configured to use those keys.

Practice this question →
23
MCQmedium

A company uses AWS Glue DataBrew to clean and normalize data. The data contains sensitive columns that must be masked before being written to the output. Which DataBrew action should be applied?

A.Apply a Hash transform to the sensitive columns.
B.Apply an Encrypt transform to the sensitive columns.
C.Apply a Delete transform to remove the sensitive columns.
D.Apply a Mask transform to the sensitive columns.
AnswerD

Correct. The 'Mask' transform obfuscates sensitive data by replacing characters with a mask character (e.g., 'X'), preserving the column structure and data type.

Why this answer

DataBrew provides a built-in 'Mask' transform that obfuscates sensitive data by applying masking patterns. Option A is incorrect because the Hash transform produces a hash value, which is not true masking as it can be reversed via brute force. Option B is incorrect because Encrypt is not a DataBrew transform; encryption is handled at the storage layer (e.g., S3 SSE).

Option C is incorrect because Delete removes the column entirely, which may not be desired if the column is needed for analysis but just needs sensitive data hidden.

Practice this question →
24
MCQeasy

A company wants to securely store database credentials used by a Lambda function. Which AWS service should be used to store and rotate the credentials automatically?

A.AWS CloudHSM
B.AWS Secrets Manager
C.AWS Key Management Service (KMS)
D.AWS Systems Manager Parameter Store
AnswerB

Secrets Manager is designed for storing secrets and supports automatic rotation of database credentials.

Why this answer

AWS Secrets Manager is designed for storing secrets and provides automatic rotation. Systems Manager Parameter Store can store secrets but does not natively support automatic rotation for database credentials. KMS is for encryption keys, not storing secrets.

CloudHSM is for hardware security modules.

Practice this question →
25
MCQmedium

A company uses AWS Glue to run ETL jobs on data stored in S3. The data is encrypted with SSE-KMS. The Glue job fails with an 'AccessDenied' error when trying to read the data. What is the MOST likely cause?

A.The S3 bucket policy denies access to the Glue service role.
B.The AWS Glue Data Catalog does not have permission to the table.
C.The IAM role used by Glue does not have kms:Decrypt permission on the KMS key.
D.The Glue job's connection does not have the necessary permissions.
AnswerC

Glue needs kms:Decrypt to read SSE-KMS encrypted data.

Why this answer

When data is encrypted with SSE-KMS, the IAM role used by Glue must have kms:Decrypt permission on the KMS key to read the data. Without it, the Glue job will fail with an 'AccessDenied' error despite S3 bucket permissions. Option A is incorrect because the S3 bucket policy may allow access, but KMS permission is separate and required.

Option B is incorrect because the Glue Data Catalog permissions are for catalog operations, not for reading actual data from S3. Option D is incorrect because Glue connection permissions are for JDBC connections, not for S3 data access.

Practice this question →
26
Multi-Selecteasy

A company wants to enforce encryption in transit for data moving between an EC2 instance and an S3 bucket. Which TWO methods can achieve this? (Choose 2)

Select 2 answers
A.Add a bucket policy that denies requests without the aws:SecureTransport condition.
B.Use a VPC endpoint for S3.
C.Enable default SSE-S3 encryption on the bucket.
D.Use the HTTPS endpoint for S3 API calls.
E.Enable CloudTrail to monitor for non-encrypted requests.
AnswersA, D

This enforces HTTPS.

Why this answer

Options A and D are correct. Option A: Adding a bucket policy with the aws:SecureTransport condition denies any requests that are not using HTTPS, thus enforcing encryption in transit. Option D: By using the HTTPS endpoint for S3 API calls, data is encrypted in transit via TLS.

Option B is incorrect because a VPC endpoint for S3 does not automatically enforce encryption; it only keeps traffic within the AWS network. Option C is incorrect because SSE-S3 is for server-side encryption at rest, not in transit. Option E is incorrect because CloudTrail is a logging service and does not enforce encryption.

Practice this question →
27
MCQeasy

A company wants to audit all changes to IAM policies in their AWS account. Which AWS service should be used to record these changes?

A.AWS Config
B.AWS CloudTrail
C.Amazon GuardDuty
D.Amazon Inspector
AnswerA

Config tracks configuration changes and can record IAM policy changes.

Why this answer

AWS Config records configuration changes to AWS resources, including IAM policies. CloudTrail records API calls, not configuration snapshots. GuardDuty is for threat detection.

Inspector is for vulnerability assessment.

Practice this question →
28
MCQhard

An organization is using AWS Glue to process sensitive data. The data is stored in S3 with server-side encryption using AWS KMS (SSE-KMS). The Glue job fails with an error indicating that it cannot read the data. The IAM role used by Glue has the following policy. What is missing?

A.The s3:GetObject permission on the bucket
B.The kms:Decrypt permission on the KMS key
C.The kms:GenerateDataKey permission on the KMS key
D.The kms:ReEncrypt permission on the KMS key
AnswerB

Correct. The role lacks kms:Decrypt, which is required to decrypt objects encrypted with SSE-KMS.

Why this answer

The Glue job fails because the IAM role lacks the kms:Decrypt permission on the KMS key. While s3:GetObject is also required, the role already has that permission (or it is not the missing permission causing the error). The key missing permission for decrypting SSE-KMS encrypted data is kms:Decrypt.

Option A is incorrect because s3:GetObject is present. Option B is correct. Options C and D are incorrect because they are not required for read operations.

Exam trap

Candidates often assume that both s3:GetObject and kms:Decrypt are missing, but the question's context implies that s3:GetObject is already present. The trap is to overlook that the IAM policy already includes s3:GetObject, so only kms:Decrypt needs to be added.

Practice this question →
29
MCQmedium

A company uses Amazon Kinesis Data Streams to ingest real-time data. The compliance team requires that all data in the stream be encrypted at rest. Which configuration should be enabled?

A.Enable TLS encryption on the Kinesis stream
B.Enable server-side encryption using an AWS KMS key
C.Use client-side encryption in the producer application
D.Store the data in Amazon CloudWatch Logs instead
AnswerB

Kinesis supports SSE with KMS.

Why this answer

Server-side encryption (SSE) for Amazon Kinesis Data Streams uses an AWS KMS key to automatically encrypt data at rest as it is written to the stream and decrypt it when read. This meets the compliance requirement for encryption at rest without requiring any changes to the producer or consumer applications.

Exam trap

The trap here is confusing encryption in transit (TLS) with encryption at rest (SSE), leading candidates to select TLS as the solution for at-rest compliance.

How to eliminate wrong answers

Option A is wrong because TLS encryption protects data in transit between clients and the Kinesis endpoint, not data at rest within the stream. Option C is wrong because client-side encryption encrypts data before it is sent to Kinesis, but this is a client-managed approach that does not leverage Kinesis's native at-rest encryption and adds complexity; the question asks which configuration should be enabled on the stream itself. Option D is wrong because storing data in CloudWatch Logs does not encrypt the Kinesis stream data at rest and is a different service entirely, not a configuration for Kinesis Data Streams.

