Courseiva

CCNA Data Security and Governance Questions

75 of 318 questions · Page 2/5 · Data Security and Governance · Answers revealed

Practice these questionsDomain overviewAll questions
76
MCQeasy

A company is using AWS Lake Formation to manage permissions on a data lake. They want to grant a data scientist the ability to query tables in the 'analytics' database using Amazon Athena, but prevent them from accessing the underlying S3 data directly. What is the best way to achieve this?

A.Grant the data scientist an IAM policy with s3:GetObject on the S3 bucket.
B.Grant SELECT permission on the 'analytics' database tables in Lake Formation.
C.Create an IAM policy that allows Athena queries only.
D.Add the data scientist to a Lake Formation data lake location with read access.
AnswerB

Lake Formation fine-grained permissions allow querying via Athena without direct S3 access.

Why this answer

Lake Formation grants SELECT permission on named database tables, which allows querying via Athena without granting direct S3 access. Option A is incorrect because granting s3:GetObject on the entire bucket would allow the data scientist to bypass Lake Formation and access the data directly. Option C is incorrect because a policy that allows Athena queries only does not grant the necessary permissions to access the database tables.

Option D is incorrect because adding the user to a data lake location with read access is too broad and would also grant direct S3 access, which does not meet the requirement of preventing direct S3 access.

Practice this question →
77
MCQeasy

A company uses Amazon RDS for MySQL with encryption at rest enabled. The security team requires that all database audit logs be stored in Amazon S3 for at least 7 years. Which AWS service should the data engineer use to collect and store the logs?

A.Amazon S3 with S3 Object Lock enabled for write-once-read-many (WORM) protection.
B.Amazon Kinesis Data Firehose to stream logs directly to Amazon S3.
C.Amazon CloudWatch Logs with a subscription filter to Amazon S3.
D.AWS CloudTrail to capture database queries and store in S3.
AnswerC

RDS audit logs can be sent to CloudWatch Logs, and then exported to S3.

Why this answer

Amazon RDS for MySQL can publish audit logs to Amazon CloudWatch Logs. A subscription filter can then forward these logs to Amazon S3 for long-term storage, satisfying the 7-year retention requirement. Option A is wrong because S3 Object Lock is a storage feature, not a log collection service.

Option B is wrong because Kinesis Data Firehose is not natively integrated with RDS audit logs. Option D is wrong because AWS CloudTrail captures API calls, not database audit logs.

Practice this question →
78
MCQmedium

Refer to the exhibit. This KMS key policy is attached to a customer managed key. A data engineer finds that the DataEngineer role can encrypt but cannot decrypt data. What is the most likely cause?

A.The key policy does not include kms:Decrypt in the IAM policy section
B.The role does not have an IAM policy allowing kms:Decrypt
C.The key policy does not allow kms:Decrypt
D.The key policy does not allow kms:GenerateDataKey
AnswerB

The role needs an IAM policy that allows kms:Decrypt; the key policy alone is insufficient for IAM roles.

Why this answer

The key policy allows kms:Decrypt and kms:GenerateDataKey for the DataEngineer role, so the role can encrypt. However, KMS requires both key policy and IAM policy permissions for IAM roles. Since the role lacks an IAM policy that grants kms:Decrypt, it cannot decrypt.

Option A is incorrect because the key policy does include kms:Decrypt. Option C is incorrect because the key policy explicitly allows kms:Decrypt. Option D is incorrect because kms:GenerateDataKey is allowed in the policy; the issue is with decrypt.

Practice this question →
79
MCQmedium

A company uses Amazon Redshift for data warehousing. The security team requires that all data stored in Redshift be encrypted at rest using a customer-managed KMS key. How should the data engineer configure this?

A.Enable encryption using a KMS key when creating the Redshift cluster
B.Configure S3 SSE-KMS on the underlying S3 storage
C.Use the AWS KMS console to encrypt the Redshift cluster after creation
D.Set a cluster parameter group with encryption enabled
AnswerA

Encryption must be enabled at launch; you cannot add it later.

Why this answer

Redshift supports encryption at rest using KMS. You enable encryption when launching the cluster by choosing a KMS key. Option B is wrong because Redshift doesn't use S3 SSE-KMS for its own storage.

Option C is wrong because you cannot encrypt an existing cluster without restoring from snapshot. Option D is wrong because cluster parameter groups do not control encryption. Option A is correct.

Practice this question →
80
MCQmedium

A data engineering team needs to encrypt data at rest in an Amazon S3 bucket that stores sensitive customer information. The team must use an AWS Key Management Service (AWS KMS) customer managed key with automatic rotation enabled. Which configuration meets these requirements?

A.Use default encryption with SSE-KMS and specify the customer managed key ID.
B.Use default encryption with SSE-S3.
C.Use default encryption with SSE-C and provide a customer-provided key.
D.Use default encryption with SSE-KMS and leave the key ID empty to use the AWS managed key.
AnswerA

SSE-KMS with a customer managed key allows automatic rotation and customer control.

Why this answer

It enables SSE-KMS with a customer managed key that supports automatic key rotation, meeting the requirement for a customer managed key with automatic rotation. Option B is incorrect because SSE-S3 uses AWS managed keys that are not customer-controlled and do not support automatic rotation. Option C is incorrect because SSE-C requires the customer to provide and manage their own keys, and does not support automatic rotation.

Option D is incorrect because leaving the key ID empty defaults to the AWS managed KMS key, which is not a customer managed key and does not support automatic rotation.

Practice this question →
81
MCQmedium

A data engineer applies the above bucket policy to an S3 bucket containing sensitive data. The goal is to allow only encrypted (HTTPS) requests. However, a user reports being able to access an object using an HTTP (non-HTTPS) request. What is the most likely reason?

A.The policy uses Allow instead of Deny
B.The resource ARN does not include the bucket itself
C.The condition key aws:SecureTransport is used with BoolIfExists instead of Bool
D.The principal is set to "*", which allows anonymous access
AnswerC

BoolIfExists allows access if the key is missing, which happens with HTTP.

Why this answer

The policy uses "BoolIfExists" instead of "Bool" for the aws:SecureTransport condition. "BoolIfExists" evaluates to true if the key is absent (as in HTTP requests), thus the Deny effect is not triggered, allowing HTTP access. Option A is wrong because using Allow or Deny is not the issue; the condition key's evaluation is the problem. Option B is incorrect because the resource ARN must include the bucket itself when using bucket policies, but this is not relevant here.

Option D is wrong because a principal of "*" includes all authenticated users (not anonymous).

Practice this question →
82
MCQmedium

A company uses Amazon RDS for MySQL to store transactional data. The database contains sensitive financial information. The company's security policy requires that all data at rest be encrypted using a customer-managed KMS key. The database was originally launched without encryption at rest. The security team now needs to enable encryption without significant downtime. What should they do?

A.Create a snapshot of the database, copy the snapshot with encryption enabled, and restore a new DB instance from the encrypted snapshot.
B.Enable encryption by modifying the DB instance's storage type to 'encrypted'.
C.Use the AWS DMS (Database Migration Service) to migrate data to a new encrypted RDS instance.
D.Modify the DB instance and enable encryption under the 'Storage' settings.
AnswerA

This is the standard procedure to enable encryption on an existing RDS instance.

Why this answer

You cannot enable encryption on an existing RDS instance directly. To encrypt an unencrypted RDS instance, you must create a snapshot, copy it with encryption enabled using a customer-managed KMS key, and then restore a new encrypted DB instance. This method minimizes downtime.

Options B and D are incorrect because modifying the DB instance's storage settings does not allow enabling encryption in place. Option C (using DMS) could also achieve encryption but involves more downtime and complexity than the snapshot approach.

Practice this question →
83
MCQmedium

A data engineer is configuring an S3 bucket to host sensitive data. The security policy requires that all objects be encrypted with a key that is generated and managed by the customer, and that the key be stored in AWS KMS. Which encryption option should be used?

A.Server-Side Encryption with S3-Managed Keys (SSE-S3)
B.Client-Side Encryption
C.Server-Side Encryption with Customer-Provided Keys (SSE-C)
D.Server-Side Encryption with AWS KMS-Managed Keys (SSE-KMS)
AnswerD

SSE-KMS allows using customer-managed keys in KMS.

Why this answer

SSE-KMS allows you to use customer-managed keys stored in AWS KMS, meeting the requirement for customer-generated and managed keys. Option A is incorrect because SSE-S3 uses AWS-managed keys, not customer-managed. Option B is incorrect because client-side encryption encrypts data outside S3, not using S3 server-side encryption.

Option C is incorrect because SSE-C uses customer-provided keys that you manage yourself, but they are not stored in AWS KMS—you must provide them with each request.

Practice this question →
84
MCQmedium

A data engineer is setting up a data pipeline that ingests streaming data from Amazon Kinesis Data Streams into an S3 data lake using Amazon Kinesis Data Firehose. The data contains personally identifiable information (PII). The security team requires that all data be encrypted at rest in S3 using an AWS KMS customer managed key (CMK) that is specific to the application. Additionally, the data must be encrypted in transit between all services. The engineer creates the KMS key and configures Firehose to use server-side encryption with the key for the S3 destination. However, Firehose delivery fails with an error indicating that the KMS key is not accessible. What is the most likely cause?

A.The KMS key policy does not grant the firehose.amazonaws.com service principal the required permissions.
B.The Kinesis data stream is not encrypted at rest.
C.The Firehose delivery stream is not in the same region as the KMS key.
D.The S3 bucket policy does not grant the Firehose delivery stream access to write objects.
AnswerA

Firehose must be allowed to use the key via the key policy.

Why this answer

Kinesis Data Firehose needs permission to use the KMS key. The key policy must grant the Firehose service principal (firehose.amazonaws.com) permission to call kms:GenerateDataKey and kms:Decrypt. Without this, Firehose cannot encrypt the data.

Practice this question →
85
Multi-Selecteasy

A data engineer needs to monitor and log changes to IAM policies in an AWS account. Which TWO AWS services can be used together to achieve this?

