A company uses S3 to store sensitive data. Which TWO S3 features can be used to protect data at rest?
Select 2 answers
A.S3 Versioning
B.Server-Side Encryption with S3 Managed Keys (SSE-S3)
C.Server-Side Encryption with AWS KMS (SSE-KMS)
D.S3 Transfer Acceleration
E.S3 Object Lock
AnswersB, C
SSE-S3 encrypts data at rest.
Why this answer
Server-Side Encryption with S3 Managed Keys (SSE-S3) and Server-Side Encryption with AWS KMS (SSE-KMS) both encrypt data at rest. Option A (S3 Versioning) protects against accidental deletion or overwrite, not encryption. Option D (S3 Transfer Acceleration) speeds up data transfers, not encryption.
Option E (S3 Object Lock) prevents deletion or overwrite for compliance, not encryption.
A company stores sensitive customer data in an Amazon S3 bucket. The security team requires that all data be encrypted at rest using server-side encryption with AWS KMS managed keys (SSE-KMS). Additionally, they want to ensure that the encryption context is enforced for all PutObject requests. Which THREE steps should be taken to meet these requirements?
Select 3 answers
A.Set the default encryption on the bucket to SSE-KMS with the desired KMS key.
B.Add a bucket policy that requires the s3:x-amz-server-side-encryption-aws-kms-key-id header and the kms:EncryptionContext condition.
C.Configure the bucket to use SSE-C and provide the encryption key.
D.Enable S3 Versioning on the bucket.
E.Create an IAM role that includes kms:GenerateDataKey and kms:Decrypt permissions for the KMS key.
AnswersA, B, E
Correct. Setting default encryption to SSE-KMS ensures new objects are encrypted with the specified KMS key if no encryption header is provided.
Why this answer
To enforce SSE-KMS and encryption context, three steps are needed. First, set default encryption on the bucket to SSE-KMS with the desired KMS key (A). Second, add a bucket policy that requires the s3:x-amz-server-side-encryption-aws-kms-key-id header and the kms:EncryptionContext condition key (B).
Third, ensure the IAM role used by applications has kms:GenerateDataKey and kms:Decrypt permissions for the KMS key (E). Option C (SSE-C) is incorrect because it uses a customer-provided key, not KMS. Option D (versioning) does not enforce encryption context.
Exam trap
Candidates might think that SSE-C is required to enforce encryption context, but encryption context can be enforced through a bucket policy condition with kms:EncryptionContext even with SSE-KMS.
A data engineering team uses AWS Glue Data Catalog to manage metadata for datasets in Amazon S3. The datasets contain personally identifiable information (PII). The team needs to implement column-level security so that only authorized users can access columns with PII. They use Amazon Athena for querying. The team has enabled AWS Lake Formation and defined data lake locations. They have created a Lake Formation tag called 'PII' and assigned it to the columns containing PII. They have also granted 'SELECT' permission on those columns to a specific IAM role. However, when a user assumes that role and queries the table using Athena, they can still see all columns, including the PII columns. What is the most likely cause?
A.The data in S3 is not encrypted, so Lake Formation cannot enforce column-level security.
B.The S3 bucket policy grants direct access to the IAM role, bypassing Lake Formation.
C.The IAM role does not have the necessary Lake Formation permissions; it only has IAM permissions to the S3 data.
D.The Lake Formation tag 'PII' is not properly associated with the columns.
AnswerC
Lake Formation column-level security requires that the principal has Lake Formation 'SELECT' permission on the table and columns, and that the principal does not have direct S3 access.
Why this answer
Lake Formation column-level security requires that the table be registered as a data lake location in Lake Formation and that the IAM role has Lake Formation permissions, not just IAM permissions. The IAM role might be bypassing Lake Formation if it has S3 permissions directly. Option A is wrong because the tags are applied correctly.
Option B is wrong because the S3 bucket policy should not allow direct access; Lake Formation should be the access point. Option D is wrong because disabling encryption would not cause this issue.
A data engineer is setting up an Amazon Redshift cluster. Which TWO measures can be taken to secure the data at rest?
Select 2 answers
A.Enable encryption on the Redshift cluster using AWS KMS
B.Encrypt data on the client side before loading into Redshift
C.Enable AWS IAM database authentication
D.Use VPC security groups to restrict network access
E.Use an HSM (Hardware Security Module) to manage encryption keys
AnswersA, E
KMS encryption protects data at rest in Redshift.
Why this answer
Redshift supports encryption at rest using KMS or HSM. Cluster encryption can be enabled at launch. Client-side encryption before loading protects data before it reaches Redshift, but not necessarily at rest.
VPC security groups control network access. IAM roles control who can access the cluster.
A multinational corporation uses AWS Organizations to manage multiple accounts. The data engineering team has a central data lake account that stores all data in S3. The security team requires that all cross-account access to the data lake be logged and that any access from outside the organization be blocked. The team has enabled S3 server access logs and AWS CloudTrail. However, they notice that some requests from an external AWS account are still able to read data from the data lake. The bucket policy currently allows cross-account access to a specific partner account for data exchange. What additional step should the team take to block access from all other external accounts?
A.Add a condition to the existing Allow statement to require that the source account be in the organization.
B.Remove the cross-account access statement from the bucket policy.
C.Add a Deny statement to the bucket policy that denies access to any principal not in the organization or the partner account.
D.Use S3 Access Points to restrict access to only the partner account.
AnswerC
Blocks all external accounts except the partner.
Why this answer
To block access from all external accounts except the allowed partner, you can add a Deny statement with a condition that checks if the account is not in the organization and not the partner account. Option A is wrong because disabling cross-account access would block the partner. Option B is wrong because the bucket policy already allows the partner.
Option D is wrong because S3 Access Points do not inherently block external accounts unless explicitly configured.
A data engineer wants to ensure that only users with a specific tag (e.g., "Department": "DataEngineering") can access an S3 bucket. How can this be enforced?
A.Use a bucket policy with aws:PrincipalTag condition
B.Use S3 object tags and a bucket policy condition
C.Attach an IAM policy to each user with the tag
D.Use S3 Object Lambda to check user tags
AnswerA
This is correct. The 'aws:PrincipalTag' condition key in a bucket policy evaluates the tags attached to the IAM principal (user or role) making the request, allowing fine-grained access control based on those tags.
Why this answer
S3 bucket policies support condition keys like aws:PrincipalTag, which allow access control based on tags attached to IAM principals (users or roles). Option A is correct because it uses aws:PrincipalTag in the bucket policy to restrict access to users with the specific tag. Option B is incorrect because S3 object tags are for objects, not principals, and cannot be used to filter users.
Option C is incorrect because attaching an IAM policy to each user is less scalable and does not leverage the bucket policy's centralized control. Option D is incorrect because S3 Object Lambda is for modifying data during retrieval, not for access control decisions.
Exam trap
Be careful not to confuse principal tags with resource tags. The condition 'aws:PrincipalTag' checks the requester's IAM user/role tags, while 's3:ExistingObjectTag' checks tags on the S3 object itself. This question tests the distinction.
A company uses Amazon RDS for PostgreSQL with encryption at rest using AWS KMS. The company needs to share a database snapshot with a different AWS account. What must be done to allow the target account to restore the snapshot?
A.Copy the snapshot to the target account's region and share it
B.Create an IAM role in the source account that allows cross-account snapshot access
C.Share the snapshot and update the KMS key policy to allow the target account to use the key
D.Disable encryption on the snapshot before sharing
AnswerC
The target account needs decrypt permission on the KMS key.
Why this answer
Cross-account snapshot sharing of an encrypted snapshot requires both sharing the snapshot and granting the target account permission to use the KMS key via the key policy. Option A is incorrect because copying does not grant the necessary key access. Option B is incorrect because IAM roles are not used for this purpose; KMS key policies are the mechanism for cross-account access.
Option D is incorrect because encryption cannot be disabled on an existing encrypted snapshot.
A data engineer needs to grant an IAM user access to query a specific table in Amazon Athena, but the user should not be able to view other tables in the same database. Which method should the engineer use?
A.Attach an IAM policy that allows athena:StartQueryExecution and restrict the query by table name
B.Use AWS Lake Formation to grant SELECT permission on the specific table to the user
C.Apply an S3 bucket policy that restricts access to the table's underlying data
D.Create a separate Athena workgroup with a query limit that only allows queries on that table
AnswerB
Lake Formation enables table-level access control.
Why this answer
Lake Formation provides fine-grained table-level permissions. Option A is wrong because IAM policies alone cannot restrict access to a specific table in Athena without Lake Formation. Option C is wrong because S3 bucket policies do not control Athena table access.
Option D is wrong because Workgroup policies do not provide table-level security.
A data engineer needs to audit all access to an S3 bucket for compliance. They want to capture object-level operations such as GetObject and PutObject, as well as bucket-level operations like ListBucket. Which AWS service should be used?
A.Amazon CloudWatch Logs
B.S3 server access logs
C.AWS CloudTrail management events
D.AWS Config
AnswerB
S3 server access logs provide detailed records about requests made to a bucket, including object-level and bucket-level operations.