Practice this question →
30
Multi-Selecteasy

A company is designing a data lake on AWS using S3. The security team requires that all data be encrypted at rest and that encryption keys be rotated annually. Which services can be used to meet these requirements? (Choose TWO.)

Select 2 answers
A.AWS Secrets Manager
B.AWS Certificate Manager (ACM)
C.AWS Key Management Service (AWS KMS)
D.AWS CloudHSM
E.Amazon S3 managed keys (SSE-S3)
AnswersC, E

Allows customer-managed keys with automatic yearly rotation.

Why this answer

AWS KMS (C) allows creating customer-managed keys that can be rotated annually or automatically. Amazon S3 managed keys (SSE-S3) (E) provide encryption at rest with keys that are automatically rotated by AWS. Option A (AWS Secrets Manager) is for storing secrets, not encryption keys.

Option B (ACM) is for SSL/TLS certificates. Option D (CloudHSM) provides hardware security modules but does not support automatic key rotation for S3 and is not typically used for S3 encryption key management.

Practice this question →
31
MCQmedium

A data engineer needs to audit all access to an Amazon S3 bucket containing sensitive data. The audit must capture who accessed the bucket, from which IP address, and what actions were performed. Which AWS service should be enabled?

A.Enable S3 server access logging for the bucket.
B.Enable AWS CloudTrail with data events for the S3 bucket.
C.Use AWS Config to record S3 bucket-level changes.
D.Configure Amazon CloudWatch Logs to monitor S3 access.
AnswerB

CloudTrail data events capture detailed API activity.

Why this answer

AWS CloudTrail logs all API calls to S3, including the caller identity, source IP, and actions. Option A is wrong because S3 server access logs provide similar info but are not as detailed or centralized. Option C is wrong because CloudWatch Logs can store logs but does not generate them.

Option D is wrong because AWS Config tracks resource configuration changes, not API calls.

Practice this question →
32
MCQmedium

A company is using Amazon Redshift for analytics and needs to ensure that all data is encrypted at rest. The current cluster does not have encryption enabled. What is the most efficient way to enable encryption?

A.Change the cluster parameter group to enable encryption
B.Modify the cluster configuration to enable encryption
C.Use AWS DMS to migrate data to a new encrypted cluster
D.Create a snapshot of the cluster and restore it to a new cluster with encryption enabled
AnswerD

This is the supported method to migrate to an encrypted cluster.

Why this answer

Redshift does not support enabling encryption on an existing cluster; a new encrypted cluster must be created and data migrated. Modifying the cluster configuration or parameter groups does not enable encryption. Creating a snapshot and restoring it to a new cluster with encryption enabled is the standard approach.

Practice this question →
33
MCQeasy

A data engineer needs to securely store database credentials used by a Lambda function. The solution must automatically rotate the credentials every 90 days. Which AWS service should the engineer use?

A.AWS CloudHSM
B.AWS Systems Manager Parameter Store
C.IAM Roles for Lambda
D.AWS Secrets Manager
AnswerD

Secrets Manager provides automatic rotation of secrets.

Why this answer

AWS Secrets Manager supports automatic rotation of secrets. Option A is wrong because CloudHSM is a hardware security module, not a secret store with rotation. Option B is wrong because Parameter Store does not natively rotate secrets.

Option C is wrong because IAM Roles are for access to AWS services, not for storing database credentials.

Practice this question →
34
MCQhard

A company is using AWS Glue to process data stored in Amazon S3. The data includes personally identifiable information (PII) that must be masked before being written to a separate output bucket. Which AWS service or feature can be used to automatically detect and mask sensitive data in the Glue ETL job?

A.Configure CloudWatch Logs to filter and mask PII.
B.Use Amazon Macie to identify sensitive data and apply masking logic in the Glue job.
C.Use an IAM policy to restrict access to the PII columns.
D.Enable S3 Object Lock on the output bucket.
AnswerB

Amazon Macie can detect sensitive data, and the Glue job can use that information to mask it.

Why this answer

Amazon Macie can be integrated with AWS Glue to automatically detect sensitive data like PII and apply masking logic within a Glue ETL job. Option A is incorrect because CloudWatch Logs are for monitoring and logging, not for data masking. Option C is incorrect because IAM policies control access permissions but do not mask data.

Option D is incorrect because S3 Object Lock prevents object deletion or modification, not masking.

Practice this question →
35
MCQeasy

A company is designing a data pipeline that ingests data from an on-premises database to Amazon S3. The data contains personally identifiable information (PII) that must be masked before storage. Which AWS service can be used to mask the data in transit?

A.AWS Database Migration Service (DMS)
B.AWS Data Pipeline
C.Amazon Kinesis Data Firehose
D.AWS Glue
AnswerC

Correct. Kinesis Data Firehose can use Lambda functions to perform data transformation, including masking PII, as data flows through the pipeline.

Why this answer

Amazon Kinesis Data Firehose can invoke an AWS Lambda function to transform and mask data in transit before delivering to Amazon S3. This makes it suitable for masking PII in a streaming pipeline. AWS Glue is designed for batch ETL jobs, not real-time masking during transit.

AWS DMS is for database migration, and AWS Data Pipeline orchestrates workflows without native masking capabilities.

Practice this question →
36
MCQhard

A company uses AWS KMS to encrypt sensitive data stored in S3. To meet compliance requirements, they need to ensure that the encryption keys are automatically rotated every year. Which type of KMS key should they use?

A.Customer managed key with manual rotation
B.AWS managed key
C.Custom key store (CloudHSM) key
D.Customer managed key with automatic rotation enabled
AnswerD

Customer managed keys can have automatic rotation enabled, which rotates the key annually.

Why this answer

Customer managed keys with automatic rotation enabled support automatic annual rotation, meeting the compliance requirement. AWS managed keys rotate automatically every year, but they cannot be controlled or customized by the customer, so they are not the best choice when the customer needs to manage the key policy or rotation schedule. Custom key stores (CloudHSM) do not support automatic rotation.

Option A (customer managed key with manual rotation) requires manual intervention to rotate, not automatic. Therefore, D is the correct answer.

Practice this question →
37
Multi-Selecthard

A company uses AWS KMS to encrypt data in Amazon Redshift. The data engineer needs to rotate the customer-managed KMS key annually. Which TWO actions must be taken to successfully rotate the key without data loss?

Select 2 answers
A.Create a new KMS key and update the Redshift cluster to use the new key
B.Keep the old KMS key enabled to allow decryption of existing encrypted data
C.Use AWS CloudTrail to verify the key rotation was successful
D.Store the new key in Amazon S3 for backup
E.Enable automatic KMS key rotation on the existing key
AnswersA, B

Needed to re-encrypt data with new key.

Why this answer

You must create a new KMS key and update the Redshift cluster to use the new key for encrypting future data. Option B is correct because the old key must remain enabled to allow decryption of data that was encrypted with it; without the old key, existing data becomes inaccessible. Option C is incorrect because CloudTrail is used for auditing API calls, not as a required action for key rotation.