Select 2 answers
A.Amazon GuardDuty
B.AWS Config
C.VPC Flow Logs
D.AWS CloudTrail
E.Amazon CloudWatch Logs
AnswersD, E

CloudTrail records all IAM API calls.

Why this answer

AWS CloudTrail logs all IAM API calls, including policy changes. Amazon CloudWatch Logs can be used to store, monitor, and alert on these log events. Option A (GuardDuty) is a threat detection service, not for logging policy changes.

Option B (AWS Config) tracks resource configuration changes but not API calls directly. Option C (VPC Flow Logs) captures network traffic, not IAM activities. Therefore, the correct combination is D and E.

Practice this question →
86
MCQmedium

A company uses AWS KMS to encrypt data at rest in Amazon S3. The security team requires that all encryption keys be automatically rotated every year. Which key type should be used to meet this requirement without manual intervention?

A.Use a customer managed key with automatic rotation enabled.
B.Use an imported key material because it supports automatic rotation.
C.Use a KMS key generated by S3 on each object upload.
D.Use an AWS managed key (aws/s3).
AnswerA

Correct. Customer managed keys with automatic rotation enabled rotate annually after the one-time manual enablement, meeting the requirement without ongoing manual intervention.

Why this answer

AWS customer managed keys (CMKs) with automatic rotation enabled rotate every year, meeting the requirement of annual rotation. While enabling automatic rotation requires a one-time manual configuration, after that no further manual intervention is needed, and the rotation occurs automatically. AWS managed keys (aws/s3) rotate automatically every three years, not annually, so they do not satisfy the yearly rotation requirement.

Imported key material cannot be rotated, and S3 does not generate a KMS key per upload. Therefore, option A is correct.

Practice this question →
87
MCQhard

A company has an S3 bucket with versioning enabled and a bucket policy that denies access if the request does not include encryption. A data engineer notices that some objects are not encrypted. What is the most likely cause?

A.The bucket policy does not evaluate requests from the same account.
B.The policy only applies to new uploads; existing objects remain unencrypted.
C.Default encryption was not enabled at the bucket level.
D.Versioning was enabled after the objects were uploaded.
AnswerB

Correct. The policy only enforces encryption on new uploads; existing objects remain as they were before the policy was applied.

Why this answer

A bucket policy that denies unencrypted requests only applies to new uploads made after the policy is effective. Objects already in the bucket remain unencrypted. Option A is wrong because bucket policies apply to all requests, including those from the same account.

Option C is wrong because default encryption would only apply to new objects, not existing ones. Option D is wrong because versioning does not retroactively encrypt existing objects.

Practice this question →
88
MCQhard

A company runs a data lake on Amazon S3 with AWS Glue and Amazon Athena. The security team recently ran a report using Amazon Macie and found that multiple S3 objects containing PII are publicly accessible. The data engineer is tasked with remediating this issue immediately. The S3 bucket is configured with a bucket policy that grants public read access to all objects. The data engineer needs to ensure that no objects are publicly accessible while maintaining the ability for authorized IAM users and roles to access the data via Athena. The bucket must also remain accessible to the Glue crawler. What is the MOST effective course of action?

A.Use Amazon Macie to automatically remediate the public access by updating the object ACLs.
B.Remove the bucket policy granting public access and attach an IAM policy to the Glue and Athena roles to allow access to the bucket.
C.Set the bucket ACL to private and add a bucket policy that allows access to the Glue crawler and Athena.
D.Enable S3 Block Public Access on the bucket and use a bucket policy to allow access from the Glue and Athena service principals.
AnswerB

This removes public access while allowing authorized access.

Why this answer

The most effective because it removes the public access grant while using IAM policies to authorize only the necessary roles (Glue and Athena). Option A is incorrect because Amazon Macie only identifies PII and cannot remediate access controls. Option C is insufficient because setting the bucket ACL to private does not change existing object ACLs that may grant public access, and using a bucket policy alone does not address object ACL overrides.

Option D is incorrect because S3 Block Public Access prevents all public access but using service principals (like the Glue or Athena service principal) is not appropriate for intra-account access; IAM roles must be used to allow authorized users and services.

Practice this question →
89
Multi-Selecthard

A data engineer needs to ensure that an S3 bucket policy follows the principle of least privilege. Which of the following are valid conditions to restrict access based on the requester's identity? (Choose TWO.)

Select 2 answers
A.aws:PrincipalOrgID
B.s3:x-amz-server-side-encryption
C.aws:Referer
D.aws:SourceIp
E.aws:userId
AnswersA, E

Correct. This condition checks the organization ID of the requesting principal, which is an identity attribute.

Why this answer

Options A and E are correct. aws:PrincipalOrgID restricts access to IAM principals within a specific AWS Organization, directly tied to the requester's identity. aws:userId restricts access to a specific IAM user ID, also an identity attribute. Option D (aws:SourceIp) is a network condition based on IP address, not the requester's identity, so it does not meet the requirement. Options B (s3:x-amz-server-side-encryption) and C (aws:Referer) are not identity-based conditions.

Exam trap

The phrase 'based on the requester's identity' can be misleading. Network conditions like aws:SourceIp are not considered identity-based; only attributes like user ID, role ID, or organization ID qualify.

Practice this question →
90
MCQhard

Refer to the exhibit. A data engineer runs the AWS CLI command to look up GetObject events. The output shows an event from the DataEngineer role. However, the engineer suspects that some GetObject requests are not being logged. What is the MOST likely reason?

A.The IAM role does not have permission to read the CloudTrail logs.
B.The CloudTrail trail is not configured to log data events.
C.The trail is not enabled in the us-east-1 region.
D.The S3 bucket is in a different region than the CloudTrail trail.
AnswerB

By default, CloudTrail does not log data events for S3 objects; they must be enabled.

Why this answer

CloudTrail must have Data Events enabled for S3 object-level operations such as GetObject. Option A is wrong because the event is logged, so the trail exists. Option C is wrong because the engineer is looking up events, not configuring logging.

Option D is wrong because the lookup is for a specific region, but the bucket might be in a different region, but that would not cause missing logs if events are logged in the bucket's region.

Practice this question →
91
MCQhard

Refer to the exhibit. A data engineer is running an AWS Glue job that reads from an S3 bucket encrypted with a customer-managed KMS key. The job fails with the error shown. What is the most likely cause?

A.The S3 bucket policy denies the kms:Decrypt action.
B.The IAM role used by the Glue job is missing the kms:Decrypt permission.
C.The Glue job does not have permission to call kms:GenerateDataKey.
D.The KMS key policy does not grant the Glue service principal access.
AnswerB

The error says no identity-based policy allows kms:Decrypt.

Why this answer

The error indicates that the AWS Glue job cannot access the S3 bucket because it lacks the necessary KMS permissions. Since the bucket is encrypted with a customer-managed KMS key, the IAM role assigned to the Glue job must include the kms:Decrypt permission to read the encrypted objects. Without this permission, the job fails when attempting to decrypt the data.

Exam trap

AWS often tests the distinction between kms:Decrypt and kms:GenerateDataKey, leading candidates to mistakenly choose the latter when the job is only reading data, not writing or generating new encryption keys.

How to eliminate wrong answers

Option A is wrong because the S3 bucket policy denying kms:Decrypt would cause a different error (e.g., Access Denied), but the error shown specifically points to a missing permission, not a denial. Option C is wrong because kms:GenerateDataKey is used for encrypting new data, not for reading existing encrypted objects; the job only needs kms:Decrypt to read the encrypted data. Option D is wrong because the KMS key policy does not need to grant the Glue service principal directly; the IAM role used by the Glue job is the entity that requires the kms:Decrypt permission, and the key policy must allow that role (or the account) to use the key.

Practice this question →
92
Multi-Selectmedium

A data engineer is configuring an S3 bucket policy to allow cross-account access for a partner organization to write data to a specific prefix. The partner's AWS account ID is 111111111111. The engineer wants to ensure that only the partner can write, and that the partner cannot read or delete objects. Which policy statements should be included? (Choose TWO.)

Select 2 answers
A.{"Effect":"Allow","Principal":{"AWS":"arn:aws:iam::111111111111:user/PartnerUser"},"Action":"s3:PutObject","Resource":"arn:aws:s3:::mybucket/partner/*"}
B.{"Effect":"Allow","Principal":"*","Action":"s3:PutObject","Resource":"arn:aws:s3:::mybucket/partner/*","Condition":{"StringEquals":{"aws:SourceAccount":"111111111111"}}}
C.{"Effect":"Allow","Principal":{"AWS":"111111111111"},"Action":"s3:PutObject","Resource":"arn:aws:s3:::mybucket/partner/*"}
D.{"Effect":"Allow","Principal":{"AWS":"111111111111"},"Action":["s3:GetObject","s3:DeleteObject"],"Resource":"arn:aws:s3:::mybucket/partner/*"}
E.{"Effect":"Deny","Principal":{"AWS":"111111111111"},"NotAction":"s3:PutObject","Resource":"arn:aws:s3:::mybucket/partner/*"}
AnswersC, E

Grants write access to the prefix.

Why this answer

The correct answers are C and E. Option C allows the partner account to perform s3:PutObject on the specified prefix, granting write access. Option E explicitly denies all actions except s3:PutObject, ensuring the partner cannot read or delete objects.

Option A is incorrect because it specifies a user ARN instead of the account ARN, which would not allow all users in the partner account. Option B grants access to any principal with a condition, but the condition uses aws:SourceAccount which is not appropriate for cross-account access via bucket policy. Option D grants read and delete, which violates the requirement.

Practice this question →
93
MCQeasy

A company is using Amazon Redshift for data warehousing. They need to ensure that all queries are logged for audit purposes. Which AWS service should be used to capture query logs?

A.AWS CloudTrail
B.Amazon S3
C.Amazon CloudWatch Logs
D.Amazon Athena
AnswerC

Amazon CloudWatch Logs is the service used to capture Redshift query logs for audit purposes.