Why this answer
S3 server access logs record both object-level operations (e.g., GetObject, PutObject) and bucket-level operations (e.g., ListBucket). AWS CloudTrail can also capture S3 API calls, but by default it logs bucket-level management events only; object-level data events must be explicitly enabled. Amazon CloudWatch Logs (Option A) is a log storage and monitoring service, not a source of S3 access logs; logs must be sent to it from another service.
AWS CloudTrail management events (Option C) capture only bucket-level operations, not object-level. AWS Config (Option D) monitors resource configuration changes, not API calls. Therefore, the correct service for auditing all S3 access is S3 server access logs.
A company has multiple AWS accounts and wants to centrally manage permissions and access to data lakes. They have enabled AWS Organizations and want to use a single set of policies that apply to all accounts. Which policy type should be used at the organization level?
A.IAM policies
B.KMS key policies
C.S3 bucket policies
D.Service control policies (SCPs)
AnswerD
Service control policies (SCPs) are used in AWS Organizations to centrally manage permissions and access across all member accounts, making them the correct choice.
Why this answer
Service Control Policies (SCPs) are used in AWS Organizations to centrally manage permissions across accounts. Option A (IAM policies) are attached to IAM users/roles within an account, not across accounts. Option B (KMS key policies) control access to KMS keys.
Option C (S3 bucket policies) are specific to S3 buckets.
Which TWO actions should a data engineer take to protect sensitive data in an Amazon S3 bucket from being accessed by unauthorized users? (Select TWO.)
Select 2 answers
A.Create a VPC endpoint for S3
B.Enable S3 server access logging
C.Add a bucket policy with a Deny effect for unauthorized principals
D.Enable AWS CloudTrail for the bucket
E.Enable S3 Block Public Access
AnswersC, E
A Deny policy explicitly denies access.
Why this answer
Options C and E are correct. Option C (bucket policy with Deny effect) explicitly denies access to unauthorized users, preventing unauthorized access. Option E (S3 Block Public Access) prevents public access to the bucket, ensuring it is not publicly accessible.
Option A (VPC endpoint) is for network connectivity, not access control. Option B (server access logging) is for auditing, not prevention. Option D (CloudTrail) is for logging and monitoring, not access control.
A data engineer needs to securely store database credentials for an RDS instance. Which TWO AWS services can be used?
Select 2 answers
A.AWS KMS
B.AWS Secrets Manager
C.AWS IAM
D.AWS CloudFormation
E.AWS Systems Manager Parameter Store
AnswersB, E
Secrets Manager is designed for managing secrets, including automatic rotation.
Why this answer
AWS Secrets Manager is a dedicated service for managing secrets, including automatic rotation. AWS Systems Manager Parameter Store can also securely store secrets like database credentials as secure string parameters. AWS KMS is used for encryption key management, not for storing secrets.
AWS IAM is for identity and access management. AWS CloudFormation is for infrastructure as code and does not natively store secrets.
A company uses AWS Glue to catalog data in Amazon S3. The data includes personally identifiable information (PII). The security team requires that PII be masked when queried by users who are not data owners. Which AWS service should be used to enforce this requirement?
A.Use Amazon Macie to automatically redact PII from S3 objects.
B.Use IAM policies with condition keys to restrict access based on tags.
C.Use AWS Lake Formation to define column-level security and data masking.
D.Use Amazon S3 Object Lambda to transform data on the fly.
AnswerC
Lake Formation provides column-level permissions and dynamic masking.
Why this answer
AWS Lake Formation provides fine-grained access control and column-level masking for data cataloged in the Glue Data Catalog, enabling PII masking at query time. Option A is wrong because Amazon Macie discovers and classifies PII but does not automatically redact data from S3 objects. Option B is wrong because IAM policies with condition keys can restrict access but cannot perform data masking.
Option D is wrong because Amazon S3 Object Lambda can transform data at the object level but not at the query level for dynamic masking.
A company is using Amazon S3 to store sensitive data. The security team requires that all objects be encrypted using server-side encryption with AWS KMS (SSE-KMS) and that the bucket policy denies any PutObject request that does not include the required encryption header. Which bucket policy condition should be added?
A.s3:x-amz-server-side-encryption-aws-kms-key-id
B.s3:x-amz-server-side-encryption
C.kms:EncryptionContext
D.aws:SecureTransport
AnswerA
This condition enforces the use of a specific KMS key.
Why this answer
S3:x-amz-server-side-encryption-aws-kms-key-id can be used to enforce a specific KMS key. Option B is wrong because s3:x-amz-server-side-encryption only enforces SSE-S3 or SSE-KMS, not a specific key. Option C is wrong because kms:EncryptionContext is for KMS, not S3.
Option D is wrong because aws:SecureTransport is for in-transit encryption.
Refer to the exhibit. A data engineer applies this bucket policy to an S3 bucket named my-data-bucket. The bucket contains sensitive data. The company's security team reports that data was accessed from an IP address outside the allowed range. What is the MOST likely reason that the policy failed to block the unauthorized access?
A.The Deny statement's condition on SecureTransport overrides the IP condition.
B.The policy has a syntax error in the Condition element.
C.The Deny statement does not restrict access based on IP address; it only denies non-HTTPS requests.
D.The bucket policy does not apply to requests made from within the same AWS account.
AnswerC
The Deny only applies to non-SecureTransport, not to IP addresses outside the allowed range.
Why this answer
The Deny statement in the policy only denies requests that are not using HTTPS (SecureTransport: false). It does not include any condition to restrict access based on IP address. Therefore, a request made from an IP outside the allowed range but using HTTPS would not be denied by this policy, allowing unauthorized access to the sensitive data.
Exam trap
The trap here is that candidates assume a Deny statement with any condition will block all unauthorized access, but in reality, each condition must be explicitly specified to deny the intended requests.
How to eliminate wrong answers
Option A is wrong because SecureTransport and IP address conditions are independent; a Deny statement with SecureTransport does not override an IP condition—it simply does not evaluate IP at all. Option B is wrong because there is no syntax error indicated in the exhibit; the policy is syntactically valid but logically incomplete. Option D is wrong because bucket policies apply to all principals, including requests made from within the same AWS account, unless explicitly scoped otherwise.
A company wants to encrypt data at rest in Amazon S3 using server-side encryption. They need to manage the encryption keys themselves and rotate them annually. Which S3 encryption option should they use?
A.SSE-KMS
B.SSE-S3
C.SSE-C
D.Client-side encryption
AnswerC
SSE-C allows the customer to provide their own encryption keys and manage them.
Why this answer
SSE-C (Server-Side Encryption with Customer-Provided Keys) allows customers to provide their own encryption keys, manage them, and rotate them as needed. SSE-S3 uses AWS-managed keys, offering no customer control over key management. SSE-KMS uses AWS KMS keys, where AWS manages the key material, though customers can manage key policies and automatic rotation.
Client-side encryption is not server-side and does not meet the requirement. Therefore, SSE-C is the correct option.
Refer to the exhibit. An IAM policy is attached to an IAM user. The user is trying to download an object from the S3 bucket 'example-bucket' from an IP address 10.1.1.1, but the request is denied. What is the most likely reason?
A.The policy does not allow the s3:GetObject action.
B.The policy has a syntax error.
C.There is an explicit deny statement elsewhere that overrides the allow.
D.The user's IP address does not match the condition in the policy.
AnswerD
The condition restricts access to IP range 10.0.0.0/16; 10.1.1.1 is outside.
Why this answer
The policy includes a condition that allows s3:GetObject only if the request originates from the 10.0.0.0/16 IP range. The user's IP address 10.1.1.1 falls outside this range, so the condition is not satisfied, resulting in an implicit deny. Therefore, the most likely reason for the denial is that the user's IP address does not match the condition, making option D correct.
Option A is incorrect because the policy does allow s3:GetObject. Option B is incorrect because the policy has no syntax error. Option C is incorrect because there is no explicit deny statement.
A data engineer needs to share a dataset stored in Amazon S3 with another AWS account. The bucket policy currently grants access only to the owning account. What is the simplest way to grant cross-account access?
A.Add a bucket policy that grants access to the other account's IAM role
B.Set the object ACL to public-read
C.Use an S3 access control list (ACL) to grant access to the other account
D.Create an IAM role in the other account and attach a policy to it
AnswerA
A bucket policy can specify a principal from another account.
Why this answer
The simplest way to grant cross-account access to an S3 bucket is to add a bucket policy that specifies the other AWS account's IAM role as the principal. This allows the role to access the bucket without requiring additional setup in the target account. Option B (public-read ACL) would make the data publicly accessible, which is not secure and not recommended for cross-account sharing.
Option C (using an ACL) is less flexible and does not support granting access to specific IAM roles across accounts. Option D (creating an IAM role in the other account) is unnecessary because the bucket policy can directly grant access to the other account's role.
A data engineer needs to audit data access events in Amazon S3. Which AWS service should be used to record and monitor API calls for S3 buckets?
A.AWS CloudTrail
B.AWS Config
C.Amazon Macie
D.Amazon GuardDuty
AnswerA
CloudTrail records API calls for auditing.
Why this answer
(AWS CloudTrail) is correct because it records API calls for S3 buckets, enabling auditing and monitoring of data access events. Option B (AWS Config) is incorrect as it tracks resource configuration changes, not API calls. Option C (Amazon Macie) is incorrect because it discovers sensitive data using machine learning.