Option D is incorrect because storing the key in Amazon S3 is unnecessary; KMS already securely stores keys. Option E is incorrect because automatic key rotation on the existing key does not create a new key; it rotates the key material automatically, which is not the scenario described (a new key must be created and the cluster updated).

Practice this question →
38
MCQeasy

Refer to the exhibit. A data engineer applies this S3 bucket policy to the bucket 'example-bucket'. What is the effect of this policy?

A.PutObject requests are denied unless they include the x-amz-server-side-encryption header set to AES256
B.All PutObject requests are denied regardless of encryption
C.All PutObject requests are allowed only if they use SSE-KMS
D.The policy has no effect because it does not allow any action
AnswerA

The condition StringNotEquals denies if the header is not AES256, so only requests with AES256 are allowed.

Why this answer

The policy denies s3:PutObject if the encryption header is not set to AES256 (SSE-S3). It does not enforce a specific KMS key. It allows uploads with SSE-S3.

It denies uploads without encryption or with other encryption types.

Practice this question →
39
Multi-Selectmedium

Which TWO actions are required to enforce encryption in transit for data being loaded into Amazon Redshift from Amazon S3? (Choose two.)

Select 2 answers
A.Configure Redshift to require SSL connections
B.Use client-side encryption for data in S3
C.Enable encryption at rest on Redshift cluster
D.Enable S3 server-side encryption
E.Use S3 VPC endpoints with HTTPS
AnswersA, E

Ensures data in transit to Redshift is encrypted.

Why this answer

To enforce encryption in transit for data loaded from S3 into Redshift, you need SSL connections on Redshift (option A) to encrypt the connection between the client and Redshift, and S3 VPC endpoints with HTTPS (option E) to encrypt data transfer from S3 to Redshift via the VPC endpoint. Option B is client-side encryption, which encrypts data before it reaches S3 and is not required for transit. Option C enables encryption at rest on the Redshift cluster, not in transit.

Option D is about server-side encryption at rest in S3, not transit.

Practice this question →
40
MCQmedium

A data engineer needs to store sensitive data in Amazon S3 and automatically classify the data using a managed service. The data is uploaded via an S3 bucket. Which AWS service can automatically detect and classify sensitive data?

A.Amazon Macie
B.AWS WAF
C.Amazon Inspector
D.AWS Shield
AnswerA

Macie automatically discovers and classifies sensitive data.

Why this answer

Amazon Macie is the correct answer because it is a fully managed data security and data privacy service that uses machine learning and pattern matching to discover, monitor, and protect sensitive data in Amazon S3. Option B, AWS WAF, is a web application firewall for protecting web applications, not for data classification. Option C, Amazon Inspector, is an automated vulnerability management service for EC2 instances and containers, not for S3 data classification.

Option D, AWS Shield, is a managed DDoS protection service, unrelated to data classification.

Practice this question →
41
Multi-Selecteasy

Which THREE AWS services can be used to centrally manage and govern data across multiple AWS accounts? (Select THREE.)

Select 3 answers
A.Amazon S3
B.AWS Control Tower
C.AWS Organizations
D.Amazon Redshift
E.AWS Lake Formation
AnswersB, C, E

Control Tower provides a governance framework for multi-account environments.

Why this answer

The correct answers are AWS Control Tower, AWS Organizations, and AWS Lake Formation. AWS Control Tower provides a pre-configured environment for governance and compliance across accounts. AWS Organizations enables centralized management of multiple accounts.

AWS Lake Formation helps manage and govern data lake permissions across accounts. Amazon S3 (Option A) is a storage service, not a central governance service. Amazon Redshift (Option D) is a data warehouse, not a governance service.

Practice this question →
42
Multi-Selectmedium

A data engineer is designing a data pipeline that processes PII data using AWS Glue and stores results in S3. Which TWO actions should be taken to protect the data? (Choose 2)

Select 2 answers
A.Use S3 default encryption with SSE-S3 for the output bucket.
B.Store database credentials in AWS Secrets Manager and reference them in Glue connections.
C.Enable S3 object deletion protection by setting a retention policy.
D.Configure AWS Glue to use a KMS key for encrypting data written to S3.
E.Use HTTPS for all data transfer between Glue and S3.
AnswersB, D

Secrets Manager secures credentials.

Why this answer

Options B and D are correct. Option B: Storing database credentials in AWS Secrets Manager and referencing them in AWS Glue connections ensures that sensitive credentials are not hard-coded or exposed in plaintext, following security best practices for PII data. Option D: Configuring AWS Glue to use a KMS key for encrypting data written to S3 ensures that data at rest in S3 is encrypted with customer-managed keys, providing additional control over encryption.

Option A is incorrect because S3 default encryption with SSE-S3 uses Amazon-managed keys and does not provide the same level of control as KMS; more importantly, the question asks for actions to protect PII, and using SSE-S3 alone is not sufficient for compliance with many regulations that require encryption with customer-managed keys. Option C is incorrect because enabling S3 object deletion protection with a retention policy is about preventing accidental deletion, not directly about protecting data from unauthorized access or encryption. Option E is incorrect because HTTPS encrypts data in transit, but the question also requires encryption at rest; HTTPS alone does not protect data at rest in S3.

Practice this question →
43
MCQhard

A data engineer is designing a data pipeline that ingests data from an on-premises system into Amazon S3 using AWS Transfer Family. The data must be encrypted at rest using a customer-managed key in AWS KMS. The S3 bucket policy must allow only encrypted connections. Which policy condition should be used?

A.aws:SecureTransport
B.kms:EncryptionContext
C.s3:x-amz-server-side-encryption-aws-kms-key-id
D.s3:x-amz-server-side-encryption
AnswerA

This condition enforces that connections use TLS.

Why this answer

The condition aws:SecureTransport is used to enforce that connections to S3 are encrypted in transit using TLS/HTTPS. This ensures data is encrypted during transmission. Option B is incorrect because kms:EncryptionContext is used to add encryption context to KMS operations, not to enforce encrypted connections.

Option C is incorrect because s3:x-amz-server-side-encryption-aws-kms-key-id enforces the use of a specific KMS key for server-side encryption, not in-transit encryption. Option D is incorrect because s3:x-amz-server-side-encryption enforces server-side encryption (SSE) for objects at rest, not in-transit encryption.

Practice this question →
44
MCQhard

A data engineering team uses AWS Glue ETL jobs to process data from an S3 data lake and load it into an Amazon Redshift cluster. The security policy mandates that all data in transit between AWS Glue and Redshift must be encrypted using TLS. The team uses a JDBC connection. Currently, the connection is failing with an SSL-related error. Which configuration change should the team make to ensure encrypted connectivity?

A.Modify the Redshift security group to allow inbound traffic on port 5439 from the Glue subnet.
B.Update the JDBC connection string to include ssl=true and sslmode=require.
C.Enable server-side encryption on the S3 bucket using AWS KMS.
D.Set the Redshift cluster parameter group to require_ssl=ON.
AnswerB

Ensures the JDBC driver uses SSL encryption.

Why this answer

To enforce TLS encryption for JDBC connections to Amazon Redshift, the connection string must include ssl=true and often sslmode=require. This is a client-side configuration that tells the JDBC driver to use SSL. Option A is incorrect because security groups control network access, not encryption.