Why this answer

Amazon Redshift can be configured to publish audit logs, including query logs, to Amazon CloudWatch Logs, which provides a centralized log management service. Option A is incorrect because AWS CloudTrail captures API activity within your AWS account, not specific database query logs. Option B is incorrect because Amazon S3 is a storage service, not a logging service.

Option D is incorrect because Amazon Athena is an interactive query service used to analyze data in S3, not a logging service.

Practice this question →
94
MCQeasy

A company uses Amazon Athena to query data in S3. The security team wants to ensure that users can only query tables they have permissions to in the AWS Glue Data Catalog. Which service should be used to manage these permissions centrally?

A.AWS Lake Formation
B.AWS IAM
C.AWS CloudTrail
D.S3 bucket policies
AnswerA

Lake Formation provides fine-grained access control to Data Catalog resources.

Why this answer

Lake Formation provides centralized permissions management for the Glue Data Catalog. Option B (IAM) is too low-level and does not integrate directly with Data Catalog tables. Option C (S3 bucket policy) does not control table access.

Option D (CloudTrail) is for auditing, not access control.

Practice this question →
95
MCQhard

A company uses Amazon Redshift for data warehousing. The security team requires that all data stored in Redshift be encrypted at rest. The current cluster is unencrypted. Which approach should the data engineer take to meet this requirement with minimal downtime?

A.Modify the cluster to enable encryption.
B.Unload data to S3 and reload into a new encrypted cluster.
C.Use the COPY command to load data into a new encrypted table.
D.Take a snapshot of the existing cluster and restore it to a new encrypted cluster.
AnswerD

Snapshot restore allows creating an encrypted cluster with minimal downtime.

Why this answer

Redshift allows restoring a snapshot to a new encrypted cluster. The engineer can take a snapshot of the existing cluster, restore it to a new cluster with encryption enabled, and then redirect traffic to the new cluster. Option A is wrong because encryption cannot be enabled on an existing cluster.

Option B is wrong because COPY command does not encrypt the cluster. Option C is wrong because unloading and reloading data would cause significant downtime.

Practice this question →
96
MCQhard

A company uses Amazon DynamoDB to store session data. The security team requires that all data be encrypted at rest using a customer-managed KMS key. The data engineer has enabled encryption with a KMS key, but discovers that old data remains encrypted with the previous AWS-managed key. How can the engineer re-encrypt all existing data with the new key?

A.Disable and re-enable encryption with the new KMS key
B.Use AWS Backup to back up the table and restore it with the new encryption key
C.Use the DynamoDB console to change the encryption key and select 'Apply to existing data'
D.Export the table to S3 using DynamoDB Export to S3, then import using DynamoDB Import from S3 with the new encryption key specified
AnswerD

Export/Import re-encrypts data.

Why this answer

Exporting the table to S3 and then importing it with a new KMS key re-encrypts all data at rest using the new key. Option A is wrong because disabling and re-enabling encryption does not re-encrypt existing data; DynamoDB does not support in-place re-encryption of existing items. Option B is wrong because AWS Backup restores the table with the original encryption; it does not allow specifying a new key for existing data.

Option C is wrong because changing the encryption key only applies to new writes; there is no 'Apply to existing data' option in the DynamoDB console.

Practice this question →
97
MCQeasy

A company needs to ensure that data stored in Amazon RDS is encrypted at rest. Which action should the data engineer take?

A.Enable encryption at rest by modifying the existing RDS instance.
B.Encrypt the underlying EBS volumes using AWS KMS.
C.Create a new RDS instance with encryption enabled using AWS KMS.
D.Enable SSL/TLS for connections to the RDS instance.
AnswerC

Encryption at rest must be enabled at launch time for RDS.

Why this answer

Amazon RDS encryption at rest must be enabled when the DB instance is created, using AWS KMS. It cannot be added later. Option A is incorrect because encryption cannot be enabled on an existing RDS instance; you must create a new one with encryption enabled.

Option B is incorrect because encrypting the underlying EBS volumes does not encrypt the RDS database; RDS encryption at rest is separate and must be configured at the instance level. Option D is incorrect because SSL/TLS secures data in transit, not at rest.

Practice this question →
98
MCQmedium

A company uses Amazon RDS for MySQL to store financial data. A compliance requirement mandates that all database connections must be encrypted. Which configuration step is necessary?

A.Set the RDS parameter require_secure_transport to 1.
B.Create the RDS DB instance in a private subnet.
C.Enable encryption for the RDS DB instance at creation time.
D.Configure the VPC security group to only allow traffic from certain IPs.
AnswerA

This is correct. To enforce encrypted connections for RDS MySQL, you must modify the DB parameter group to require SSL/TLS by setting parameters such as 'require_secure_transport' to 1. While the exact parameter name may vary, the intent is to enforce encryption in transit.

Why this answer

To enforce encrypted connections in transit for RDS MySQL, you need to configure the DB parameter group to require SSL/TLS. Setting the parameter 'require_secure_transport' to 1 forces all connections to use encryption. Option C is incorrect because enabling encryption at rest (at creation time) encrypts stored data, not connections in transit, which does not satisfy the compliance requirement for encrypted connections.

Exam trap

Encryption at rest (enabled at creation) does not encrypt database connections in transit. A common trap is confusing encryption at rest with encryption in transit. For encrypted connections, you must configure the DB parameter group (e.g., require_secure_transport=1 for MySQL).

Practice this question →
99
MCQmedium

Refer to the exhibit. A data engineer runs the AWS CLI command and gets the output shown. The engineer wants to grant a data analyst read-only access to the 'sales_db' database in AWS Glue Data Catalog using IAM. Which IAM policy statement is required?

A.{"Effect": "Allow", "Action": "glue:GetTable", "Resource": "arn:aws:glue:us-east-1:123456789012:table/sales_db/*"}
B.{"Effect": "Allow", "Action": "glue:GetDatabase", "Resource": "arn:aws:glue:us-east-1:123456789012:database/sales_db"}
C.{"Effect": "Allow", "Action": "glue:GetDatabases", "Resource": "*"}
D.{"Effect": "Allow", "Action": "s3:GetObject", "Resource": "arn:aws:s3:::data-lake-sales/*"}
AnswerB

Grants read access to the specific database.

Why this answer

To grant read-only access to a database in AWS Glue Data Catalog, the required IAM action is glue:GetDatabase. Option B correctly specifies this action and targets the specific database resource. Option A uses glue:GetTable, which is for tables, not databases.

Option C uses glue:GetDatabases, which is for listing databases and requires broader permissions. Option D uses s3:GetObject, which is for S3 data access, not Glue catalog operations.

Practice this question →
100
Multi-Selectmedium

A data engineer needs to encrypt data at rest in Amazon S3 using server-side encryption with a customer-managed KMS key. Which TWO steps are required to ensure that the KMS key can be used for S3 object encryption?

Select 2 answers
A.Configure a VPC endpoint for KMS to allow S3 to access the key.
B.Set the S3 bucket policy to require SSE-KMS for all PutObject requests.
C.Add a statement in the KMS key policy that allows the S3 service to use the key.
D.Grant the IAM role that writes objects the kms:GenerateDataKey and kms:Decrypt permissions.
E.Create a service-linked role for S3 to access KMS.
AnswersC, D

The key policy must allow S3 to call GenerateDataKey and Decrypt.

Why this answer

Options C and D are correct. For SSE-KMS with a customer-managed key, the KMS key policy must include a statement that allows the S3 service to use the key (e.g., kms:GenerateDataKey and kms:Decrypt). Additionally, the IAM role writing objects must have kms:GenerateDataKey and kms:Decrypt permissions.

Option A is not required because a VPC endpoint for KMS is not mandatory for S3 to access the key. Option B is not required because enforcing SSE-KMS via bucket policy is a separate configuration, not a prerequisite for using the key. Option E is not required because S3 does not use a service-linked role for KMS access.

Practice this question →
101
MCQmedium

Refer to the exhibit. An S3 bucket policy is shown. A data engineer using the DataEngineerRole tries to upload an object to s3://example-bucket/data/report.csv with SSE-S3 encryption. The upload fails. What is the most likely cause?

A.The resource ARN does not match the object.
B.The role does not have s3:PutObject permission.
C.The condition requires SSE-S3 encryption header, but the upload did not include it.
D.The principal is not authorized.
AnswerC

The condition requires the encryption header to be present and set to AES256.

Why this answer

The bucket policy includes a condition that the request must include the `x-amz-server-side-encryption` header with value `AES256` (SSE-S3). The upload did not include this header, so the policy condition was not met, resulting in a failed upload. Option A is incorrect because the resource ARN matches the object path.

Option B is incorrect because the role has the `s3:PutObject` permission. Option D is incorrect because the principal (DataEngineerRole) is allowed by the policy.

Practice this question →
102
MCQhard

A company stores data in Amazon S3 with server-side encryption using AWS KMS (SSE-KMS). The data engineer needs to give a third-party auditor read-only access to the encrypted objects. The auditor has an AWS account. Which strategy should be used?

A.Generate a presigned URL for each object the auditor needs to access.
B.Copy the objects to a new bucket encrypted with SSE-S3 and share that bucket.
C.Grant the auditor's IAM role permission to use the KMS key.
D.Update the S3 bucket policy to allow access from the auditor's account and update the KMS key policy to allow the auditor's account to decrypt.
AnswerD

Both policies are required for cross-account access with SSE-KMS.

Why this answer

Cross-account access to SSE-KMS encrypted objects requires both an S3 bucket policy allowing the auditor's account and a KMS key policy granting the auditor's account decrypt permissions. Option A is wrong because presigned URLs don't solve the cross-account KMS issue. Option B is wrong because simply granting access to the KMS key is insufficient without S3 permissions.

Option C is wrong because copying objects with SSE-S3 changes encryption and may not be allowed.

Practice this question →
103
MCQeasy

A data engineer needs to ensure that an Amazon Redshift cluster encrypts data at rest using a customer-managed AWS KMS key. Which configuration step is required?