Option D (Amazon GuardDuty) is incorrect as it is a threat detection service.
Drag a concept onto its matching description — or click a concept then click the description.
Concepts
Matches
Frequent access, low latency
Auto-moves data between tiers
Archive retrieval in minutes to hours
Lowest cost, 12-hour retrieval
Infrequent access, single AZ
Why these pairings
Correct matches: S3 Standard for frequently accessed data, S3 Intelligent-Tiering for automatic cost optimization, and S3 Glacier for archival. Common confusions involve mixing up Standard-IA and Glacier Deep Archive definitions.
A company uses AWS Lake Formation to manage access to data in a data lake. The data engineer needs to grant a user the ability to query tables in the 'sales' database using Amazon Athena, but only when the user's IP address is within the corporate network (10.0.0.0/8). Which combination of actions should the data engineer take?
A.Grant Lake Formation permissions on the tables and attach an S3 bucket policy with aws:SourceIp condition
B.Grant Lake Formation permissions on the tables and attach an IAM policy to the user with aws:SourceIp condition
C.Use an S3 VPC endpoint and grant Lake Formation permissions on the tables
D.Grant Lake Formation permissions on the tables and configure a network ACL in the VPC
AnswerB
Correct combination.
Why this answer
Lake Formation permissions are needed to grant query access to the tables in the 'sales' database, and an IAM policy attached to the user with a condition key `aws:SourceIp` restricts Athena access to the corporate IP range (10.0.0.0/8). Option A is incorrect because S3 bucket policies with `aws:SourceIp` cannot be used to restrict Athena queries through Lake Formation; Lake Formation manages access at a higher level. Option C is incorrect because using an S3 VPC endpoint alone does not enforce IP-based restrictions; it only restricts network traffic to the VPC.
Option D is incorrect because network ACLs operate at the subnet level and do not control access to specific Lake Formation resources or Athena queries.
A data engineer is configuring an Amazon Redshift cluster to encrypt data at rest. The company policy requires that encryption keys be stored in AWS CloudHSM. Which integration should the engineer use to meet this requirement?
A.Use AWS KMS with a customer managed key.
B.Configure Redshift to use an HSM for encryption.
C.Enable encryption using the AWS Redshift SSL/TLS feature.
D.Use Redshift automatic key rotation.
AnswerB
Redshift supports integration with CloudHSM for key storage.
Why this answer
The correct integration is to configure Amazon Redshift to use an HSM (Hardware Security Module) for encryption. Amazon Redshift supports AWS CloudHSM as an external HSM to store encryption keys. Option A (AWS KMS with a customer managed key) is not the integration for CloudHSM; it uses KMS, not CloudHSM.
Option C (SSL/TLS) is for encryption in transit, not at rest. Option D (automatic key rotation) is a feature of Redshift encryption but does not integrate with CloudHSM for key storage.
A company wants to enforce that all data written to an S3 bucket is encrypted with a customer-managed AWS KMS key. The data engineer has created the KMS key and attached an S3 bucket policy. However, users are still able to upload objects without specifying the KMS key. What is the most likely cause?
A.The S3 bucket policy does not include a condition that denies s3:PutObject without the correct encryption
B.The S3 bucket has default encryption enabled with SSE-S3
C.The KMS key policy does not grant the users kms:Encrypt permission
D.The IAM role for the users does not have s3:PutObject permission
AnswerA
The bucket policy must have a deny condition.
Why this answer
The bucket policy must explicitly deny s3:PutObject if the encryption header does not match the required KMS key. Without this condition, users can upload objects without specifying the KMS key, even if the bucket has default encryption. Option B is wrong because default encryption with SSE-S3 does not enforce a customer-managed KMS key.
Option C is wrong because the KMS key policy grants encryption permissions, but the issue is that the bucket policy does not deny non-compliant uploads. Option D is wrong because the IAM role's s3:PutObject permission is not the issue; the issue is the lack of a condition in the bucket policy.
A financial services company uses AWS Glue ETL jobs to process credit card transaction data stored in Amazon S3. The data includes PII such as names and credit card numbers. The security team requires that all PII be masked before the data is written to the curated zone of the data lake. The data engineer has implemented a Glue job that reads from the raw zone, applies a custom transform to mask credit card numbers using a regular expression, and writes to the curated zone. However, during a recent audit, the security team discovered that some masked data still contained partial credit card numbers (e.g., showing the last four digits) when viewed by analysts who should only see masked data. The company's policy is that credit card numbers must be completely masked, showing only asterisks or a fixed string like "XXXX-XXXX-XXXX-XXXX". The Glue job uses a DynamicFrame and applies a Map transform with a Python function that replaces digits with 'X'. The data is stored in Parquet format. What should the data engineer do to ensure complete masking of credit card numbers?
A.Use an AWS Glue crawler to classify the data and apply a masking rule based on the classification.
B.Enable server-side encryption with AWS KMS on the curated S3 bucket.
C.Replace the custom Python Map transform with a built-in Glue Transform for data masking, such as the Mask transform available in Glue Studio.
D.Change the output format from Parquet to CSV and use a different write mode.
AnswerC
Built-in masking transforms are designed to handle common patterns and ensure complete masking.
Why this answer
AWS Glue provides a built-in Mask transform that can be applied directly in Glue Studio or via the AWS Glue API. This transform is designed to reliably obfuscate sensitive data like credit card numbers by replacing them with a fixed string (e.g., 'XXXX-XXXX-XXXX-XXXX') or asterisks, ensuring complete masking regardless of input format. The custom Python Map transform in the current implementation is error-prone because it relies on a regular expression that may not catch all patterns or partial digits, whereas the Mask transform uses predefined logic to guarantee full masking.
Exam trap
The trap here is that candidates may assume any custom Python logic with a regex is sufficient for masking, but the exam tests the understanding that AWS Glue's built-in Mask transform provides a more reliable and policy-compliant solution for sensitive data obfuscation.
How to eliminate wrong answers
Option A is wrong because an AWS Glue crawler is used for schema discovery and classification, not for applying data masking rules; masking must be performed during ETL processing, not at the crawler level. Option B is wrong because enabling server-side encryption with AWS KMS protects data at rest but does not alter the content of the data; it does not mask or obfuscate credit card numbers, so analysts would still see partial digits. Option D is wrong because changing the output format from Parquet to CSV and using a different write mode has no effect on the masking logic; the custom Python Map transform would still produce the same incomplete masking, and CSV format does not inherently mask data.
A data engineer is designing a data pipeline that processes sensitive financial data. The data must be encrypted at rest and in transit. The pipeline uses Amazon Kinesis Data Streams to ingest data and AWS Lambda to process it. Which combination of actions ensures the data is encrypted in transit? (Select TWO.)
A.Enable TLS for Kinesis Data Streams.
B.Enable Encryption in Transit for the Lambda function's VPC configuration.
C.Enable Server-Side Encryption (SSE-S3) on the S3 bucket used for data storage.
D.Use AWS KMS to encrypt data at rest in Kinesis Data Streams.
E.Encrypt the Lambda function's CloudWatch Logs using KMS.
AnswerA, B
TLS encrypts data in transit between producers and Kinesis.
Why this answer
Enabling TLS for Kinesis Data Streams encrypts data in transit between producers and the stream. Option B is correct because enabling encryption in transit for the Lambda function's VPC configuration ensures TLS is used when Lambda communicates, such as with Kinesis over a VPC endpoint. Option C is incorrect because SSE-S3 encrypts data at rest in S3, not in transit.
Option D is incorrect because encrypting data at rest in Kinesis using KMS does not address encryption in transit. Option E is incorrect because encrypting CloudWatch Logs with KMS is for data at rest.
A company needs to audit access to their Amazon S3 buckets. Which TWO services can be used together to achieve this? (Choose two.)
Select 2 answers
A.Amazon Macie
B.Amazon S3 Inventory
C.Amazon CloudWatch Logs
D.AWS Config
E.AWS CloudTrail
AnswersC, E
CloudWatch Logs can store and monitor CloudTrail logs for access patterns.
Why this answer
CloudTrail records S3 API calls, and CloudWatch Logs can be used to store and monitor those logs. Config records configuration changes, not data access. S3 server access logs record object-level access, but the question asks for auditing access; CloudTrail with CloudWatch Logs is a common solution.
A company wants to audit API calls made to its Amazon S3 buckets. Which AWS services can be used to achieve this? (Choose TWO.)
Select 2 answers
A.IAM Access Analyzer
B.AWS Config
C.VPC Flow Logs
D.AWS CloudTrail
E.Amazon S3 server access logs
AnswersD, E
CloudTrail can log S3 data events.
Why this answer
Options D and E are correct. AWS CloudTrail can log API calls to S3 by enabling data events, and S3 server access logs record detailed request information. Option A is wrong because IAM Access Analyzer reviews resource policies, not API calls.
Option B is wrong because AWS Config tracks configuration changes, not API calls. Option C is wrong because VPC Flow Logs capture network traffic, not API calls.
A company uses AWS Lake Formation to manage access to data in a data lake. A new data engineer has been granted SELECT permission on a table but receives an 'AccessDeniedException' when querying via Amazon Athena. The table is registered in Lake Formation and the data is encrypted with SSE-KMS. Which of the following is the MOST likely cause?