Option C is incorrect because server-side encryption on S3 secures data at rest, not data in transit. Option D is incorrect because setting require_ssl=ON in the cluster parameter group enforces SSL on the server side, but the client (Glue) must still specify ssl=true in the JDBC URL to establish an encrypted connection. Therefore, the correct change is option B.

Practice this question →
45
MCQhard

A company runs an Amazon EMR cluster that processes sensitive data stored in Amazon S3. The security team requires that all data in transit between the EMR cluster and S3 be encrypted. Which configuration ensures this requirement is met?

A.Enable in-transit encryption within the EMR cluster using EMRFS.
B.Enable server-side encryption with S3 managed keys (SSE-S3) on the S3 bucket.
C.Configure the S3 endpoint to use TLS and ensure the EMR cluster uses HTTPS for S3 access.
D.Use an S3 access point with a bucket policy that denies HTTP requests.
AnswerC

TLS encrypts data in transit between EMR and S3.

Why this answer

Configuring the S3 endpoint to use TLS and ensuring the EMR cluster uses HTTPS for S3 access enforces encryption in transit between the cluster and S3. Option A is incorrect because enabling in-transit encryption within the EMR cluster using EMRFS encrypts data within the cluster, not data between the cluster and S3. Option B is incorrect because SSE-S3 encrypts data at rest on S3, not data in transit.

Option D is incorrect because an S3 access point with a bucket policy denying HTTP requests does not directly configure encryption in transit from the EMR cluster; it only denies non-HTTPS requests, but the cluster could still use HTTPS, and this is a bucket-level enforcement, not a direct configuration for the cluster.

Practice this question →
46
MCQmedium

A company needs to monitor and record all changes to IAM policies in their AWS account. Which AWS service should be used?

A.Amazon CloudWatch Logs
B.Amazon GuardDuty
C.AWS CloudTrail
D.AWS IAM Access Analyzer
AnswerC

AWS CloudTrail records API calls, including IAM policy changes, making it the correct service for monitoring and recording changes to IAM policies.

Why this answer

AWS CloudTrail records API calls, including IAM policy changes, making it the correct choice for monitoring and recording changes to IAM policies. Option A is wrong because Amazon CloudWatch Logs is primarily for storing and monitoring log files, not for directly recording IAM changes. Option B is wrong because Amazon GuardDuty is a threat detection service, not designed for recording configuration changes.

Option D is wrong because AWS IAM Access Analyzer analyzes resource policies for public or cross-account access, not for recording changes.

Practice this question →
47
Multi-Selectmedium

A company wants to use AWS CloudTrail to monitor data events for an S3 bucket. Which TWO configurations are required to capture object-level API operations?

Select 2 answers
A.Configure the CloudTrail trail to log data events for the S3 bucket.
B.Enable management events in the CloudTrail trail.
C.Enable S3 server access logs on the bucket.
D.Create a CloudTrail trail in the same AWS Region as the S3 bucket.
E.Set up an Amazon CloudWatch Events rule to capture S3 events.
AnswersA, D

Data events capture object-level operations like GetObject, PutObject.

Why this answer

And Option D are correct. To capture object-level API operations for an S3 bucket, you must configure the CloudTrail trail to log data events for the bucket (Option A). Additionally, the CloudTrail trail must be created in the same AWS Region as the S3 bucket (Option D) because CloudTrail trails are region-specific.

Option B is incorrect because management events capture bucket-level operations, not object-level. Option C is incorrect because S3 server access logs are a separate logging mechanism, not part of CloudTrail. Option E is incorrect because CloudWatch Events is not required for CloudTrail to capture events.

Practice this question →
48
Multi-Selecthard

A company uses Amazon Redshift for its data warehouse and needs to enforce column-level security on sensitive columns. Which TWO approaches can achieve this?

Select 2 answers
A.Apply an S3 bucket policy to the underlying data files.
B.Create views that expose only non-sensitive columns and grant access to the views.
C.Use Redshift Spectrum to query external tables and restrict columns via the external schema.
D.Use Redshift column-level security to grant or revoke permissions on specific columns.
E.Use Redshift row-level security policies to restrict column access.
AnswersB, D

Views can limit column visibility.

Why this answer

Options B and D are correct. Amazon Redshift natively supports column-level security, allowing you to grant or revoke permissions on specific columns (option D). Additionally, you can create views that include only non-sensitive columns and grant access to those views (option B), effectively achieving column-level access control.

Option A (S3 bucket policy) does not control access within Redshift. Option C (Redshift Spectrum) pertains to external tables and is not a column-level security feature. Option E (row-level security) controls rows, not columns.

Practice this question →
49
Multi-Selecteasy

A data analytics company uses Amazon Athena to query data stored in an S3 bucket. The data contains personally identifiable information (PII). The security team wants to ensure that only authorized users can access the data through Athena, and that the data is encrypted at rest in S3. Which combination of actions should the company take? (Choose two.)

Select 2 answers
A.Attach an IAM policy to users that grants Athena access and S3 read access to the bucket.
B.Use AWS Lake Formation to define data lake permissions.
C.Use AWS Kinesis to stream data to Athena.
D.Create an S3 Access Point with a restricted policy.
E.Enable server-side encryption (SSE-S3) on the S3 bucket.
AnswersA, E

Controls access to Athena and underlying data.

Why this answer

Attaching an IAM policy that grants Athena access and S3 read access to the bucket ensures that only authorized users can access the data through Athena via IAM permissions. Option E is correct because enabling server-side encryption (SSE-S3) on the S3 bucket ensures data is encrypted at rest. Option B is incorrect because while Lake Formation can be used for data lake permissions, it is not required for this scenario; IAM policies are sufficient.

Option C is incorrect because Kinesis is a streaming service, not used for querying data in Athena. Option D is incorrect because an S3 Access Point with a restricted policy could be used but is not necessary when IAM policies already provide the required access control.

Practice this question →
50
MCQmedium

A company wants to centrally manage encryption keys for multiple AWS services and automatically rotate them every year. Which AWS service should be used?

A.AWS CloudHSM
B.AWS Certificate Manager (ACM)
C.AWS Secrets Manager
D.AWS Key Management Service (KMS)
AnswerD

KMS can automatically rotate customer managed keys yearly.

Why this answer

AWS KMS manages encryption keys and supports automatic key rotation annually. Option A is wrong because CloudHSM provides hardware-based key storage but does not offer automatic key rotation. Option B is wrong because ACM manages SSL/TLS certificates, not encryption keys.

Option C is wrong because Secrets Manager is designed to manage secrets like database credentials, not encryption keys.

Practice this question →
51
MCQeasy

Refer to the exhibit. A data engineer creates an external table in AWS Glue Data Catalog pointing to an S3 bucket that contains encrypted objects (SSE-S3). The CREATE TABLE statement fails with an error. What change should be made to fix the error?