A.Create a new cluster and select the default AWS managed key for encryption.
B.Create a new cluster and specify a customer-managed KMS key for encryption.
C.Use AWS CloudHSM to generate a key and attach it to the cluster.
D.Enable encryption on the existing cluster by modifying the cluster configuration.
AnswerB

Encryption must be set at cluster creation with a KMS key.

Why this answer

To use a customer-managed KMS key for encryption at rest in Amazon Redshift, you must specify the key when creating a new cluster. Encryption cannot be enabled on an existing cluster (option D is incorrect). Option A is incorrect because the default AWS managed key is not customer-managed.

Option C is incorrect because AWS CloudHSM is not used for Redshift encryption; Redshift integrates directly with AWS KMS for key management.

Practice this question →
104
Multi-Selecteasy

A data engineer needs to audit data access in Amazon S3 for compliance. Which TWO services can be used to capture and analyze S3 access logs? (Choose TWO.)

Select 2 answers
A.Amazon CloudWatch Logs
B.AWS CloudTrail
C.S3 server access logs
D.Amazon Macie
E.AWS Config
AnswersB, C

Correct. AWS CloudTrail can be enabled to record S3 data events, providing a record of API calls made to S3.

Why this answer

Options B and C are correct. AWS CloudTrail can be configured to record S3 data events, capturing API calls made to S3 buckets. S3 server access logs provide detailed records of all requests made to an S3 bucket, including source IP, requester, and operation.

Option A (Amazon CloudWatch Logs) is used for monitoring and storing logs from various sources, but it does not natively generate S3 access logs. Option D (Amazon Macie) is for sensitive data discovery and classification. Option E (AWS Config) is for tracking resource configuration changes.

Practice this question →
105
MCQmedium

A financial services company uses Amazon Redshift for its data warehouse. The compliance team requires that all access to the database be logged, including the SQL queries executed, and that the logs be stored in a separate S3 bucket that is encrypted with a customer-managed KMS key. Additionally, the logs must be retained for 7 years. The data engineer has enabled audit logging on the Redshift cluster and configured it to deliver logs to an S3 bucket. However, the compliance team reports that the logs are not being delivered. The S3 bucket policy allows the Redshift service to write logs. What is the most likely reason for the failure?

A.The S3 bucket is in a different region than the Redshift cluster.
B.The S3 bucket has versioning enabled, which blocks log delivery.
C.The KMS key policy does not grant the Redshift service principal decrypt permissions.
D.The S3 bucket policy does not include a statement allowing the Redshift service principal to write objects.
AnswerD

Redshift requires explicit bucket policy for audit logging.

Why this answer

Amazon Redshift audit logging requires a specific S3 bucket policy that grants the Redshift service principal permission to write objects. Without this policy statement, log delivery fails. Option A is incorrect because the S3 bucket can be in a different region.

Option B is incorrect because versioning does not block log delivery. Option C is incorrect because the issue is the bucket policy, not the KMS key policy; the Redshift service principal needs s3:PutObject permission, not KMS decrypt.

Practice this question →
106
MCQmedium

A data engineer needs to encrypt data at rest in an Amazon Redshift cluster. The company requires that the encryption key be managed by the customer and rotated annually. Which solution meets these requirements?

A.Use S3 server-side encryption with customer-provided keys (SSE-C).
B.Use AWS Secrets Manager to store the encryption key and configure Redshift to reference it.
C.Use AWS KMS with automatic key rotation enabled.
D.Use AWS CloudHSM to create and manage the encryption key, and configure Redshift to use it.
AnswerC

KMS with a customer-managed key allows you to manage the key and enables automatic annual rotation, meeting the requirement. Redshift natively supports KMS for encryption at rest.

Why this answer

AWS KMS with a customer-managed key (CMK) allows you to control the encryption key and enables automatic annual rotation. Amazon Redshift natively integrates with KMS for encryption at rest, making this a straightforward solution. Option D is incorrect because CloudHSM is not directly integrated with Redshift for encryption at rest; it requires custom configuration and is typically overkill for the requirement of annual rotation.

Option A is incorrect because SSE-C is used for S3 objects, not Redshift. Option B is incorrect because Secrets Manager is designed for secrets like database credentials, not for encryption keys used by Redshift.

Practice this question →
107
Multi-Selectmedium

A company is designing a data lake on Amazon S3. The security team requires granular access control based on data classifications. Which TWO AWS services can be used together to implement attribute-based access control (ABAC) for objects in S3?

Select 2 answers
A.AWS Secrets Manager
B.AWS Lake Formation
C.Amazon S3 object tags
D.AWS Identity and Access Management (IAM)
E.AWS Key Management Service (KMS)
AnswersC, D

Amazon S3 object tags can be used as condition keys in IAM policies to implement attribute-based access control (ABAC) for S3 objects.

Why this answer

IAM policies support ABAC by using condition keys based on resource tags. S3 object tags allow you to attach metadata to objects, and these tags can be referenced in IAM policy conditions to control access. This combination enables granular, attribute-based access control for S3 objects.

AWS Lake Formation also supports ABAC, but it is primarily used for managing permissions on a data lake catalog, not directly on S3 objects; the most direct and commonly used services for ABAC on S3 objects are IAM and S3 object tags. AWS Secrets Manager is for managing secrets, KMS is for encryption keys, and neither provides access control based on object attributes.

Practice this question →
108
MCQeasy

A data engineer needs to audit who accessed specific objects in an S3 bucket over the past 30 days. Which AWS service should be used?

A.AWS Config
B.Amazon CloudWatch Logs
C.Amazon S3 server access logs
D.AWS CloudTrail
AnswerC

Amazon S3 server access logs capture detailed information about every request made to a bucket, including object access, making it the correct choice.

Why this answer

Amazon S3 server access logs provide detailed records of requests made to an S3 bucket, including object-level access (e.g., who accessed which object, when, and from where). Option A (AWS Config) is used for resource inventory and compliance, not access auditing. Option B (Amazon CloudWatch Logs) can store and monitor logs but does not generate S3 access logs.

Option D (AWS CloudTrail) logs API calls to S3, but by default it records bucket-level operations, not object-level access; CloudTrail can be enabled for data events to log object-level operations, but S3 server access logs are specifically designed for detailed object access auditing and are simpler to enable for this requirement.

Practice this question →
109
MCQmedium

Refer to the exhibit. An IAM policy allows kms:Decrypt and kms:GenerateDataKey on a specific KMS key. A data engineer is unable to upload an object to an S3 bucket that uses SSE-KMS with that key. What is the MOST likely missing permission?

A.kms:Decrypt permission on the key.
B.s3:PutObject permission on the bucket.
C.kms:Encrypt permission on the key.
D.kms:CreateGrant permission on the key.
AnswerB

Correct. The user lacks s3:PutObject permission on the S3 bucket.

Why this answer

The user is unable to upload an object to an S3 bucket that uses SSE-KMS. The IAM policy currently allows kms:Decrypt and kms:GenerateDataKey on the KMS key. However, to upload an object to an S3 bucket, the user also needs the s3:PutObject permission on the bucket.

Therefore, the missing permission is s3:PutObject. Option A is incorrect because kms:Decrypt is already allowed. Option C is incorrect because kms:Encrypt is not required; GenerateDataKey is sufficient.

Option D is incorrect because kms:CreateGrant is not required for uploading.

Practice this question →
110
MCQeasy

A data engineer needs to grant an IAM user the ability to view Amazon CloudWatch Logs log groups and stream log events from a specific log group. Which IAM policy action should be used?

A.logs:DescribeLogGroups and logs:GetLogEvents
B.logs:PutLogEvents
C.logs:CreateLogGroup
D.logs:DeleteLogGroup
AnswerA

These allow listing and reading logs.

Why this answer

Logs:DescribeLogGroups and logs:GetLogEvents are the required actions. Option B is wrong because logs:PutLogEvents is for writing. Option C is wrong because logs:CreateLogGroup is for creation.

Option D is wrong because logs:DeleteLogGroup is for deletion.

Practice this question →
111
MCQhard

Refer to the exhibit. A data engineer creates this KMS key policy. An IAM role in account 123456789012 is granted decrypt access to the key. However, when the DataAnalystRole tries to decrypt an S3 object encrypted with this key, the operation fails. What is the most likely reason?

A.The S3 bucket policy does not allow the role to call s3:GetObject
B.The KMS key is in a different region than the S3 bucket
C.The role does not have permission to call kms:DescribeKey
D.The KMS key policy does not grant kms:Decrypt permission to the role
AnswerA

Even with decrypt permission, the role needs s3:GetObject permission on the encrypted object.

Why this answer

KMS key policies grant access to principals. However, if the S3 bucket policy does not allow the role to call kms:Decrypt, the combination of policies might still deny. But the key policy itself grants decrypt.

A common issue is that the S3 bucket policy might not allow the s3:GetObject action, or the role might not have S3 permissions. Another possibility is that the KMS key is in a different region (us-east-1) but the S3 object is in another region, causing cross-region access which is not allowed by default. However, the most likely reason based on typical exam scenarios is that the S3 bucket policy does not grant the necessary S3 permissions.

Practice this question →
112
MCQmedium

A company stores sensitive data in an Amazon S3 bucket. To comply with regulations, all data must be encrypted at rest using server-side encryption. The security team wants to ensure that any attempt to upload an unencrypted object is automatically denied. Which S3 bucket policy condition should be used?

A.s3:x-amz-server-side-encryption-aws-kms-key-id
B.s3:x-amz-acl
C.s3:x-amz-server-side-encryption
D.s3:x-amz-storage-class
AnswerC

Setting this condition to require 'AES256' enforces SSE-S3 encryption.

Why this answer

The s3:x-amz-server-side-encryption condition key enforces that objects must be encrypted with AES-256 (SSE-S3). s3:x-amz-server-side-encryption-aws-kms-key-id is for KMS key enforcement. s3:x-amz-acl controls access control lists, not encryption.

Practice this question →
113
MCQmedium

A team is designing a data lake on S3 and needs to enforce encryption at rest. They want to use server-side encryption with a KMS key that they manage. Which encryption option should they configure on the S3 bucket?