A.The table's resource-based policy does not include the engineer's IAM role.
B.The S3 bucket policy denies access to the engineer's IAM role.
C.The AWS Glue Data Catalog has not been granted permission to the engineer's role.
D.The IAM role used by Athena does not have kms:Decrypt permission on the KMS key.
AnswerD
Correct. The IAM role used by Athena must have kms:Decrypt permission on the KMS key to access encrypted data.
Why this answer
The IAM role used by Athena does not have kms:Decrypt permission on the KMS key. When data is encrypted with SSE-KMS, Athena's IAM role requires kms:Decrypt to read the data from S3. Even if Lake Formation grants SELECT permission, the query fails without KMS access.
Option A is incorrect because Lake Formation does not use resource-based policies on tables; it uses LF-Tags or resource links to grant permissions. Option B is incorrect because while an S3 bucket policy could block access, the most likely issue with encrypted data is missing KMS permissions. Option C is incorrect because the Glue Data Catalog does not enforce data access; Lake Formation is the service that manages fine-grained access.
It allows ListBucket on the bucket and GetObject on objects, enabling read-only access. Option A is wrong because it grants write actions (PutObject, DeleteObject). Option B is wrong because it allows all S3 actions (s3:*).
Option D is wrong because it only allows ListBucket, not GetObject.
A data engineer is configuring S3 bucket policies to restrict access to a specific VPC. Which condition key should be used in the bucket policy to enforce that requests originate only from the desired VPC?
A.aws:VpcSourceIp
B.aws:SourceVpc
C.aws:RequestedRegion
D.aws:SourceIp
AnswerB
aws:SourceVpc restricts requests to a specific VPC.
Why this answer
Aws:SourceVpc is the condition key used in S3 bucket policies to restrict access to requests originating from a specific VPC. Option A is incorrect because aws:VpcSourceIp is not a valid AWS condition key. Option C is incorrect because aws:RequestedRegion is used to restrict based on the region, not VPC.
Option D is incorrect because aws:SourceIp restricts based on IP addresses, not VPC.
A company uses AWS Glue to process sensitive customer data stored in S3. The security team requires that all data be encrypted at rest using a customer-managed KMS key and that access to the key be auditable. Which solution meets these requirements?
A.Encrypt the data client-side before uploading to S3.
B.Configure the S3 bucket to use SSE-KMS with a customer-managed KMS key and enable CloudTrail for KMS events.
C.Enable default SSE-S3 encryption on the S3 bucket.
D.Use SSE-C with a customer-provided key.
AnswerB
SSE-KMS with customer-managed key provides encryption and auditability via CloudTrail.
Why this answer
SSE-KMS with a customer-managed KMS key provides encryption at rest and, when combined with CloudTrail logging for KMS events, offers full auditability of key usage. Option A (client-side encryption) does not encrypt data at rest within S3; it encrypts before upload. Option C (SSE-S3) uses AWS-managed keys, which do not allow customer audit of key access.
Option D (SSE-C) relies on customer-provided keys that are not managed by KMS and cannot be audited via CloudTrail.
A company has a data lake in Amazon S3 with millions of objects. The security team wants to enforce that all objects are encrypted with a specific customer-managed KMS key. The data engineer configures an S3 bucket policy to deny PutObject if the encryption is not set to that key. However, some existing objects are not encrypted with that key. What is the most efficient way to remediate the existing objects?
A.Use S3 Cross-Region Replication to replicate objects to a new bucket with the correct encryption.
B.Write a script using the AWS SDK to iterate over all objects and re-upload them with the correct encryption.
C.Use S3 Batch Operations to copy objects in the same bucket with the new encryption settings.
D.Use S3 Object Lambda to dynamically encrypt objects on read.
AnswerC
Batch Operations can efficiently update encryption for large numbers of objects.
Why this answer
S3 Batch Operations can copy objects within the same bucket with new encryption settings, efficiently updating millions of objects in place. Option A is incorrect because S3 Cross-Region Replication replicates objects to a different bucket or region, not to the same bucket with changed encryption. Option B is inefficient compared to Batch Operations for large-scale remediation.
Option D is incorrect because S3 Object Lambda transforms data on read, not at rest, so it does not change the stored encryption of existing objects.
A company has an AWS Glue ETL job that reads data from an S3 bucket encrypted with SSE-S3. The job runs successfully, but the output written to another S3 bucket with SSE-KMS fails. The IAM role for the Glue job has s3:PutObject and kms:GenerateDataKey permissions. What is the most likely cause?
A.The IAM role is missing kms:Encrypt permission
B.The target S3 bucket policy denies s3:PutObject
C.The KMS key policy does not grant the Glue role kms:GenerateDataKey
D.The source bucket's encryption type is incompatible with the target
AnswerA
Writing with SSE-KMS requires kms:Encrypt.
Why this answer
For SSE-KMS, the IAM role needs both kms:GenerateDataKey and kms:Encrypt permissions to write objects. The role already has kms:GenerateDataKey, but missing kms:Encrypt causes the write to fail. Option A is correct.
Option B is incorrect because if the bucket policy denied s3:PutObject, the job would fail on the PutObject action itself, not on encryption. Option C is incorrect because the role already has kms:GenerateDataKey; the missing permission is kms:Encrypt. Option D is incorrect because the source bucket's encryption (SSE-S3) is irrelevant to the write operation; the error occurs on the target bucket with SSE-KMS.
A company uses AWS Lake Formation to manage data lake permissions. The data engineer notices that a user with SELECT permission on a table can also query the underlying data in Amazon S3 directly. How can the engineer enforce that access to the S3 data is only through Lake Formation?
A.Use S3 Access Points with a policy that restricts access to only Lake Formation
B.Grant the user permissions only through Lake Formation and remove any IAM policies that allow direct S3 access to the data location
C.Enable S3 Block Public Access on the bucket
D.Change the S3 bucket policy to deny all access except from Lake Formation
AnswerB
This ensures that the user can only access data through Lake Formation, and direct S3 access is blocked.
Why this answer
When using Lake Formation, you should grant permissions only through Lake Formation and remove any IAM policies that allow direct S3 access. This ensures that users cannot bypass Lake Formation's fine-grained access controls. Option A (S3 Access Points) can restrict access but does not inherently enforce Lake Formation-only access unless properly configured with a policy that specifically allows only Lake Formation, which is more complex and not the recommended approach.
Option C (S3 Block Public Access) only prevents public access but does not prevent authorized IAM users from direct access. Option D (bucket policy denying all except Lake Formation) could work but is not the simplest or most standard method; the recommended practice is to use Lake Formation's integration and manage permissions centrally.
A company is using Amazon EMR to process data stored in Amazon S3. The S3 bucket is configured with a bucket policy that denies access unless the request includes a specific tag. The EMR cluster's IAM role has s3:GetObject permission. However, the EMR job fails to read data from S3. What is the most likely cause?
A.The bucket policy is not attached to the EMR role.
B.The EMR cluster is not in the same account as the S3 bucket.
C.The IAM role does not have a condition that matches the required tag.
D.The EMR role does not have s3:GetObject permission.
AnswerC
The bucket policy requires a tag, and the role must have a matching condition.
Why this answer
The bucket policy denies access unless the request includes a specific tag. Even though the EMR cluster's IAM role has s3:GetObject permission, the IAM role does not have a condition key (e.g., aws:RequestTag) that matches the required tag. Therefore, the request is denied by the bucket policy, causing the EMR job to fail.
Exam trap
AWS often tests the interaction between IAM policies and S3 bucket policies, specifically that a bucket policy with a deny condition can override IAM permissions, and candidates mistakenly think the issue is missing IAM permissions rather than a missing condition in the request.
How to eliminate wrong answers
Option A is wrong because bucket policies are attached to the S3 bucket, not to IAM roles; the policy is already configured on the bucket. Option B is wrong because cross-account access is possible with proper permissions, and the question does not indicate a different account; the failure is due to the tag condition, not account mismatch. Option D is wrong because the question explicitly states the IAM role has s3:GetObject permission, so the failure is not due to missing permission.
A company is using Amazon EMR with Kerberos authentication. They want to ensure that data in transit between EMR cluster nodes is encrypted. Which configuration should be applied?
A.Use VPC peering to connect the cluster nodes.
B.Configure the EMR cluster to use in-transit encryption.
C.Enable S3 server-side encryption for the cluster's output data.
D.Enable EBS encryption on the cluster instances.
AnswerB
In-transit encryption uses TLS to protect data between nodes.
Why this answer
Enabling in-transit encryption in Amazon EMR uses TLS to encrypt data between nodes, ensuring data in transit is encrypted. Option A is incorrect because VPC peering does not provide encryption; it is a network connectivity feature. Option C is incorrect because S3 server-side encryption encrypts data at rest, not in transit.
Option D is incorrect because EBS encryption encrypts data at rest.
A data engineer needs to audit all AWS KMS key usage in the account. Which AWS service should be used to record KMS API calls?
A.AWS CloudTrail
B.AWS Config
C.Amazon CloudWatch Logs
D.Amazon GuardDuty
AnswerA
AWS CloudTrail records API calls for KMS, allowing auditing of all KMS key usage.