A.Change the SERDE to 'org.apache.hadoop.hive.serde2.lazy.LazySimpleSerDe'.
B.Add 'aws_iam_role' as a table property.
C.Include the KMS key ARN in the LOCATION.
D.Set 'has_encrypted_data' to 'true'.
AnswerD

The property tells the catalog that data is encrypted.

Why this answer

When creating an external table in AWS Glue Data Catalog that references an S3 bucket with SSE-S3 encrypted objects, you must set the table property 'has_encrypted_data' to 'true'. This allows Glue to properly read the encrypted data. Option A is unnecessary; Option B is not required for encryption; Option C is for SSE-KMS, not SSE-S3.

Therefore, Option D is the correct change.

Practice this question →
52
Multi-Selecthard

A company is using AWS KMS to encrypt data in Amazon S3. The security team wants to ensure that only specific IAM roles can decrypt the data. Which TWO steps should the data engineer take? (Choose two.)

Select 2 answers
A.Use the default AWS managed KMS key for S3 (aws/s3)
B.Use SSE-S3 encryption instead of KMS
C.Create a customer-managed KMS key with a key policy that grants kms:Decrypt only to the allowed IAM roles
D.Add an IAM policy to the role that requires MFA for kms:Decrypt
E.Configure the S3 bucket to use SSE-KMS with the customer-managed key
AnswersC, E

Correct. The key policy on a customer-managed key can explicitly list which IAM roles are allowed to perform kms:Decrypt.

Why this answer

To ensure only specific IAM roles can decrypt data in S3 using KMS, you must create a customer-managed KMS key with a key policy that grants kms:Decrypt only to those roles (C). Then, configure the S3 bucket to use SSE-KMS with that key (E). This restricts decryption to only the allowed roles because the key policy explicitly controls access.

Option A uses the default AWS managed key which cannot be restricted to specific roles. Option B (SSE-S3) does not use KMS and hence cannot provide role-based decryption control. Option D, requiring MFA for decryption, adds an extra authentication factor but does not by itself restrict which roles can decrypt; it only strengthens the security of the roles that already have permission.

Therefore, D is not a step to ensure only specific roles can decrypt.

Practice this question →
53
MCQmedium

A company wants to monitor and alert on unauthorized API calls in their AWS account. Which AWS service should be used to detect and notify on such events?

A.Amazon GuardDuty and AWS Security Hub
B.Amazon VPC Flow Logs and Amazon CloudWatch Logs
C.AWS Config and AWS Systems Manager
D.AWS CloudTrail and Amazon CloudWatch Events
AnswerD

AWS CloudTrail and CloudWatch Events: CloudTrail logs API calls, and CloudWatch Events can create rules to trigger notifications on specific API calls, such as unauthorized ones.

Why this answer

D is correct because AWS CloudTrail records all API calls in the AWS account, and Amazon CloudWatch Events (or EventBridge) can be configured with rules to detect specific API calls (e.g., unauthorized actions) and trigger notifications. Option A is incorrect because Amazon GuardDuty and AWS Security Hub are threat detection and security management services, not primarily for monitoring all API calls. Option B is incorrect because Amazon VPC Flow Logs capture network traffic metadata, not API calls.

Option C is incorrect because AWS Config monitors resource configuration changes, not API calls.

Exam trap

Candidates often assume GuardDuty is the go-to for API call monitoring, but GuardDuty focuses on threat detection, not comprehensive API logging. CloudTrail is the correct service for logging all API calls.

Practice this question →
54
Multi-Selectmedium

A company is using Amazon Redshift for data warehousing. They need to ensure that data is encrypted at rest and in transit. Which TWO configurations are required to meet these requirements?

Select 2 answers
A.Enable encryption on the Redshift cluster using AWS KMS.
B.Configure the Redshift cluster to require SSL connections.
C.Use AWS CloudHSM to manage encryption keys for Redshift.
D.Enable VPC Flow Logs on the Redshift subnet.
E.Enable EBS encryption on the Redshift cluster nodes.
AnswersA, B

KMS encrypts data at rest.

Why this answer

To encrypt data at rest in Amazon Redshift, you must enable encryption on the cluster using AWS KMS (Option A). To encrypt data in transit, you must configure the cluster to require SSL connections (Option B). Option C (CloudHSM) can be used for key management but is not a required configuration.

Option D (VPC Flow Logs) captures network metadata and does not encrypt traffic. Option E (EBS encryption) is not applicable to Redshift's managed storage.

Practice this question →
55
MCQhard

A company is using an Amazon RDS for PostgreSQL database to store personally identifiable information (PII). The security team wants to ensure that database administrators cannot view the plaintext PII data. Which solution should a data engineer implement?

A.Use IAM policies to restrict DBA access to the RDS instance
B.Enable Dynamic Data Masking in RDS to obfuscate PII for all users
C.Enable encryption at rest for the RDS instance using AWS KMS
D.Use client-side encryption with AWS KMS to encrypt PII before inserting into the database
AnswerD

Client-side encryption ensures data is encrypted before reaching the database, so DBAs cannot see the plaintext.

Why this answer

Using AWS KMS with client-side encryption ensures that data is encrypted before being sent to RDS, so database administrators cannot read the plaintext. Dynamic data masking in RDS is not natively supported; application-level masking would be needed. RDS encryption at rest protects data on disk but DBAs with access can still query plaintext.

Using IAM policies to restrict access does not prevent DBAs with database credentials from viewing data.

Practice this question →
56
MCQmedium

A company uses AWS Lake Formation to manage data lake permissions. The data lake contains sensitive customer data in the 'customer' database. The security team wants to ensure that only users with a specific tag 'access_level=analyst' can query the 'customer' table. Which combination of steps should the data engineer take to enforce this?

A.In Lake Formation, create an LF-tag 'access_level' with values 'analyst' and 'admin'. Grant 'SELECT' permission on the 'customer' table to the tag value 'analyst'. Associate the LF-tag with the 'customer' table.
B.Create an IAM policy that conditionally allows 'glue:GetTable' based on the tag 'access_level=analyst'.
C.Apply a bucket policy on the S3 location of the 'customer' table that allows access only if the request carries the tag 'access_level=analyst'.
D.Use Lake Formation column-level filters to restrict access to columns based on the tag 'access_level=analyst'.
AnswerA

This uses Lake Formation TBAC to restrict access based on the user's tag.

Why this answer

Lake Formation LF-tags allow you to define metadata tags (key-value pairs) and grant permissions to those tags. By creating an LF-tag 'access_level' with values 'analyst' and 'admin', granting SELECT on the 'customer' table to the tag value 'analyst', and associating that LF-tag with the table, only principals who have the tag 'access_level=analyst' (or are granted via the tag) can query the table. This enforces tag-based access control at the Lake Formation permission layer, which is the intended mechanism for fine-grained, attribute-based access control in Lake Formation.

Exam trap

The trap here is that candidates often confuse IAM tag-based policies (Option B) or S3 bucket policies (Option C) with Lake Formation's native LF-tag mechanism, not realizing that LF-tags are a Lake Formation-specific construct that must be managed within Lake Formation itself, not at the IAM or S3 level.