A.SSE-KMS
B.Client-side encryption
C.SSE-S3
D.SSE-C
AnswerA

SSE-KMS uses KMS keys that the customer manages.

Why this answer

SSE-KMS is the correct choice because it provides server-side encryption using a customer-managed KMS key. This allows the team to enforce encryption at rest with their own key, giving them control over key rotation, access policies, and audit trails via AWS CloudTrail, which aligns with the requirement to manage the encryption key themselves.

Exam trap

The trap here is that candidates often confuse SSE-S3 with SSE-KMS, assuming both use customer-managed keys, but SSE-S3 uses AWS-managed keys and does not provide the customer with key management control or audit capabilities.

How to eliminate wrong answers

Option B (Client-side encryption) is wrong because it encrypts data before it is sent to S3, not at rest on the server side, and does not involve configuring encryption on the S3 bucket itself. Option C (SSE-S3) is wrong because it uses an AWS-managed key, not a customer-managed KMS key, so the team would not have control over key management. Option D (SSE-C) is wrong because it requires the customer to provide their own encryption keys in each request, and the bucket configuration does not manage the key; instead, the key is supplied per-object, which is not a bucket-level encryption setting.

Practice this question →
114
MCQmedium

A company is using Amazon Redshift Spectrum to query data in Amazon S3. The S3 bucket uses SSE-KMS encryption. The Redshift cluster has an IAM role that allows access to S3 and KMS. However, queries fail with an 'Access Denied' error. What is the most likely cause?

A.The Redshift cluster does not have the IAM role attached.
B.The external schema does not have the IAM role specified.
C.The IAM role does not have the kms:Decrypt permission.
D.The external table is not defined in the schema.
AnswerB

The schema must reference the IAM role for Redshift Spectrum to assume it.

Why this answer

When using Redshift Spectrum with SSE-KMS encrypted data in S3, the IAM role must be explicitly associated with the external schema via the `CREATE EXTERNAL SCHEMA` command using the `IAM_ROLE` parameter. Even if the cluster has the IAM role attached, Spectrum queries fail with 'Access Denied' if the role is not specified at the schema level, because Redshift needs to pass that role to S3 and KMS for each query execution. Option B correctly identifies this missing configuration as the most likely cause.

Exam trap

The trap here is that candidates assume attaching an IAM role to the Redshift cluster is sufficient for all Spectrum operations, but the DEA-C01 exam tests the specific requirement that the role must be declared in the external schema definition for Spectrum to use it.

How to eliminate wrong answers

Option A is wrong because the question states the Redshift cluster has an IAM role attached, so the role is present on the cluster; the issue is that it is not specified in the external schema. Option C is wrong because the IAM role is explicitly stated to allow access to KMS, and the 'Access Denied' error typically occurs before KMS permission checks if the role is not passed to Spectrum at all. Option D is wrong because the external table definition is irrelevant to the 'Access Denied' error; the error occurs at the schema or role association level, not due to missing table definitions.

Practice this question →
115
MCQhard

Refer to the exhibit. A data engineer reviews an Amazon S3 server access log entry for an object upload. The log shows a status of 200 and encryption status "AES256". The company policy requires that all data be encrypted with SSE-KMS. Which action should the engineer take to enforce this policy?

A.Attach an S3 bucket policy that denies s3:PutObject unless the request includes x-amz-server-side-encryption: aws:kms
B.Revoke the IAM role's s3:PutObject permission
C.Enable AWS CloudTrail data events to monitor future uploads
D.Enable S3 default encryption with SSE-KMS on the bucket
AnswerA

Enforces SSE-KMS.

Why this answer

The log shows the object was uploaded with SSE-S3 (AES256), not the required SSE-KMS. To enforce the policy, the engineer should attach an S3 bucket policy that denies s3:PutObject unless the request includes the x-amz-server-side-encryption header set to aws:kms. Option D (default encryption) would encrypt new objects with SSE-KMS, but it does not block uploads that explicitly use SSE-S3; default encryption only applies when no encryption header is specified.

Options B and C do not enforce the policy: revoking IAM permissions is too broad and CloudTrail only logs events.

Practice this question →
116
Multi-Selectmedium

A company uses AWS CloudTrail to log all API calls. The security team wants to ensure that log files are tamper-proof and cannot be deleted. Which TWO actions should the data engineer take? (Choose TWO.)

Select 2 answers
A.Enable CloudTrail log file validation
B.Enable S3 Object Lock on the S3 bucket
C.Enable MFA Delete on the S3 bucket
D.Enable S3 Versioning on the S3 bucket
E.Enable SSE-KMS encryption on the S3 bucket
AnswersA, B

Provides integrity verification to detect tampering.

Why this answer

To ensure CloudTrail log files are tamper-proof and cannot be deleted, enable CloudTrail log file validation (option A) to verify integrity and detect tampering, and enable S3 Object Lock on the S3 bucket (option B) to prevent deletion or overwrites. Option C (MFA Delete) requires additional setup and is not automatically enforced by CloudTrail; it is not the primary mechanism for preventing deletion. Option D (S3 Versioning) alone does not prevent deletion; it preserves older versions but allows deletion of current versions.

Option E (SSE-KMS) encrypts data but does not prevent deletion.

Practice this question →
117
MCQhard

A data engineer needs to share a dataset stored in an Amazon S3 bucket with another AWS account. The dataset must remain encrypted at rest using AWS KMS. The data engineer creates a bucket policy that grants the other account access to the bucket. However, the other account reports that objects appear encrypted and they cannot decrypt them. What is the most likely cause?

A.The KMS key policy does not grant the other account the kms:Decrypt permission
B.The bucket policy does not grant the s3:GetObject permission
C.The other account must use the same KMS key to upload objects
D.The objects are encrypted with SSE-S3, which is not supported for cross-account access
AnswerA

Without decrypt permission on the KMS key, the other account cannot decrypt the objects even if they can download them.

Why this answer

When using SSE-KMS, the bucket policy alone is not enough; the KMS key policy must also grant the consuming account permission to use the key (kms:Decrypt). The bucket policy controls access to the S3 objects, but KMS key policy controls who can decrypt. Therefore, option A is correct.

Practice this question →
118
Multi-Selecthard

A company needs to enforce encryption at rest for all data stored in Amazon S3. The security team wants to ensure that no objects can be uploaded without encryption. Which THREE steps should be taken to meet this requirement?

Select 3 answers
A.Require all clients to use AWS CloudTrail for logging
B.Enable Amazon S3 Transfer Acceleration
C.Use AWS Key Management Service (KMS) to manage encryption keys
D.Create an S3 bucket policy that denies s3:PutObject if the x-amz-server-side-encryption header is not present
E.Enable default encryption on the S3 bucket using SSE-S3
AnswersC, D, E

SSE-KMS is a valid option for encryption at rest, and enforcing its use can be part of the policy.

Why this answer

A bucket policy denying s3:PutObject without the x-amz-server-side-encryption header enforces encryption. Using SSE-S3 or SSE-KMS ensures encryption at rest. SSE-C is not recommended for most cases.

Requiring HTTPS ensures encryption in transit, not at rest. CloudTrail is for auditing.

Practice this question →
119
MCQeasy

A data engineer receives an alert that an AWS KMS key has been scheduled for deletion by mistake. What is the immediate action to prevent the key from being deleted?

A.Cancel the key deletion from the KMS console or API.
B.Create a new KMS key and re-encrypt the data.
C.Wait for the key to be deleted and restore it from backup.
D.Disable the key immediately to stop usage.
AnswerA

Canceling deletion restores the key.

Why this answer

When a KMS key is scheduled for deletion, the deletion can be canceled from the AWS KMS console or via the CancelKeyDeletion API during the pending deletion period. This immediate action restores the key to its previous state and prevents it from being deleted. Option B is incorrect because creating a new key does not cancel the deletion of the existing key.

Option C is incorrect because deleted KMS keys cannot be restored; the default waiting period of 7–30 days exists specifically to allow cancellation. Option D is incorrect because disabling the key does not affect the deletion schedule.

Practice this question →
120
MCQmedium

A data engineer is designing a data pipeline that ingests personally identifiable information (PII) into Amazon Redshift. The engineer needs to ensure that only authorized users can view the data, and that all queries are logged for auditing. Which combination of AWS services should the engineer use?

A.AWS CloudTrail and Amazon Redshift audit logging
B.AWS IAM Access Analyzer and Amazon Redshift audit logging
C.Amazon S3 access logs and AWS CloudTrail
D.AWS CloudTrail and Amazon CloudWatch Logs
AnswerD

CloudTrail logs API calls; CloudWatch Logs can capture Redshift audit logs.

Why this answer

AWS CloudTrail and Amazon CloudWatch Logs. CloudTrail logs API calls to Redshift for auditing administrative actions, while Amazon Redshift can be configured to send audit logs (including SQL queries) to Amazon CloudWatch Logs. This combination ensures both API activity and data access are logged.

Option A is incorrect because Amazon Redshift audit logging is not a separate service; audit logs can be sent to CloudWatch Logs. Option B is incorrect because IAM Access Analyzer does not log queries. Option C is incorrect because S3 access logs only capture access to S3 objects, not Redshift queries.

Practice this question →
121
MCQeasy

Refer to the exhibit. An IAM policy is attached to a user. What is the security implication of this policy?

A.The policy only allows read access.
B.The policy is invalid because it uses asterisks.
C.The policy is too restrictive.
D.The policy grants excessive permissions, violating least privilege.
AnswerD

It grants full S3 access to all resources.

Why this answer

The policy, which grants full S3 access to all resources, violates the principle of least privilege by providing excessive permissions. Option A is incorrect because the policy does not only allow read access; it allows all actions. Option B is incorrect because the use of asterisks is valid syntax in IAM policies.

Option C is incorrect because the policy is overly permissive, not restrictive.

Practice this question →
122
Multi-Selectmedium

A company stores sensitive data in Amazon S3. The data engineer needs to implement a solution that automatically detects and redacts PII in new objects as they are uploaded. Which TWO AWS services should be used together?