Why this answer
AWS CloudTrail records API calls for KMS. Option B (AWS Config) is wrong because it records resource changes, not API calls. Option C (Amazon CloudWatch Logs) is wrong because it stores logs but does not record API calls.
Option D (Amazon GuardDuty) is wrong because it is for threat detection.
A data engineer needs to audit all access to an S3 bucket containing sensitive customer data. The engineer must record the requester, timestamp, action, and whether the access was denied. Which AWS solution meets these requirements?
A.Use AWS Config to record S3 bucket-level configuration changes.
B.Enable VPC Flow Logs for the VPC where the bucket resides.
C.Enable AWS CloudTrail Data Events for the S3 bucket.
D.Enable S3 server access logs for the bucket, storing them in a different bucket.
AnswerD
S3 server access logs provide detailed records of all requests, including requester and access status.
Why this answer
S3 server access logs capture detailed records of requests made to a bucket, including the requester, timestamp, action, and response status (e.g., whether the access was denied). These logs are stored in a designated target bucket and are specifically designed for auditing access requests. Option A is incorrect because AWS Config tracks configuration changes, not individual access requests.
Option B is incorrect because VPC Flow Logs capture IP traffic metadata, not application-level S3 operations. Option C is incorrect because while AWS CloudTrail can log object-level events when Data Events are enabled, S3 server access logs are purpose-built for this auditing requirement and provide granular details out of the box without additional setup or cost beyond logging.
A company wants to audit all changes to IAM policies in their AWS account. Which combination of services should be used to achieve this?
A.AWS Config and Amazon SNS
B.AWS CloudTrail and Amazon CloudWatch Logs
C.Amazon CloudWatch Logs and Amazon SNS
D.AWS CloudTrail and Amazon DynamoDB
AnswerB
CloudTrail records IAM API calls and can deliver logs to CloudWatch Logs for monitoring and alerting.
Why this answer
AWS CloudTrail records all API calls made in the account, including IAM policy changes (e.g., PutRolePolicy, PutUserPolicy). By sending CloudTrail logs to Amazon CloudWatch Logs, you can monitor and set up alerts for policy modifications. This combination provides a complete audit trail for IAM changes.
Option B is correct. AWS Config records resource configuration changes but not all API calls; Amazon SNS alone or with Config does not capture the API events; DynamoDB is not used for CloudTrail log storage or monitoring.
A data engineer is setting up an Amazon EMR cluster to process sensitive data. The data is stored in S3 with SSE-S3. The company policy requires that data in transit between the EMR cluster and S3 be encrypted. Which configuration should be used?
A.Enable S3 encryption in transit using TLS
B.Disable encryption and use VPC endpoints
C.Configure EMRFS to use SSE-KMS
D.Use SSE-C for S3 objects
AnswerA
TLS encrypts data in transit between EMR and S3.
Why this answer
Enabling S3 encryption in transit using TLS encrypts data between the EMR cluster and S3. Amazon S3 supports HTTPS (TLS) endpoints by default, and this ensures that data is encrypted during transfer. Option B is wrong because disabling encryption is not allowed per policy.
Option C is incorrect because EMRFS with SSE-KMS encrypts data at rest, not in transit. Option D is wrong because SSE-C is also an at-rest encryption mechanism, not for transit.
Refer to the exhibit. A data engineer runs this CLI command to investigate a recent change to an S3 bucket policy. What information does the command return?
A.An evaluation of bucket policy compliance
B.The current bucket policy for all buckets
C.A report of all S3 bucket policy changes
D.A list of event IDs for PutBucketPolicy calls
AnswerD
The output includes event IDs, but also other details like user identity and timestamp.
Why this answer
The command uses CloudTrail's lookup-events to find all PutBucketPolicy API calls in a 24-hour period. It returns a list of events, each containing details like who made the call, when, and the request parameters. Option A is wrong because the command returns a list of event IDs, not an evaluation of compliance.
Option B is wrong because the command does not show the current policy, only past events. Option C is wrong because the command does not evaluate compliance.
A company stores sensitive data in S3 and uses VPC endpoints to access the bucket. They need to ensure that only traffic from their VPC can access the data, and that the traffic cannot leave the AWS network. Which combination of bucket policy and endpoint policy should they use?
A.Use only a bucket policy with aws:SourceIp condition
B.Use an S3 VPC Gateway endpoint and add a bucket policy with aws:SourceVpc condition
C.Use an S3 VPC Interface endpoint and add a bucket policy with aws:SourceVpce condition
D.Use an S3 VPC Gateway endpoint with no bucket policy
AnswerB
Gateway endpoints keep traffic within AWS network and the condition restricts to the VPC.
Why this answer
Using an S3 VPC Gateway endpoint with a bucket policy that includes the aws:SourceVpc condition restricts access to traffic originating from the specified VPC, and Gateway endpoints use AWS private network, ensuring traffic does not leave the AWS network. Option A is incorrect because aws:SourceIp checks IP addresses, not VPC origin, so it cannot enforce VPC-only access. Option C is incorrect because VPC Interface endpoints, while private, rely on aws:SourceVpce condition which checks the specific endpoint ID rather than the VPC; the requirement is to restrict to the entire VPC.
Option D is incorrect because without any bucket policy, the bucket would be publicly accessible or accessible to any authenticated user, failing to restrict to the VPC.
A data engineer is configuring an Amazon Redshift cluster for compliance. The cluster must encrypt data at rest and automatically rotate the encryption key every year. Which steps should the engineer take? (Choose THREE.)
Select 3 answers
A.Create the Redshift cluster with encryption enabled.
B.Enable automatic yearly rotation of the KMS key.
C.Configure the Redshift cluster to rotate its encryption key every year.
D.Modify an existing unencrypted cluster to enable encryption.
E.Specify a customer-managed AWS KMS key for encryption.
AnswersA, B, E
Encryption must be enabled at creation.
Why this answer
The correct steps to meet the compliance requirements are A, B, and E. Option A is correct because encryption must be enabled during Redshift cluster creation; it cannot be added afterward. Option B is correct because using a customer-managed KMS key allows you to enable automatic yearly rotation of the key itself, satisfying the key rotation requirement.
Option E is correct because specifying a customer-managed KMS key gives you control over the key and its rotation policy. Option C is incorrect because Redshift does not provide a native mechanism to rotate the cluster's encryption key; key rotation is handled at the KMS level. Option D is incorrect because encryption cannot be enabled on an existing unencrypted Redshift cluster; you must create a new cluster with encryption enabled.
A company needs to enforce encryption in transit for all data moving between its Amazon S3 bucket and a fleet of Amazon EC2 instances. The data is accessed via S3 API calls over the internet. Which configuration ensures encryption in transit?
A.Enable SSE-S3 on the bucket.
B.Enable S3 Transfer Acceleration.
C.Use a VPC endpoint for S3.
D.Configure the bucket policy to deny requests that do not use HTTPS.
AnswerD
Bucket policy with condition aws:SecureTransport true enforces HTTPS.
Why this answer
Configuring the bucket policy to deny requests that do not use HTTPS ensures encryption in transit for S3 API calls. Option A is wrong because SSE-S3 encrypts data at rest, not in transit. Option B is wrong because S3 Transfer Acceleration uses a global network but does not enforce encryption; HTTPS must still be used.
Option C is wrong because a VPC endpoint for S3 uses AWS network but does not enforce encryption; the bucket policy must explicitly require HTTPS.
A company is building a data pipeline that ingests sensitive customer data from an on-premises database into Amazon S3 using AWS DMS. The data must be encrypted at rest in S3 and in transit. The security team requires that the encryption keys be managed by the company (not AWS). Which TWO actions should the data engineer take to meet these requirements? (Choose TWO.)
Select 2 answers
A.Enable encryption at rest using the default DMS encryption settings.
B.Configure the S3 bucket to use server-side encryption with AWS KMS (SSE-KMS) using a customer managed key.
C.Configure the S3 bucket to use server-side encryption with S3 managed keys (SSE-S3).
D.Enable SSL/TLS encryption on the DMS source and target endpoints.
E.Create an AWS KMS key and use it in the DMS endpoint to encrypt data in transit.
AnswersB, D
Customer managed keys allow the company to control the keys.
Why this answer
SSE-KMS with a customer managed key allows the company to control the encryption keys used for S3 server-side encryption, meeting the requirement that keys be managed by the company, not AWS. Option D is correct because enabling SSL/TLS on both the DMS source and target endpoints ensures data is encrypted in transit between the on-premises database and AWS DMS, and between DMS and S3, satisfying the in-transit encryption requirement.
Exam trap
The trap here is that candidates often confuse encryption at rest with encryption in transit, and mistakenly think that KMS keys can be used for both, or that default DMS encryption or SSE-S3 satisfies the customer-managed key requirement.
A data engineer runs an AWS Glue ETL job that reads from a table in the AWS Glue Data Catalog. The job fails with the error shown. The IAM role used by the Glue job has the following policy attached:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"glue:GetTable",
"glue:GetDatabase"
],
"Resource": "*"
}
]
}
What should be added to the IAM role's policy to resolve the error?
A.s3:GetObject on the underlying S3 bucket
B.glue:GetTable on the specific table resource
C.lakeformation:GetDataAccess on the table resource
D.kms:Decrypt on the KMS key
AnswerC
This permission is required to access tables governed by Lake Formation.