How to eliminate wrong answers

Option B is wrong because an IAM policy conditionally allowing 'glue:GetTable' based on a tag controls access to the Glue Data Catalog API, but it does not enforce Lake Formation permissions on the underlying data; Lake Formation permissions override IAM policies for registered locations, and this approach would not prevent a user with the tag from querying the table if Lake Formation grants are not also configured. Option C is wrong because S3 bucket policies operate at the object storage layer and cannot evaluate Lake Formation LF-tags; they can use IAM tags via the 'aws:RequestTag' condition key, but this would require the request to carry the tag, which is not how Lake Formation principals are identified, and it would bypass Lake Formation's centralized permission model. Option D is wrong because column-level filters in Lake Formation restrict access to specific columns based on a filter expression, not based on LF-tags; LF-tags are used for row-level or table-level permission grants, not for column-level filtering.

Practice this question →
57
Multi-Selectmedium

A data engineer needs to audit all access to an S3 bucket containing sensitive data. The engineer must capture who accessed the bucket, from which IP address, and what actions were performed. Which AWS services should be used together to meet this requirement? (Choose THREE.)

Select 3 answers
A.Amazon CloudWatch Logs
B.AWS Config
C.Amazon S3 server access logs
D.AWS CloudTrail
E.VPC Flow Logs
AnswersA, C, D

Amazon CloudWatch Logs can ingest and analyze log data from various sources.

Why this answer

Amazon CloudWatch Logs (A) can ingest and analyze log data from various sources. Amazon S3 server access logs (C) provide detailed records of requests made to the S3 bucket, including the requester, IP address, and actions. AWS CloudTrail (D) records API calls with identity and source IP, enabling auditing of who accessed the bucket.

AWS Config (B) tracks resource configuration changes, not access logs. VPC Flow Logs (E) capture network traffic, not S3 API details.

Practice this question →
58
MCQeasy

Refer to the exhibit. A data engineer creates an IAM policy for a service role used by AWS Glue. What does the condition in the policy enforce?

A.The role can use the KMS key from any AWS service
B.The role can only use the KMS key when the request comes from Glue
C.The role can only use the KMS key for decrypting data
D.The role can only use the KMS key when the request comes from S3
AnswerD

kms:ViaService limits to S3 endpoints.

Why this answer

The condition uses the `kms:ViaService` key with value `s3.amazonaws.com`, which restricts KMS actions to requests originating from Amazon S3. Therefore, the role can only use the KMS key when the request comes from S3, making option D correct. Option A is incorrect because it does not allow any service; option B is incorrect because it specifies Glue instead of S3; option C is incorrect because it limits to decrypting only, but the condition does not specify the action.

Practice this question →
59
Multi-Selectmedium

A company needs to protect sensitive data stored in Amazon S3 from unauthorized access. Which TWO actions should the data engineer take? (Choose two.)

Select 2 answers
A.Configure S3 bucket policies to require MFA for delete operations
B.Enable cross-region replication for all buckets
C.Set up an S3 Lifecycle policy to transition objects to Glacier
D.Enable S3 Block Public Access at the account level
E.Enable S3 Versioning on all buckets
AnswersA, D

Correct. Using S3 bucket policies with a condition that requires MFA for delete operations prevents unauthorized users from deleting objects, adding an additional security layer.

Why this answer

S3 Block Public Access at the account level prevents any public access to S3 buckets, ensuring data is not exposed. Requiring MFA for delete operations via bucket policies adds an extra layer of security by requiring a second factor. Cross-region replication is for disaster recovery, not security.

Lifecycle policies manage storage costs. Versioning protects against accidental deletion but does not prevent unauthorized access.

Practice this question →
60
MCQhard

A company uses Amazon Redshift for data warehousing. The security team requires that all data be encrypted at rest using a key managed by the company. Which Redshift encryption option should be used?

A.Enable encryption using AWS managed key (default)
B.Use SSL/TLS encryption
C.Use hardware security module (HSM)
D.Specify a customer managed KMS key when enabling encryption
AnswerD

Redshift allows you to specify a customer managed KMS key for encryption.

Why this answer

Amazon Redshift supports encryption at rest using AWS KMS. To use a key managed by the company (customer managed key), you must specify a customer managed KMS key when enabling encryption. Option D is correct.

Option A uses an AWS managed key (default), which is not managed by the company. Option B refers to encryption in transit, not at rest. Option C: HSM is not directly supported for Redshift encryption; KMS is used.

Practice this question →
61
MCQmedium

A company wants to grant cross-account access to an S3 bucket without using IAM roles. The data engineer needs to write a bucket policy that allows another AWS account to list objects. Which Principal should be specified in the bucket policy?

A.The AWS account ID that owns the bucket
B.The AWS account ID of the other account
C.The IAM user ARN in the other account
D.The root user of the other account
AnswerB

The Principal should be the other account's ID.

Why this answer

Specifying the AWS account ID of the other account as the Principal in the bucket policy grants cross-account access to all users and roles in that account, allowing them to list objects. Option A is incorrect because the owning account's ID would grant access to itself, not the other account. Option C is incorrect because specifying an IAM user ARN would restrict access to only that user, not the entire account.

Option D is incorrect because the root user is a specific principal, not the account-wide access needed for cross-account delegation.

Practice this question →
62
MCQhard

A data engineer is designing a data lake on Amazon S3 that must comply with a regulatory requirement to prevent any data from being overwritten or deleted for 7 years after creation. Which S3 feature should be used?

A.S3 bucket policy that denies s3:DeleteObject
B.S3 bucket versioning with MFA Delete
C.S3 Object Lock with retention mode set to COMPLIANCE
D.S3 bucket versioning only
AnswerC

COMPLIANCE retention prevents any deletion or overwrite during the retention period.

Why this answer

S3 Object Lock with retention mode set to COMPLIANCE ensures that objects cannot be overwritten or deleted for the specified retention period (7 years). The retention period cannot be shortened or removed by any user, including the root user, making it suitable for regulatory compliance. Option A is incorrect because a bucket policy that denies s3:DeleteObject can be modified or removed, and it does not prevent overwrites.

Option B is incorrect because MFA Delete requires an additional authentication factor but can still be disabled by an authorized user, and it does not enforce a retention period. Option D is incorrect because bucket versioning alone does not prevent deletion; it only creates delete markers, and objects can still be permanently deleted.

Practice this question →
63
MCQeasy

Refer to the exhibit. A data engineer checks the versioning status of an S3 bucket and sees the above output. The bucket contains critical logs that must not be permanently deleted. What should the engineer do to enhance protection against accidental or malicious deletion?

A.Enable MFA Delete on the bucket
B.Enable versioning on the bucket
C.Enable cross-region replication
D.Configure a lifecycle policy to expire noncurrent versions
AnswerA

MFA Delete requires additional authentication to permanently delete versions, protecting against accidental or malicious deletion.

Why this answer

Enabling MFA Delete on the bucket requires multi-factor authentication to delete object versions, which adds protection. Versioning is already enabled, so that is not needed. Enabling Object Lock with retention mode is another option, but the question asks for enhancement using the current setup; MFA Delete is a direct enhancement.