Select 2 answers
A.AWS Glue ETL
B.Amazon Macie
C.Amazon DynamoDB
D.Amazon Comprehend
E.AWS Glue Data Catalog
AnswersB, D

Detects PII in S3.

Why this answer

Amazon Macie is a fully managed data security and data privacy service that uses machine learning and pattern matching to discover and protect sensitive data in Amazon S3. Amazon Comprehend is a natural language processing (NLP) service that can be used to detect and redact PII entities from text. Together, they enable automated detection and redaction of PII in newly uploaded S3 objects by triggering Macie to identify sensitive data and then using Comprehend to redact the PII.

Exam trap

AWS often tests the distinction between data discovery (Macie) and data processing/redaction (Comprehend), leading candidates to incorrectly select only Macie or to confuse Glue ETL as a redaction tool.

Practice this question →
123
MCQmedium

A healthcare company uses AWS Glue to process patient data stored in Amazon S3. The data is encrypted at rest using SSE-KMS with a customer managed key. The Glue ETL job runs on a schedule and reads from an S3 bucket, transforms the data, and writes to another S3 bucket also encrypted with the same KMS key. Recently, the security team rotated the KMS key. After the rotation, the Glue job started failing with 'AccessDenied' errors when trying to read from the source bucket. The Glue job's IAM role has permissions to use the KMS key (kms:Decrypt, kms:GenerateDataKey). The S3 bucket policies allow the role to read/write. What is the MOST likely cause of the failure?

A.The KMS key rotation created a new backing key, but the Glue job's IAM role does not have permission to decrypt with the old backing key.
B.The Glue job's IAM role is missing the kms:Encrypt permission on the KMS key.
C.The Glue job is using the wrong encryption context when calling KMS.
D.The S3 bucket policy has a condition that requires the request to use the latest version of the KMS key.
AnswerA

If automatic rotation is enabled, old backing keys are retained, but if the key was manually rotated (new key created), the old key may be disabled. Also, the key policy may have been updated incorrectly.

Why this answer

When you rotate a customer managed KMS key, AWS KMS retains the old backing key to allow decryption of data encrypted before the rotation. However, the Glue job's IAM role must have permission to use the old backing key via the kms:Decrypt action. If the key policy or IAM policy does not explicitly allow decryption with the old backing key (or if the key policy was inadvertently updated to remove access to the old key material), the Glue job will fail with AccessDenied when reading SSE-KMS encrypted objects that were encrypted with the previous key version.

Exam trap

The trap here is that candidates assume KMS key rotation is seamless and never breaks existing access, but they overlook that the IAM role or key policy must still grant kms:Decrypt on the key resource, and that the old backing key remains in use for previously encrypted data.

How to eliminate wrong answers

Option B is wrong because the Glue job is failing on read (decrypt), not write; the error occurs when reading from the source bucket, so missing kms:Encrypt would only affect writes to the destination bucket. Option C is wrong because the encryption context is set by the S3 service when the object was uploaded; the Glue job does not control the encryption context used during decryption, and a mismatch would cause a different error (e.g., InvalidCiphertextException), not AccessDenied. Option D is wrong because S3 bucket policies cannot require the request to use the latest version of a KMS key; KMS key versioning is transparent to S3 policies, and there is no such condition key in S3 bucket policies.

Practice this question →
124
MCQmedium

An organization wants to audit all API calls made to AWS services for compliance. Which AWS service should be used to capture and store these API calls?

A.AWS CloudTrail
B.AWS Config
C.Amazon VPC Flow Logs
D.Amazon CloudWatch Logs
AnswerA

CloudTrail records AWS API calls for auditing.

Why this answer

AWS CloudTrail records all API calls made to AWS services and stores them in Amazon S3 for auditing and compliance. AWS Config monitors resource configurations, not API calls. Amazon VPC Flow Logs capture IP traffic information.

Amazon CloudWatch Logs stores log data but does not natively capture API calls; it can receive logs from CloudTrail if integrated, but CloudTrail is the primary service for capturing API calls.

Practice this question →
125
MCQmedium

Refer to the exhibit. A data engineer attaches this bucket policy to an S3 bucket. A developer tries to upload an object to the bucket using the AWS CLI with the command: `aws s3 cp file.txt s3://my-bucket/`. The upload fails. What is the most likely reason?

A.The CLI command does not specify the encryption header, so the request is denied by the policy
B.The developer used the wrong AWS region
C.The CLI command does not include the required KMS key ID
D.The IAM user does not have s3:PutObject permission
AnswerA

The policy denies requests without encryption header.

Why this answer

The correct answer. The bucket policy condition `aws:SecureTransport` or similar encryption requirement (e.g., `s3:x-amz-server-side-encryption`) denies requests that do not include the required encryption header. The `aws s3 cp` CLI command does not automatically include the `x-amz-server-side-encryption` header; it uses SSE-S3 by default without setting the header explicitly.

Therefore, the request is denied because the header is missing. Option B is incorrect because the policy does not depend on region. Option C is incorrect because the policy does not require a specific KMS key ID; it only requires the encryption header.

Option D is incorrect because the IAM user likely has `s3:PutObject` permission, but the bucket policy explicitly denies the request due to missing encryption header.

Practice this question →
126
MCQeasy

A company needs to encrypt data in transit between an EC2 instance and an S3 bucket. Which method should be used?

A.Use HTTPS endpoints
B.Use plain HTTP
C.Use an IPsec VPN
D.Server-side encryption (SSE)
AnswerA

HTTPS encrypts data in transit using TLS.

Why this answer

HTTPS endpoints encrypt data in transit between EC2 and S3 using TLS/SSL, ensuring confidentiality and integrity over the public internet. S3 supports HTTPS natively on its REST endpoints, and the AWS SDKs default to HTTPS, making this the simplest and most secure method for encrypting data in motion.

Exam trap

The trap here is confusing encryption in transit (HTTPS) with encryption at rest (SSE), leading candidates to select server-side encryption even though it does not protect data during network transfer.

How to eliminate wrong answers

Option B is wrong because plain HTTP transmits data in cleartext, exposing it to interception and tampering, which violates encryption-in-transit requirements. Option C is wrong because an IPsec VPN encrypts traffic between networks but is unnecessary and overly complex for direct EC2-to-S3 communication, which can be secured via HTTPS without additional infrastructure. Option D is wrong because server-side encryption (SSE) protects data at rest within S3, not data in transit between EC2 and S3.

Practice this question →
127
MCQeasy

A data engineer needs to grant an IAM user read-only access to a specific KMS key for decrypting S3 objects. Which policy element should be used?

A.Attach an IAM policy to the user allowing kms:Decrypt
B.Add a statement to the KMS key policy allowing the IAM user to call kms:Decrypt
C.Add a bucket policy that grants kms:Decrypt
D.Use an SCP in AWS Organizations to allow kms:Decrypt
AnswerB

Correct. KMS key policies are resource-based policies that directly grant permissions to IAM users or roles to perform actions on the key. Adding a statement to the key policy allowing the IAM user to call kms:Decrypt is the recommended method.

Why this answer

KMS key policies are resource-based policies that directly grant permissions to IAM users or roles to perform actions on the key. To grant an IAM user read-only access (kms:Decrypt) to a specific KMS key, the recommended approach is to add a statement in the key policy that allows that user to call kms:Decrypt. Option A is incorrect because an IAM policy alone cannot grant KMS permissions unless the key policy explicitly allows it (by default, key policies must allow IAM policies).

Option C is incorrect because bucket policies cannot grant kms:Decrypt permissions; they can only specify conditions for using KMS keys. Option D is incorrect because SCPs are used in AWS Organizations to set permission boundaries, not to grant permissions.

Practice this question →
128
Multi-Selecthard

A company uses Amazon Redshift for data warehousing. The security team requires that data be encrypted at rest using a customer-managed key (CMK) in AWS KMS, and that the key be rotated automatically every year. Additionally, the team wants to restrict access to the key to only the Redshift cluster and a security admin IAM role. Which steps should the company take? (Choose THREE.)

Select 3 answers
A.Add the security admin IAM role as a key user in the KMS key policy.
B.Alter the existing Redshift cluster to enable encryption with the CMK.
C.Enable automatic key rotation in the KMS key policy.
D.Disable automatic key rotation to comply with security policy.
E.Create a new Redshift cluster and specify the CMK for encryption.
AnswersA, C, E

Allows the admin to manage the key.

Why this answer

Options A, C, and E are correct. Option A adds the security admin IAM role as a key user in the KMS key policy. Option C enables automatic yearly rotation of the CMK.

Option E creates a new Redshift cluster and specifies the CMK for encryption. Option B is wrong because you cannot enable encryption on an existing unencrypted cluster by altering it; you must create a new cluster or restore from an encrypted snapshot. Option D is wrong because it disables rotation, which conflicts with the security requirement.

Practice this question →
129
Drag & Dropmedium

Order the steps to migrate an on-premises database to Amazon RDS using AWS DMS.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4

Why this order

First, create the replication instance. Then configure endpoints, create the migration task, start it, and finally validate the migrated data.

Practice this question →
130
MCQmedium

A company stores sensitive customer data in an S3 bucket. The security team requires that all data be encrypted at rest using a customer-managed AWS KMS key. However, when a data engineer attempts to upload an object using the AWS CLI, the upload fails with an access denied error. The engineer has s3:PutObject permission on the bucket. Which additional permission is most likely missing?

A.kms:CreateKey
B.kms:Decrypt
C.s3:PutObjectAcl
D.kms:GenerateDataKey
AnswerD

Required to generate a data key for server-side encryption.

Why this answer

To upload an object with SSE-KMS, the IAM user or role must have kms:GenerateDataKey permission to generate a data key for encryption. Option D is correct because without it, the upload fails. Option A (kms:CreateKey) is for creating keys, not using them.

Option B (kms:Decrypt) is for decryption, not upload. Option C (s3:PutObjectAcl) is for ACLs, not encryption.

Practice this question →
131
MCQeasy

A company uses AWS KMS to encrypt data in Amazon S3. The security team wants to ensure that the KMS key can only be used from within the company's VPC. Which policy element should be added to the KMS key policy?