Why this answer
Lake Formation requires lakeformation:GetDataAccess permission on the table. Option A is wrong because the error is about Lake Formation, not S3. Option B is wrong because the role already has glue:GetTable.
Option D is wrong because kms:Decrypt is not indicated.
A financial services company uses a multi-account AWS Organization with hundreds of accounts. The data engineering team needs to enable cross-account access to an encrypted S3 bucket in the data lake account (account ID 111111111111) for a Glue ETL job running in the analytics account (account ID 222222222222). The S3 bucket uses AWS KMS customer managed key (CMK) for server-side encryption (SSE-KMS). The Glue job fails with an AccessDenied error when trying to read data from the bucket. The IAM roles in both accounts have the necessary S3 permissions and the bucket policy allows access from the analytics account. What is the most likely cause of the failure?
A.The KMS key policy does not grant the analytics account's IAM role permission to use the key for decryption.
B.The S3 bucket is in a different region than the Glue job.
C.The Glue job does not have an IAM role assigned.
D.The S3 bucket policy does not allow the s3:GetObject action for the analytics account's IAM role.
AnswerA
Cross-account access to SSE-KMS encrypted objects requires the key policy to allow the decrypt action for the external principal.
Why this answer
The Glue job fails because the KMS key policy does not grant the analytics account's IAM role permission to use the key for decryption. S3 permissions alone are insufficient when SSE-KMS is used; the key policy must explicitly allow the decrypt action for the cross-account principal.
A company uses Amazon DynamoDB to store session data. The security team requires that all data be encrypted at rest using a customer-managed KMS key. The data engineer has enabled DynamoDB encryption with a customer-managed key. However, the security team notices that the key is not being used for all tables; some tables still use the default AWS-managed key. The engineer needs to ensure that all new tables are automatically encrypted with the customer-managed key. The company has hundreds of developers who create tables using various methods (console, CLI, SDK, CloudFormation). What is the most efficient way to enforce this policy?
A.Create a CloudFormation template that all developers must use to create tables.
B.Attach an SCP to deny creating DynamoDB tables without the customer-managed key.
C.Use an AWS Config rule to check for tables not using the customer-managed key and trigger auto-remediation.
D.Update the company's internal documentation and require all developers to specify the KMS key in their code.
AnswerC
Config can detect and remediate non-compliant resources.
Why this answer
AWS Config rules can evaluate whether DynamoDB tables use customer-managed KMS keys and take remediation actions. Option A is wrong because it requires updating all existing code. Option B is wrong because CloudFormation templates can be bypassed.
Option D is wrong because SCPs cannot enforce encryption configuration for DynamoDB.
A company uses AWS Lake Formation to manage data lake permissions. A data analyst is unable to query a table in the data lake using Amazon Athena. The table is registered in Lake Formation, and the analyst has SELECT permission granted via Lake Formation. What is the most likely reason for the failure?
A.Athena is configured to use encryption in transit
B.The IAM role used by Athena does not have necessary Lake Formation permissions
C.The S3 bucket policy does not grant access to the analyst's IAM role
D.The table is not registered in the AWS Glue Data Catalog
AnswerB
Athena needs permissions to call Lake Formation APIs.
Why this answer
Lake Formation integrates with Athena, and the IAM role assumed by Athena must have necessary Lake Formation permissions (e.g., SELECT on the table) to query the data. Option A is incorrect because encryption in transit is about data protection during transmission, not access control; it does not prevent querying. Option C is incorrect because when using Lake Formation, S3 bucket policies are not the primary mechanism for granting access; Lake Formation manages permissions, and the bucket policy typically allows the Lake Formation service role, not the analyst's role.
Option D is incorrect because the table is registered in Lake Formation, which requires it to be in the AWS Glue Data Catalog; so this is not the issue.
Refer to the exhibit. An IAM policy includes the above statement to allow decryption of a KMS key under specific conditions. What does this policy allow?
A.Decrypt any data encrypted with any KMS key
B.Decrypt data that was encrypted with the encryption context {"aws:pi":"db-123"}
C.Encrypt data with the KMS key using the specified encryption context
D.Decrypt data encrypted with the KMS key without any encryption context
AnswerB
The condition matches that context.
Why this answer
The policy allows the Decrypt action on the KMS key only when the encryption context condition is met, specifically the key 'aws:pi' with value 'db-123'. This means only data encrypted with that encryption context can be decrypted. Option A is incorrect because the condition restricts to a specific encryption context, not any KMS key.
Option C is incorrect because the action is Decrypt, not Encrypt. Option D is incorrect because decryption without the required encryption context would not satisfy the condition.
A company wants to centrally manage access to multiple AWS accounts for its data engineers. The company already uses AWS Organizations. Which AWS service should be used to define fine-grained permissions across accounts?
A.AWS IAM
B.AWS IAM Identity Center (AWS Single Sign-On)
C.AWS Resource Access Manager (AWS RAM)
D.AWS Key Management Service (AWS KMS)
AnswerB
IAM Identity Center provides centralized access management across accounts.
Why this answer
AWS IAM Identity Center (formerly AWS Single Sign-On) enables centralized management of permissions across multiple AWS accounts by allowing administrators to define fine-grained permissions using permission sets. This eliminates the need to create individual IAM users in each account. Option A is incorrect because IAM is per-account and does not support cross-account permission management without additional configuration.
Option C is incorrect because AWS Resource Access Manager (RAM) is used to share resources, not to define permissions. Option D is incorrect because AWS Key Management Service (KMS) is for encryption key management, not access control.
A financial services company uses AWS KMS to encrypt data in Amazon S3. The compliance team requires that all encryption keys be rotated automatically every 365 days. The data engineer needs to implement this requirement without manual intervention. Which solution meets the requirement with the LEAST operational overhead?
A.Create a customer managed key (CMK) in KMS with automatic rotation enabled every 365 days. Use this CMK to encrypt S3 objects.
B.Create a customer managed key with imported key material and configure a Lambda function to rotate the key every 365 days.
C.Use the AWS managed key for Amazon S3 (aws/s3) for server-side encryption.
D.Use S3 server-side encryption with S3 managed keys (SSE-S3).
AnswerC
AWS managed keys are automatically rotated every year with no operational overhead.
Why this answer
The AWS managed key for Amazon S3 (aws/s3) is automatically rotated by AWS every 365 days (or less) with no configuration or maintenance required. This satisfies the compliance requirement with zero operational overhead, as the rotation is handled entirely by the AWS KMS service without any manual intervention or custom automation.
Exam trap
The trap here is that candidates often assume customer managed keys (CMK) with automatic rotation are the only way to meet a specific rotation interval, overlooking that AWS managed keys already rotate on a 365-day schedule and require zero configuration, making them the least overhead solution.
How to eliminate wrong answers
Option A is wrong because customer managed keys (CMKs) with automatic rotation have a default rotation period of 365 days, but enabling automatic rotation requires manual activation and does not meet the 'least operational overhead' requirement compared to using an AWS managed key. Option B is wrong because using imported key material disables automatic rotation in KMS, requiring a custom Lambda function to manually rotate the key, which introduces significant operational overhead and complexity. Option D is wrong because SSE-S3 uses S3 managed keys (Amazon S3-managed keys) that are rotated automatically, but the rotation frequency is not guaranteed to be exactly every 365 days and is not configurable; the compliance team specifically requires a 365-day rotation interval, which is not a documented behavior of SSE-S3.
A company uses Amazon Redshift for data warehousing. The security team requires that all data in transit between the Redshift cluster and clients be encrypted. Which feature should be enabled?
A.Client-side VPN
B.SSL/TLS encryption
C.AWS KMS key
D.VPC peering
AnswerB
Redshift supports SSL/TLS for encrypting client connections.
Why this answer
Amazon Redshift supports SSL/TLS encryption for client connections to ensure data in transit is encrypted. Option A (Client-side VPN) is not a Redshift feature for encrypting client connections. Option C (AWS KMS key) is used for encrypting data at rest, not in transit.
Option D (VPC peering) does not provide encryption of data in transit between the cluster and clients.
A company uses Amazon Redshift for data warehousing. The security team requires that all queries be logged for audit and that sensitive columns be masked for non-privileged users. Which THREE steps should the data engineer take? (Choose 3)
Select 3 answers
A.Implement row-level security using Redshift's row-level security feature.
B.Enable audit logging on the Redshift cluster.
C.Enable CloudTrail logging for Redshift data events.
D.Use IAM roles to restrict access to specific columns.
E.Create views that expose only non-sensitive columns and grant access to those views.
AnswersA, B, E
Row-level security filters rows based on user.
Why this answer
The correct answers are A, B, and E. Option A: Redshift supports row-level security, which restricts access to rows based on user authorization, meeting the requirement to mask sensitive data for non-privileged users. Option B: Enabling audit logging on the Redshift cluster captures all queries for audit purposes, satisfying the logging requirement.
Option E: Creating views that expose only non-sensitive columns and granting access to those views is a common method to implement column-level masking in Redshift. Option C is incorrect because AWS CloudTrail logs API calls to Redshift (e.g., cluster operations) but does not log SQL queries; for query logging, audit logging must be enabled. Option D is incorrect because IAM roles control access to the Redshift database itself but cannot restrict access to specific columns; column-level control is achieved through views or column-level security.