A lifecycle policy does not prevent deletion. Cross-region replication is for disaster recovery, not deletion protection.

Practice this question →
64
MCQhard

A company stores sensitive customer data in an Amazon S3 bucket with versioning enabled. A data engineer accidentally deleted the current version of an object. What is the quickest way to restore the object to its previous state without additional data transfer costs?

A.Use S3 Batch Operations to restore the object from the Recycle Bin.
B.Delete the delete marker that was created by the deletion.
C.Copy the previous version from the bucket to itself.
D.Use the S3 sync command to restore the previous version.
AnswerB

Deleting the delete marker restores the previous version as the current object without copying data.

Why this answer

With S3 versioning enabled, deleting an object does not permanently remove it; instead, a delete marker is placed. To restore the object to its previous state, you simply remove the delete marker, which makes the previous version the current version again. Option A is incorrect because S3 does not have a Recycle Bin; S3 Batch Operations are for bulk actions but not for restoring from a recycle bin.

Option C would not restore the object properly; copying the previous version to itself would create a new version, not restore the original. Option D is incorrect because the s3 sync command synchronizes objects between locations and does not restore previous versions.

Practice this question →
65
MCQeasy

A company uses AWS Glue to process sensitive data stored in Amazon S3. The security team requires that all data in transit between AWS Glue and S3 be encrypted. Which configuration should be used to meet this requirement?

A.Use an S3 bucket policy that denies requests not using HTTPS.
B.Use an AWS KMS key to encrypt the data before uploading to S3.
C.Configure AWS Glue to use SSL by setting the 'ssl' parameter to 'true'.
D.Enable default encryption on the S3 bucket using SSE-S3.
AnswerA

This enforces encryption in transit for all requests.

Why this answer

Requiring HTTPS for all requests to the S3 bucket ensures that data in transit between AWS Glue and S3 is encrypted using TLS. By using an S3 bucket policy with a condition that denies requests where `aws:SecureTransport` is false, the company enforces encryption for all connections, including those from AWS Glue. This meets the security requirement without needing to modify Glue or S3 configurations beyond the bucket policy.

Exam trap

The trap here is that candidates often confuse encryption at rest (SSE-S3, SSE-KMS, client-side encryption) with encryption in transit (TLS/HTTPS), and may incorrectly assume that enabling default encryption or using KMS keys secures the data during transfer.

How to eliminate wrong answers

Option B is wrong because encrypting data with an AWS KMS key before uploading to S3 (client-side encryption) protects data at rest, not data in transit; the security team specifically requires encryption in transit. Option C is wrong because AWS Glue does not have an 'ssl' parameter; Glue uses HTTPS by default when connecting to S3, and this setting is not configurable via a simple parameter. Option D is wrong because enabling default encryption on the S3 bucket (SSE-S3) only encrypts data at rest, not data in transit between Glue and S3.

Practice this question →
66
MCQmedium

An organization needs to audit all access to their S3 buckets for compliance purposes. They want to log both successful and failed API calls. Which AWS service should be used?

A.Amazon CloudWatch Logs
B.AWS Config
C.AWS CloudTrail
D.VPC Flow Logs
AnswerC

CloudTrail logs API calls for auditing.

Why this answer

AWS CloudTrail is the correct service because it records all API calls made to S3, including both successful and failed requests, and delivers log files to an S3 bucket for auditing and compliance. CloudTrail captures management events (e.g., CreateBucket) and, when enabled, data events (e.g., GetObject, PutObject) for S3, providing a complete audit trail of access.

Exam trap

The trap here is that candidates often confuse AWS CloudTrail (API auditing) with AWS Config (configuration auditing) or VPC Flow Logs (network traffic logging), failing to recognize that only CloudTrail captures the specific API call details needed for access auditing.

How to eliminate wrong answers

Option A is wrong because Amazon CloudWatch Logs is used for monitoring, storing, and accessing log files from various AWS services (e.g., EC2, Lambda), but it does not natively capture S3 API calls; it can only receive logs forwarded from CloudTrail or other sources. Option B is wrong because AWS Config is a service for evaluating resource configurations against desired policies and tracking configuration changes, not for logging API calls or access events. Option D is wrong because VPC Flow Logs capture IP traffic metadata (source/destination IP, ports, protocol) at the network interface level, not S3 API-level operations or authentication details.

Practice this question →
67
MCQeasy

A company uses Amazon RDS for MySQL to store application data. The database contains personally identifiable information (PII). The security team requires that all data be encrypted at rest using AWS KMS. The database is currently unencrypted. The data engineer needs to enable encryption without significant downtime. Which approach should the data engineer take?

A.Use AWS DMS to migrate data to a new encrypted RDS instance continuously.
B.Take a snapshot of the database, copy it with encryption enabled, and restore from the encrypted snapshot.
C.Create a read replica with encryption enabled and promote it to primary.
D.Modify the RDS instance and enable encryption in the configuration.
AnswerB

Standard procedure to enable encryption on existing RDS.

Why this answer

To enable encryption on an existing unencrypted RDS instance, you must take a snapshot of the database, copy it with encryption enabled (using AWS KMS), and restore from the encrypted snapshot. This process involves downtime during the restore but is the only supported method. Option A is incorrect because AWS DMS can migrate data to a new encrypted RDS instance, but that adds complexity and is not the simplest approach.

Option C is incorrect because read replicas cannot be promoted to primary if encryption is enabled on the replica but not on the source; also, the source must be encrypted. Option D is incorrect because you cannot modify an existing RDS instance to enable encryption directly; encryption can only be enabled when creating a new instance from an encrypted snapshot.

Practice this question →
68
MCQmedium

A company uses AWS Lake Formation to manage permissions on a data lake stored in S3. A data scientist is unable to query a table in Amazon Athena, receiving an 'Access Denied' error. The data scientist has IAM permissions to call Athena and has been granted SELECT permission on the table in Lake Formation. What is the most likely cause?

A.The data scientist does not have DESCRIBE permission on the table.
B.The data is encrypted with SSE-KMS and the data scientist lacks kms:Decrypt permission.
C.The S3 bucket policy denies access to the data scientist's IAM role.
D.The S3 bucket containing the data is not registered as a Lake Formation location.
AnswerD

Prevents Lake Formation from granting S3 access.

Why this answer

The most likely cause is that the S3 bucket containing the data is not registered as a Lake Formation location. Lake Formation manages permissions for registered S3 locations, but if the bucket is not registered, Lake Formation cannot enforce its permissions, and the data scientist would rely on S3 bucket policies, which may deny access. Option A is incorrect because DESCRIBE permission is not required for querying.

Option B is incorrect because encryption is not mentioned as an issue. Option C is incorrect because bucket policies are not the primary issue if the bucket is registered; the error occurs because the bucket is not registered.

Practice this question →
69
MCQmedium

A data engineer needs to ensure that an S3 bucket can only be accessed from a specific VPC. Which policy element should be used?