A.Set the Principal element to restrict access to the VPC.
B.Add a condition using aws:SourceIp to allow only IP addresses from the VPC.
C.Add a condition using aws:SourceVpc to allow only requests from the VPC.
D.Add a condition using kms:ViaService to allow only via VPC endpoints.
AnswerC

This condition restricts key usage to the specified VPC.

Why this answer

Using a condition with aws:SourceVpc restricts key usage to requests originating from a specific VPC. Option A is wrong because the Principal element specifies who can use the key, not where. Option B is wrong because aws:SourceIp is for IP addresses, not VPC.

Option D is wrong because kms:ViaService restricts usage to specific AWS services, not network location.

Practice this question →
132
Multi-Selecteasy

A data engineer is designing a data lake on Amazon S3 that must comply with GDPR. The engineer needs to ensure that individuals can request deletion of their personal data. Which THREE AWS services can be used together to automate the deletion of specific records?

Select 3 answers
A.AWS Lambda
B.AWS Glue
C.Amazon S3 Batch Operations
D.Amazon S3 Select
E.Amazon DynamoDB
AnswersA, C, D

Can process deletion logic.

Why this answer

AWS Lambda can be used to process deletion requests and trigger actions. Amazon S3 Batch Operations can perform bulk actions on S3 objects, such as deleting them. Amazon S3 Select can query specific records within S3 objects to identify which ones need deletion, enabling targeted removal.

Together, these services automate the deletion of specific records to comply with GDPR. AWS Glue is an ETL service, not designed for selective deletion, and Amazon DynamoDB is a NoSQL database, not directly applicable to S3 data.

Practice this question →
133
MCQhard

A company has a multi-account strategy using AWS Organizations. The data engineering team needs to share a central S3 bucket across multiple accounts while maintaining fine-grained access control. Which solution should be used?

A.Use IAM roles in each account with cross-account access
B.Use Amazon CloudFront to serve the data
C.Use S3 access points with a policy per account
D.Create a bucket policy with principal ARNs for each account
AnswerC

Access points allow separate policies for each account.

Why this answer

S3 access points allow you to create separate access points for each account with their own policies, enabling fine-grained access control while sharing the same bucket. This integrates with AWS Organizations to simplify policy management. Option A is incorrect because cross-account IAM roles grant full access to the role's permissions and lack object-level granularity.

Option B is incorrect because CloudFront is a content delivery network, not an access control mechanism. Option D is incorrect because a bucket policy with principal ARNs for each account becomes difficult to manage as accounts scale, and it doesn't provide per-account fine-grained control like access points do.

Practice this question →
134
Multi-Selecthard

A company uses Amazon EMR to process sensitive data. The data engineer needs to ensure that data in transit between EMR and S3 is encrypted. Which THREE configurations achieve this? (Choose THREE.)

Select 3 answers
A.Enable S3 Block Public Access on the bucket
B.Configure EMRFS to use server-side encryption with S3 (SSE-S3) and require HTTPS
C.Enable SSE-KMS on the S3 bucket
D.Use SSE-C with HTTPS for S3 communication
E.Configure EMR to use VPC endpoints for S3 with a policy that enforces HTTPS
AnswersB, D, E

EMRFS can enforce HTTPS for data transfer.

Why this answer

To ensure encryption in transit between Amazon EMR and S3, you can use server-side encryption with customer-provided keys (SSE-C) with HTTPS (Option D), configure EMRFS to use server-side encryption with S3 (SSE-S3) and require HTTPS (Option B), or use VPC endpoints for S3 with a policy that enforces HTTPS (Option E). Option A (S3 Block Public Access) controls public access, not transit encryption. Option C (SSE-KMS) encrypts data at rest, not in transit.

Thus, correct answers are B, D, E.

Practice this question →
135
MCQhard

A company stores sensitive data in Amazon S3. The security team requires that all data be encrypted at rest and that the encryption keys be stored in AWS CloudHSM. Which S3 encryption option should be used?

A.SSE-S3
B.SSE-KMS with an AWS managed key
C.SSE-KMS with a customer managed key
D.SSE-C
AnswerD

SSE-C allows the customer to provide their own encryption keys, which can be stored and managed in CloudHSM.

Why this answer

SSE-C allows customers to provide their own encryption keys, which can be stored in CloudHSM. SSE-S3 and SSE-KMS use AWS-managed keys or KMS keys, not CloudHSM. Option D is correct.

Practice this question →
136
MCQeasy

Refer to the exhibit. An IAM policy includes this statement. What access does it grant?

A.It denies GetObject access to the bucket from IP addresses in 10.0.0.0/8
B.It allows GetObject access to the bucket only from a specific VPC
C.It allows PutObject access to the bucket from any IP address
D.It allows GetObject access to the bucket only from IP addresses in 10.0.0.0/8
AnswerD

The policy allows access from the specified IP range.

Why this answer

The policy statement allows the s3:GetObject action on the specified bucket, with a condition that the request must originate from an IP address within the 10.0.0.0/8 range. Therefore, it grants GetObject access only from IP addresses in that range. Option A is incorrect because the policy allows, not denies.

Option B is incorrect because the condition is based on IP address, not VPC. Option C is incorrect because the action is GetObject, not PutObject. Option D correctly describes the access granted.

Practice this question →
137
MCQhard

Refer to the exhibit. An S3 bucket policy allows the DataEngineerRole to get objects only if the request uses HTTPS. However, requests from this role are being denied even when using HTTPS. What is the MOST likely reason?

A.The IAM role does not have permission to use SSE-S3.
B.The condition key aws:SecureTransport is misspelled.
C.The bucket policy does not include a Deny statement for HTTP requests.
D.The IAM role's attached policy does not allow s3:GetObject on the bucket.
AnswerD

The bucket policy allows the role, but the role itself must also have an IAM policy that allows s3:GetObject.

Why this answer

Even though the bucket policy condition requires HTTPS, the IAM role must also have an IAM policy that explicitly allows s3:GetObject on the bucket. Without this, the request is denied regardless of the bucket policy. Option A is incorrect because SSE-S3 does not require explicit IAM permissions; it is a server-side encryption option that works by default.

Option B is incorrect because aws:SecureTransport is spelled correctly; misspelling would cause the condition to not apply, potentially allowing HTTP, but the issue is requests being denied. Option C is incorrect because the bucket policy uses a condition to require HTTPS, which effectively denies HTTP requests even without a separate Deny statement.

Practice this question →
138
Multi-Selecthard

A company wants to implement least privilege access for its data lake on S3. Which THREE practices should be followed? (Choose THREE.)

Select 3 answers
A.Grant s3:* to all users for simplicity
B.Use S3 bucket policies for cross-account access
C.Use S3 access points to enforce network policies
D.Disable S3 Block Public Access to allow flexibility
E.Use IAM policies to grant specific permissions to users and roles
AnswersB, C, E

Bucket policies are appropriate for cross-account.

Why this answer

The correct answers are B, C, and E. To implement least privilege for an S3 data lake, use S3 bucket policies for cross-account access (B), use S3 access points to enforce network policies (C), and use IAM policies to grant specific permissions (E). Option A is incorrect because granting s3:* to all users violates least privilege.

Option D is incorrect because disabling S3 Block Public Access increases risk; it should be enabled.

Practice this question →
139
MCQmedium

A data engineer needs to grant an IAM user read-only access to a specific prefix (folder) in an S3 bucket. The bucket contains sensitive data. Which S3 bucket policy statement achieves this?

A.{"Effect":"Allow","Principal":{"AWS":"arn:aws:iam::123456789012:user/DataEng"},"Action":"s3:GetObject","Resource":"arn:aws:s3:::mybucket"}
B.{"Effect":"Allow","Principal":{"AWS":"arn:aws:iam::123456789012:user/DataEng"},"Action":"s3:GetObject","Resource":"arn:aws:s3:::mybucket/sensitive/*"}
C.{"Effect":"Allow","Principal":{"AWS":"arn:aws:iam::123456789012:user/DataEng"},"Action":"s3:GetObject","Resource":"arn:aws:s3:::mybucket/*","Condition":{"StringLike":{"s3:prefix":"sensitive/"}}}
D.{"Effect":"Allow","Principal":{"AWS":"arn:aws:iam::123456789012:user/DataEng"},"Action":"s3:GetObject","Resource":"arn:aws:s3:::mybucket/*"}
AnswerB

Grants access only to objects under sensitive/ prefix.

Why this answer

It grants s3:GetObject for the specific prefix and denies access to other prefixes implicitly. Option A is wrong because it grants access to all objects. Option C is wrong because it uses a condition that does not restrict prefix.

Option D is wrong because it grants access to all objects in the bucket.

Practice this question →
140
Multi-Selecthard

A data engineer is troubleshooting an Amazon Redshift cluster that is unable to access an S3 bucket for COPY operations. The cluster has an IAM role attached. Which of the following could be causing the failure? (Choose TWO.)

Select 2 answers
A.The VPC security group does not allow outbound HTTPS traffic
B.The S3 bucket policy denies access to the IAM role
C.The S3 bucket has default encryption enabled
D.The IAM role does not have the s3:GetObject permission
E.The KMS key used for encryption is not shared with Redshift
AnswersB, D

The bucket policy can override the IAM role permissions.

Why this answer

Options B and D are correct. The IAM role must have permission to the S3 bucket, and the bucket policy must allow the role. Option A is wrong because VPC security groups control network traffic, not S3 access.

Option C is wrong because encryption is not required for COPY. Option E is wrong because Redshift does not need KMS permissions unless using SSE-KMS.

Practice this question →
141
MCQmedium

A company is using AWS Lake Formation to manage access to data in a data lake stored in Amazon S3. A data engineer notices that users with SELECT permissions on a table can still query the underlying S3 data directly using Athena. What is the most likely cause?