A company uses Amazon RDS for PostgreSQL to store financial data. The security team requires that all database connections be encrypted in transit and that the database audit logs be stored in Amazon S3 for at least 7 years. Which steps should the data engineer take to meet these requirements?
A.Enable encryption at rest using AWS KMS, and configure the RDS instance to publish logs to an S3 bucket with a lifecycle policy
B.Configure the DB security group to allow only TLS connections, and set up AWS CloudTrail to log all database queries
C.Use an SSL certificate from AWS Certificate Manager (ACM) and attach it to the RDS instance, and stream logs to Amazon Kinesis Data Firehose with S3 destination
D.Set the `rds.force_ssl` parameter to 1 in the DB parameter group, and export RDS audit logs to Amazon CloudWatch Logs with a subscription to Amazon S3
AnswerD
Forces TLS and enables long-term storage.
Why this answer
Setting `rds.force_ssl` to 1 in the DB parameter group forces all connections to use SSL/TLS, ensuring encryption in transit. To store audit logs in S3 for at least 7 years, you can export RDS audit logs to Amazon CloudWatch Logs and create a subscription filter to stream them to Amazon S3, where an S3 lifecycle policy can manage retention. Option A is incorrect because encryption at rest does not enforce TLS for connections, and RDS cannot publish logs directly to S3.
Option B is incorrect because security groups control network access, not encryption protocol, and CloudTrail logs AWS API calls, not database queries. Option C is incorrect because ACM certificates are not used with RDS for SSL connections, and streaming to Kinesis Firehose is unnecessary and not directly supported for RDS audit logs.
A data engineer needs to ensure that all data stored in an S3 bucket is encrypted at rest. Which S3 bucket policy condition key should be used to enforce encryption using AWS KMS?
A.s3:x-amz-server-side-encryption
B.kms:EncryptionContext
C.s3:x-amz-acl
D.s3:x-amz-server-side-encryption-aws-kms-key-id
AnswerD
This condition key allows you to require that a specific KMS key is used for server-side encryption, enforcing encryption at rest with a particular key.
Why this answer
The s3:x-amz-server-side-encryption-aws-kms-key-id condition key allows you to enforce that a specific KMS key is used for server-side encryption with AWS KMS (SSE-KMS). Option A is incorrect because s3:x-amz-server-side-encryption only checks whether server-side encryption is enabled, but does not require a specific KMS key. Option B is incorrect because kms:EncryptionContext is a condition key used in KMS policies, not S3 bucket policies.
Option C is incorrect because s3:x-amz-acl is used for access control lists, not encryption.
A company uses AWS Lake Formation to manage data lakes on Amazon S3. The data engineer needs to grant a data analyst access to query specific columns in a table using Amazon Athena, but deny access to columns containing personally identifiable information (PII). Which Lake Formation feature should be used?
A.Row-level security filters.
B.Column-level permissions in Lake Formation.
C.Tag-based access control with Lake Formation tags.
D.Cell-level security with AWS Glue.
AnswerB
Column-level permissions allow granting access to specific columns and denying others.
Why this answer
Lake Formation column-level permissions allow granting access to specific columns and denying access to others. This is the correct feature for restricting access to PII columns while allowing querying other columns. Row-level security (A) controls which rows are visible, not columns.
Tag-based access control (C) is for resource categorization, not fine-grained column access. Cell-level security (D) is not a feature of Lake Formation or AWS Glue.
A data engineer needs to ensure that an Amazon Redshift cluster only accepts encrypted connections. Which parameter should be modified?
A.enable_user_activity_logging
B.max_concurrency_scaling_clusters
C.require_SSL
D.wlm_json_configuration
AnswerC
This parameter enforces SSL connections.
Why this answer
Setting the `require_SSL` parameter to `true` forces all connections to the Amazon Redshift cluster to use SSL/TLS encryption, ensuring that data in transit is encrypted. This parameter is modified in the cluster's parameter group and applies to both JDBC and ODBC connections, as well as the Redshift Query Editor.
Exam trap
The trap here is that candidates may confuse `require_SSL` with other security-related parameters like `enable_user_activity_logging` (auditing) or assume that encryption is handled by a different mechanism (e.g., WLM or concurrency scaling), leading them to pick a wrong option that sounds security-adjacent but is technically unrelated.
How to eliminate wrong answers
Option A is wrong because `enable_user_activity_logging` controls the logging of user activity (e.g., queries run by users) for auditing purposes, not connection encryption. Option B is wrong because `max_concurrency_scaling_clusters` defines the maximum number of concurrency scaling clusters that can be used to handle spikes in concurrent queries, unrelated to encryption. Option D is wrong because `wlm_json_configuration` defines workload management (WLM) queue configurations (e.g., concurrency, memory allocation) and has no effect on SSL/TLS enforcement.
A data engineer is designing a data lake on Amazon S3 with AWS Lake Formation. The data lake contains personally identifiable information (PII). The company has a policy that only users who have completed data privacy training can access the PII data. The training status is stored in an external identity provider (IdP) as an attribute. The data engineer needs to enforce this policy using Lake Formation. Which THREE steps should the data engineer take? (Choose THREE.)
Select 3 answers
A.Create an LF-tag called 'trainingCompleted' with values 'true' and 'false'. Grant 'SELECT' permission on the LF-tag 'trainingCompleted=true' to the federated users.
B.Configure SAML-based federation between the IdP and AWS to pass the training status attribute in the SAML assertion.
C.Create a column-level filter on the PII columns that limits access based on the user's training attribute.
D.Create an IAM role for each user and attach a policy that allows 'lakeformation:GetDataAccess' only if the user has the training attribute.
E.Associate the LF-tag 'trainingCompleted=true' with the PII columns in the tables.
AnswersA, B, E
This allows users with the tag to access data associated with that tag.
Why this answer
LF-tags allow Lake Formation to manage access based on metadata attributes. By creating an LF-tag 'trainingCompleted' with values 'true' and 'false', and granting SELECT permission on the tag value 'true' to federated users, the data engineer can enforce that only users with the training attribute can access the tagged resources. This approach decouples access control from IAM roles and leverages tag-based authorization, which is the recommended method for attribute-based access control (ABAC) in Lake Formation.
Exam trap
The trap here is that candidates often confuse column-level filters (Option C) with tag-based access control, not realizing that column-level filters cannot dynamically evaluate external IdP attributes, whereas LF-tags with SAML assertions can enforce attribute-based policies.
A data engineer uses the AWS CLI to list KMS keys and describe one. The output shows two keys. The described key has KeyState 'Enabled' and Origin 'AWS_KMS'. Which statement is true about this key?
A.The key is a KMS managed key that is enabled and ready for use
B.The key material was imported from an external source
C.The key is scheduled for deletion
D.The key is disabled and cannot be used
AnswerA
Origin 'AWS_KMS' and KeyState 'Enabled' indicate it is a managed, enabled key.
Why this answer
The key has KeyState 'Enabled' and Origin 'AWS_KMS', which means it is an AWS KMS managed key that is enabled and ready for use. Option B is incorrect because Origin 'AWS_KMS' indicates the key material is generated by AWS, not imported. Option C is incorrect because a key scheduled for deletion would have KeyState 'PendingDeletion'.
Option D is incorrect because KeyState 'Enabled' means the key is not disabled.
A data engineer is setting up an Amazon RDS for MySQL database. The compliance team requires that all data at rest be encrypted. What must the engineer do to enable encryption for this database?
A.Specify an AWS KMS key when launching the DB instance
B.Enable encryption after the DB instance is created by modifying the DB instance
C.Use AWS Secrets Manager to store the encryption key and attach it to the DB instance
D.Encrypt the underlying EBS volumes after the instance is created
AnswerA
Encryption must be enabled at launch by choosing a KMS key.
Why this answer
Encryption at rest for Amazon RDS can only be enabled at launch time. After creation, you cannot enable encryption; you must create a new encrypted instance and migrate data.
Match each AWS networking concept to its definition.
Drag a concept onto its matching description — or click a concept then click the description.
Concepts
Matches
Virtual private cloud isolated network
Segment of VPC IP address range
Stateful firewall for instances
Stateless firewall for subnets
Enables VPC to internet communication
Why these pairings
Networking fundamentals for AWS: VPC is a virtual network, subnets are subdivisions, security groups are instance-level firewalls, and NACLs are subnet-level stateless firewalls.
A data engineer is designing a data pipeline that processes PII data in AWS Glue. They need to ensure data is encrypted at rest and in transit. Which TWO actions should they take? (Choose TWO.)
Select 2 answers
A.Disable SSL for Glue connections
B.Configure S3 bucket server-side encryption for job output
C.Use a KMS key for Glue job bookmarks
D.Use CloudWatch Logs for encryption
E.Enable encryption at rest for the AWS Glue Data Catalog
AnswersB, E
Encrypts data stored in S3.
Why this answer
To ensure data is encrypted at rest and in transit, the data engineer should configure S3 bucket server-side encryption for job output (Option B) because Glue jobs write output to S3, and server-side encryption protects data at rest. Additionally, enabling encryption at rest for the AWS Glue Data Catalog (Option E) encrypts the catalog metadata at rest. Option A is incorrect because SSL should not be disabled; SSL provides encryption in transit.