A.Use the condition key aws:VpcSourceIp in the bucket policy.
B.Use the condition key aws:SourceIp in the bucket policy.
C.Use the condition key aws:SourceVpce in the bucket policy.
D.Use the condition key aws:SourceVpc in the bucket policy.
AnswerD

This restricts access to requests from the specified VPC.

Why this answer

The condition key aws:SourceVpc restricts requests to originate from a specific VPC. Option C (aws:SourceVpce) limits access to a VPC endpoint, not the VPC itself. Option B (aws:SourceIp) restricts by IP address, not VPC.

Option A (aws:VpcSourceIp) is not a valid condition key.

Practice this question →
70
MCQeasy

A data engineer needs to grant an IAM role read-only access to Amazon DynamoDB tables in a specific AWS account. Which IAM policy element should be used to restrict access to only the 'GetItem' and 'Query' actions?

A.Resource
B.Action
C.Effect
D.Condition
AnswerB

Action specifies the API actions like GetItem and Query.

Why this answer

The 'Action' element specifies the allowed API actions. 'Effect' is 'Allow' or 'Deny'. 'Resource' specifies the ARN. 'Condition' adds conditions. So Action is correct.

Practice this question →
71
Multi-Selectmedium

A data engineer is configuring a data lake on Amazon S3 that contains sensitive customer information. The company requires that all access to this data be logged and monitored, and that any data shared with external partners must be anonymized before leaving the S3 bucket. Which combination of AWS services should the engineer use to meet these requirements? (Choose THREE.)

Select 3 answers
A.AWS WAF
B.AWS Lake Formation
C.AWS CloudTrail
D.AWS Direct Connect
E.Amazon Macie
AnswersB, C, E

Lake Formation provides fine-grained access control and can be used to enforce anonymization policies.

Why this answer

AWS Lake Formation (B) is correct because it provides fine-grained access control and data anonymization capabilities for data lakes on Amazon S3. It allows you to define column-level and row-level security policies, and can automatically anonymize sensitive data (e.g., via masking or tokenization) before it is shared with external partners, ensuring compliance with data governance requirements.

Exam trap

The trap here is that candidates often confuse AWS WAF (a web-layer security tool) with data-level security, or assume Direct Connect provides logging and monitoring, when in fact neither service addresses S3 data access logging or anonymization.

Practice this question →
72
MCQhard

A data team uses AWS Glue ETL jobs to process data from an S3 bucket (s3://data-lake-raw) and write results to another S3 bucket (s3://data-lake-processed). Both buckets are encrypted with SSE-KMS using the same KMS key (alias 'data-key'). The Glue job runs in the same account. The team recently enabled S3 Server Access Logging for the raw bucket, sending logs to a separate logging account. After enabling logging, the Glue job starts failing with 'AccessDenied' when reading from the raw bucket. The Glue job's IAM role has s3:GetObject permission on the raw bucket. Which additional permission is most likely missing?

A.s3:GetBucketLocation on the raw bucket.
B.kms:Decrypt on the KMS key (alias 'data-key').
C.s3:PutObject on the processed bucket.
D.kms:GenerateDataKey on the KMS key.
AnswerB

The Glue job needs permission to decrypt the objects using the KMS key.

Why this answer

When S3 Server Access Logging is enabled for a bucket encrypted with SSE-KMS, the S3 service must write log objects to the target bucket. If the target bucket is in a different account, the S3 service needs permission to use the KMS key. However, the failure is on the Glue job reading from the raw bucket, not writing logs.

The issue could be that the raw bucket's S3 access log delivery writes to a target bucket that uses a different KMS key, but that would affect logging, not Glue reads. Re-reading: The Glue job reading the raw bucket fails after enabling logging. It's likely that the raw bucket policy was modified to allow log delivery, inadvertently restricting other access.

Actually, the most likely cause is that the S3 bucket policy now includes a condition that denies access unless a specific header is present, or the KMS key policy was changed. Given the options, the correct answer is that the KMS key policy for the data-key now denies the Glue role because the S3 service principal was added for cross-account logging. But the Glue role needs kms:Decrypt permission.

The scenario says the same key is used for both buckets. The correct answer is B: The KMS key policy does not allow the Glue role to decrypt because the S3 log delivery service is using the key and the key policy may have a condition. Actually, the most direct answer: The Glue role is missing kms:Decrypt permission on the KMS key.

But the team might have added a statement to allow S3 logging that inadvertently denies the Glue role. However, the simplest answer is that the Glue role lacks kms:Decrypt. But the question says 'Which additional permission is most likely missing?' The options are specific permissions.

I'll go with the need for kms:Decrypt on the KMS key.

Practice this question →
73
MCQhard

A data engineer runs the command shown in the exhibit to check the bucket policy. A user from another AWS account is trying to download an object using HTTP (not HTTPS). What will happen?

A.The download will succeed because the principal is not specified
B.The download will fail with an access denied error
C.The download will succeed if the object is encrypted at rest
D.The download will succeed because the policy only denies write operations
AnswerB

The policy denies access when using HTTP.

Why this answer

The bucket policy denies all actions when aws:SecureTransport is false (i.e., HTTP). Therefore, HTTP requests are denied. Option A is wrong because the policy denies HTTP requests.

Option C is wrong because the policy does not require encryption at rest. Option D is wrong because the policy explicitly denies HTTP.

Practice this question →
74
MCQmedium

Refer to the exhibit. A data engineer applied this bucket policy to an S3 bucket. What is the effect of this policy?

A.Allows only HTTPS requests to get objects
B.Blocks HTTP requests to get objects
C.Allows only HTTP requests to get objects
D.Blocks all access to the bucket
AnswerB

The Deny effect with condition aws:SecureTransport false blocks HTTP requests.

Why this answer

The bucket policy denies the s3:GetObject action when the request is made over HTTP (i.e., when aws:SecureTransport equals false). This effectively blocks HTTP requests to get objects, while allowing HTTPS requests. Therefore, Option B is correct.

Option A is incorrect because the policy blocks HTTP, not allows it. Option C is incorrect because the policy blocks HTTP, not allows it. Option D is incorrect because the policy only blocks insecure transport, not all access.

Practice this question →
75
MCQeasy

A company wants to grant read-only access to an S3 bucket for a data analyst. The analyst should be able to list objects and read object content. Which IAM policy effect and action combination is correct?

A.Effect: Allow, Actions: s3:GetObject, s3:DeleteObject
B.Effect: Allow, Actions: s3:ListAllMyBuckets, s3:GetObject
C.Effect: Allow, Actions: s3:PutObject, s3:GetObject
D.Effect: Allow, Actions: s3:ListBucket, s3:GetObject
AnswerD

Provides read-only access to list and read objects.

Why this answer

S3:ListBucket allows listing objects in the bucket, and s3:GetObject allows reading object content. This combination provides read-only access. Option A is incorrect because s3:DeleteObject grants delete permissions.

Option B is incorrect because s3:ListAllMyBuckets lists all buckets, not bucket contents. Option C is incorrect because s3:PutObject grants write access.

Practice this question →
Page 1 of 5 · 318 questions totalNext →

Ready to test yourself?

Try a timed practice session using only Data Security and Governance questions.

Start 20-question session