A.The S3 bucket policy allows full access to all principals
B.The users are using a version of Athena that does not support Lake Formation
C.The S3 bucket does not have server-side encryption enabled
D.Lake Formation does not support integration with Athena
AnswerB

Correct. Athena engine version 1 does not support Lake Formation integration, so users can bypass Lake Formation permissions and query data directly.

Why this answer

Athena workgroups using engine version 1 do not support integration with Lake Formation. In such cases, Lake Formation permissions are not enforced, and users can query the underlying S3 data directly through Athena, bypassing Lake Formation's access controls. Option A is incorrect: while a permissive S3 bucket policy could allow direct access, the most likely cause given Lake Formation integration is the Athena version.

Option C is incorrect because server-side encryption does not affect Lake Formation's ability to enforce permissions. Option D is incorrect: Lake Formation does integrate with Athena, but only when using Athena engine version 2 or later.

Practice this question →
142
MCQeasy

A company is using Amazon S3 to store log files. The security team requires that all data be encrypted in transit. Which of the following ensures encryption in transit for S3?

A.Use HTTPS (SSL/TLS) when accessing S3 endpoints.
B.Use Amazon S3 Transfer Acceleration.
C.Enable client-side encryption before uploading to S3.
D.Use server-side encryption with S3 managed keys (SSE-S3).
AnswerA

HTTPS encrypts data in transit between client and S3.

Why this answer

Encryption in transit for S3 is achieved by using HTTPS (SSL/TLS) when accessing S3 endpoints (option A). Option B (Transfer Acceleration) speeds up uploads but does not provide encryption in transit by itself. Option C (client-side encryption) protects data at rest and during transit only if combined with HTTPS.

Option D (SSE-S3) is at-rest encryption. Therefore, the correct answer is A.

Practice this question →
143
MCQhard

A data engineer is tasked with implementing data masking for a non-production environment. The source data contains credit card numbers stored in an Amazon RDS for PostgreSQL database. The engineer wants to automatically mask the credit card numbers when copying data to the non-production database. Which AWS service can be used to achieve this?

A.AWS Database Migration Service (DMS)
B.AWS Glue
C.AWS Lake Formation
D.Amazon Athena
AnswerA

DMS supports transformation rules that can mask columns during migration.

Why this answer

AWS DMS can transform data during migration using transformation rules. It can mask data by replacing columns with predefined values. Glue is for ETL, but DMS is purpose-built for database migrations with transformations.

Lake Formation is for data lake permissions. Athena is for querying S3 data.

Practice this question →
144
MCQhard

A data engineer is designing a data lake on Amazon S3. The compliance team requires that objects be automatically deleted after 7 years. Additionally, objects must be transitioned to Amazon S3 Glacier Instant Retrieval after 30 days to reduce costs. Which S3 lifecycle policy configuration meets these requirements?

A.Transition to Glacier Instant Retrieval after 30 days, then expire after 90 days.
B.Transition to Glacier Instant Retrieval after 30 days, then expire after 2555 days.
C.Transition to Glacier Deep Archive after 30 days, then expire after 7 years.
D.Transition to S3 Standard-IA after 30 days, then expire after 7 years.
AnswerB

2555 days is approximately 7 years.

Why this answer

It transitions objects to S3 Glacier Instant Retrieval after 30 days and then expires (permanently deletes) them after 2555 days, which is approximately 7 years (365 * 7 = 2555). This meets both the cost-saving and deletion requirements. Option A is incorrect because it expires after 90 days, not 7 years.

Option C is incorrect because it uses Glacier Deep Archive instead of Glacier Instant Retrieval. Option D is incorrect because it uses S3 Standard-IA instead of Glacier Instant Retrieval.

Practice this question →
145
MCQhard

A data engineer needs to share a dataset stored in an S3 bucket with a partner AWS account. The partner should be able to read the data without needing to authenticate with the engineer's account. The engineer must not share any secret keys. Which approach should be used?

A.Write a bucket policy that grants access to the partner account's IAM role.
B.Generate presigned URLs and share them with the partner.
C.Make the bucket publicly readable.
D.Create an IAM user with access keys and share them with the partner.
AnswerA

Bucket policy can grant cross-account access securely.

Why this answer

S3 bucket policies can grant cross-account access to a specific IAM role in the partner account, allowing the partner to read data without authentication or shared secrets. Option B is wrong because presigned URLs are temporary and require ongoing generation for each access, not a persistent solution. Option C is wrong because making the bucket public violates security principles and exposes data to everyone.

Option D is wrong because sharing access keys is insecure and against best practices; keys should never be shared.

Exam trap

Candidates often confuse presigned URLs with a secure long-term solution, but they are temporary and not suitable for persistent cross-account access.

Practice this question →
146
MCQhard

A healthcare organization uses AWS Lake Formation to manage a data lake in Amazon S3. The data lake contains sensitive patient information that must be encrypted at rest. The organization uses AWS KMS with a customer-managed key (CMK) for encryption. Recently, the security team noticed that a new IAM user was able to query the data lake using Amazon Athena without explicit permissions in Lake Formation. The data lake administrator suspects that the IAM user might have been granted access through an IAM policy that allows 'lakeformation:GetDataAccess' without proper resource restrictions. The organization wants to enforce that only Lake Formation permissions control access to the data lake, and IAM policies should not grant access directly. What should they do?

A.Change the KMS key policy to require that any request to decrypt data must come from the Lake Formation service role.
B.Revoke the 'lakeformation:GetDataAccess' permission from all IAM users and groups, and require that access be granted only through Lake Formation permissions.
C.Remove the IAM policy that grants 'lakeformation:GetDataAccess' from the specific user and ensure Lake Formation permissions are correctly set.
D.Add an S3 bucket policy that denies all principals except the Lake Formation service role.
AnswerB

This ensures that only Lake Formation permissions control data access.

Why this answer

Revoking the 'lakeformation:GetDataAccess' permission from all IAM users and groups ensures that only Lake Formation permissions control access to the data lake. This prevents IAM policies from bypassing Lake Formation's fine-grained access control. Option A is wrong because changing the KMS key policy would not address the IAM policy issue; KMS controls encryption, not access permissions.

Option C is wrong because removing the policy from a single user does not prevent other users from having similar permissions; a broader revocation is needed. Option D is wrong because S3 bucket policies would still allow direct S3 access, bypassing Lake Formation's controls.

Practice this question →
147
Multi-Selecteasy

A company wants to audit all API calls made to Amazon S3 and Amazon RDS resources. Which TWO AWS services can be used together to achieve this?

Select 2 answers
A.AWS CloudTrail
B.AWS Config
C.Amazon GuardDuty
D.Amazon Macie
E.Amazon CloudWatch Logs
AnswersA, E

AWS CloudTrail records API calls to S3 and RDS, enabling auditing of all actions.

Why this answer

Options A and E are correct. AWS CloudTrail records API calls to S3 and RDS, and Amazon CloudWatch Logs can store and monitor those logs. Option B (AWS Config) records resource configuration changes, not API calls, so it is incorrect.

Option C (Amazon GuardDuty) is a threat detection service, not for auditing API calls. Option D (Amazon Macie) is for data classification and protection, not for recording API calls.

Practice this question →
148
MCQeasy

A data engineer needs to audit all AWS KMS key usage events for the past 90 days to verify compliance. Which AWS service should be used?

A.VPC Flow Logs
B.AWS CloudTrail
C.AWS Config
D.Amazon Inspector
AnswerB

CloudTrail records KMS API calls for auditing.

Why this answer

(AWS CloudTrail). AWS CloudTrail logs all API calls made to AWS KMS, including key usage events, and retains event history for the past 90 days by default, making it suitable for auditing. Option A (VPC Flow Logs) captures network traffic, not API calls.

Option C (AWS Config) tracks resource configuration changes, not API calls. Option D (Amazon Inspector) performs vulnerability assessments, not API logging.

Practice this question →
149
MCQmedium

A data engineer is setting up cross-account access to an encrypted S3 bucket. The bucket uses a customer-managed KMS key. The engineer has configured the bucket policy and the IAM role in the source account. The target account still gets access denied errors when trying to read objects. What is the most likely cause?

A.The KMS key policy does not grant the target account's IAM role the kms:Decrypt permission.
B.The S3 bucket has Object Ownership set to BucketOwnerPreferred.
C.The bucket policy does not allow the target account's root user.
D.The VPC Endpoint policy blocks access from the target account.
AnswerA

Correct. The KMS key policy must grant the target account's IAM role kms:Decrypt permission to allow decryption of objects encrypted with that key.

Why this answer

For cross-account access to an S3 bucket encrypted with a customer-managed KMS key, the KMS key policy must explicitly grant the target account's IAM role the kms:Decrypt permission. Without this, the target account will get access denied errors even if the bucket policy and IAM role are correctly configured. Option B is incorrect because Object Ownership does not affect cross-account read access.

Option C is incorrect because the bucket policy only needs to allow the target account's IAM role, not the root user. Option D is incorrect because VPC Endpoint policies are not relevant to this cross-account access issue.

Practice this question →
150
MCQhard

A company uses AWS Glue to process sensitive data. The security team requires that all data in transit between Glue and Amazon S3 be encrypted using TLS 1.2 or higher. Which configuration ensures this requirement is met?

A.Configure a VPC endpoint for S3 and enable private DNS
B.Enable S3 Block Public Access at the bucket level
C.Add a bucket policy that denies access unless aws:SecureTransport is true
D.Use SSE-KMS encryption on the S3 bucket
AnswerC

Enforces HTTPS, which typically uses TLS 1.2+.

Why this answer

S3 bucket policies can enforce aws:SecureTransport to require HTTPS. Glue by default uses HTTPS when accessing S3, but to enforce it, the bucket policy must deny requests without SecureTransport. Option A is wrong because VPC endpoints enforce private connectivity but not necessarily TLS version.

Option B is wrong because S3 Block Public Access does not affect encryption in transit. Option D is wrong because KMS is for at-rest encryption. Option C is correct.

Practice this question →
← PreviousPage 2 of 5 · 318 questions totalNext →

Ready to test yourself?

Try a timed practice session using only Data Security and Governance questions.

Start 20-question session