Option C is incorrect because KMS keys for Glue job bookmarks encrypt only bookmarks, not all data. Option D is incorrect because CloudWatch Logs are for logging, not for encryption.
Default encryption automatically encrypts objects at rest.
Why this answer
Default encryption, is the correct bucket setting because it ensures all objects uploaded to the bucket are automatically encrypted at rest using SSE-S3 or SSE-KMS. Option B is incorrect because S3 Object Lock is used for compliance and retention, not encryption. Option C is incorrect because while a bucket policy can enforce encryption via the s3:x-amz-server-side-encryption header, the question asks for a bucket setting, and default encryption is the simpler and direct setting.
Option D is incorrect because S3 Block Public Access controls public access, not encryption.
A data engineer needs to ensure that an Amazon S3 bucket used for sensitive data is encrypted at rest using a customer-managed AWS KMS key. The bucket policy must enforce encryption for all PUT requests. Which policy statement should be added to the bucket policy?
This denies if encryption is not aws:kms or if the key ID is not provided, enforcing the required encryption.
Why this answer
It uses a Deny effect with a condition that blocks PUT requests unless the encryption header specifies 'aws:kms' (SSE-KMS) AND the KMS key ID matches the required customer-managed key. The combination of StringNotEquals on the encryption type and Null on the key ID ensures that any request not using the specified KMS key is denied, enforcing both encryption at rest and the use of the customer-managed key.
Exam trap
The trap here is that candidates often choose a simple Deny on a missing encryption header (Option A) without realizing that it does not enforce the use of a specific KMS key, or they mistakenly use an Allow effect (Option B) which cannot block non-compliant requests due to the default Allow behavior of S3 bucket policies.
How to eliminate wrong answers
Option A is wrong because it denies requests only when the 's3:x-amz-server-side-encryption' header is null, which would allow requests with any encryption header (including AES256 or a different KMS key) to succeed, failing to enforce the specific customer-managed KMS key. Option B is wrong because it uses an Allow effect, which cannot override an explicit Deny and does not enforce encryption; it merely allows requests that match the condition but does not block non-compliant requests. Option D is wrong because it denies requests only when the KMS key ID does not match, but it does not require the encryption header to be present at all, allowing unencrypted PUT requests to bypass the policy.
Refer to the exhibit. A data engineer runs the command above. The DataAdminRole is used by an application to decrypt data. The security team wants to ensure that a SecurityAdminRole can revoke the grant. What must be done to allow the SecurityAdminRole to retire the grant?
A.Set the RetiringPrincipal to the root user
B.Add a grant with Revoke operation for the SecurityAdminRole
C.No action needed; the SecurityAdminRole can retire the grant
D.Create a new grant with SecurityAdminRole as GranteePrincipal
AnswerC
The RetiringPrincipal is already set.
Why this answer
The grant's RetiringPrincipal field is already set to SecurityAdminRole, so no additional action is needed. Option A is incorrect because setting the RetiringPrincipal to the root user would not grant SecurityAdminRole the ability to retire. Option B is incorrect because a Revoke grant is not required; retire is handled by the RetiringPrincipal.
Option D is incorrect because creating a new grant is unnecessary when the existing grant already has the correct RetiringPrincipal.
Refer to the exhibit. A data engineer runs the above command and sees that the DataLakeAdmin role has the AmazonS3FullAccess and AWSLakeFormationDataAdmin policies attached. The engineer wants to ensure that the role can only access S3 data through Lake Formation. What should the engineer do?
A.Create a new IAM policy that explicitly denies s3:GetObject and attach it to the role
B.Detach the AWSLakeFormationDataAdmin policy from the role
C.Detach the AmazonS3FullAccess policy from the role
D.Modify the S3 bucket policy to deny all access except from Lake Formation
AnswerC
This removes direct S3 access, forcing the role to use Lake Formation for data access.
Why this answer
To enforce that access is only through Lake Formation, the engineer should detach the AmazonS3FullAccess policy because it allows direct S3 access, bypassing Lake Formation. The LakeFormationAdmin policy is needed for Lake Formation administration. Changing the S3 bucket policy to deny all access except from Lake Formation is not straightforward because Lake Formation uses the principal's IAM role.
Creating a new policy that denies S3 access would be redundant if the full access policy is removed.
A company uses AWS Glue to catalog data in Amazon S3. The security team requires that all sensitive data be identified and encrypted at rest using customer-managed KMS keys. Which combination of steps should a data engineer take to meet these requirements?
A.Enable S3 Access Logs and use Athena to query the logs for sensitive data patterns.
B.Use Amazon Macie to scan the S3 bucket and automatically apply S3 default encryption.
C.Enable S3 default encryption for the bucket and use IAM policies to restrict access.
D.Configure AWS Glue to use Detect Sensitive Data and write encrypted output to S3 with SSE-KMS.
AnswerD
Glue's Detect Sensitive Data identifies sensitive columns, and the ETL job can encrypt output using customer-managed KMS keys.
Why this answer
AWS Glue provides a 'Detect Sensitive Data' transform (such as FindMatches or custom classifiers) that can be used in a Glue ETL job to identify sensitive data within the catalog. The same ETL job can then write the processed data to Amazon S3 with server-side encryption using customer-managed KMS keys (SSE-KMS), meeting both identification and encryption-at-rest requirements. Option A is incorrect because S3 Access Logs and Athena queries do not directly identify sensitive data patterns reliably, nor do they enforce encryption.
Option B is incorrect because Amazon Macie can scan for sensitive data, but it does not automatically apply S3 default encryption; moreover, default encryption uses S3-managed keys, not customer-managed KMS keys. Option C is incorrect because enabling S3 default encryption and using IAM policies addresses encryption and access control but lacks the sensitive data identification step required by the security team.
A data engineer is configuring a VPC for an Amazon Redshift cluster. The cluster must be accessible only from a specific on-premises network via a Direct Connect connection. Which TWO actions should the engineer take to meet this requirement? (Choose TWO.)
Select 2 answers
A.Enable Redshift Enhanced VPC Routing.
B.Configure a security group to allow inbound traffic from the on-premises CIDR block.
C.Configure a network ACL to allow inbound traffic from the on-premises CIDR block.
D.Create a VPC endpoint for Redshift.
E.Make the Redshift cluster publicly accessible.
AnswersB, C
Security groups act as a firewall to control inbound traffic.
Why this answer
To restrict access to an Amazon Redshift cluster from a specific on-premises network via Direct Connect, the engineer should use a security group (option B) to control inbound traffic at the instance level, and a network ACL (option C) for subnet-level traffic control. Both should allow traffic from the on-premises CIDR block. Option A (Enhanced VPC Routing) is incorrect because it controls how traffic flows between the cluster and other resources, not inbound access.
Option D (VPC endpoint) is incorrect because a VPC endpoint provides private connectivity from within the VPC, not from on-premises via Direct Connect. Option E (publicly accessible) is insecure and unnecessary when using Direct Connect.
A data engineer needs to ensure that an S3 bucket containing sensitive customer data is encrypted at rest. The company requires that all encryption keys be managed by AWS and rotated annually. Which encryption option meets these requirements?
A.Use server-side encryption with AWS KMS (SSE-KMS)
B.Use client-side encryption with AWS KMS
C.Use server-side encryption with customer-provided keys (SSE-C)
D.Use server-side encryption with S3-managed keys (SSE-S3)
AnswerD
SSE-S3 uses AWS-managed keys that are rotated automatically.
Why this answer
SSE-S3 uses AWS-managed keys and automatically handles annual key rotation, meeting both requirements of encryption at rest and AWS-managed keys with rotation. SSE-KMS also uses AWS-managed keys but does not automatically rotate keys (unless using a custom KMS key with rotation enabled, but the question implies automatic rotation without extra configuration). SSE-C requires customer-provided keys, which violates the requirement that AWS manages the keys.
Client-side encryption (B) is not server-side and also involves customer management. Thus, only SSE-S3 fully satisfies the requirements.
A company needs to tag all resources created in a specific AWS account to enforce data governance policies. Which AWS service can automatically enforce tagging rules?
A.AWS Organizations SCPs
B.AWS Service Catalog
C.AWS Resource Access Manager
D.AWS Systems Manager
AnswerA
SCPs can enforce tagging policies.
Why this answer
(AWS Organizations SCPs) is correct. Service Control Policies (SCPs) can be used to enforce tagging rules across all accounts in an organization by denying actions that don't meet tagging requirements. Option B (AWS Service Catalog) is used for creating and managing approved IT services, not for enforcing tagging rules.
Option C (AWS Resource Access Manager) is for sharing resources across accounts, not for enforcement. Option D (AWS Systems Manager) is for operational management, not for governance policies.
A company uses AWS Lake Formation to manage permissions on a data lake stored in S3. A data engineer notices that a new IAM user can query data via Athena but cannot see the tables in the Lake Formation console. What is the most likely cause?
A.The user has not been granted DESCRIBE or SELECT permissions on the tables in Lake Formation
B.The Athena workgroup is not encrypted
C.The Glue Data Catalog is not enabled for the account
D.The IAM user lacks s3:GetObject permissions
AnswerA
Lake Formation controls metadata access.
Why this answer
Lake Formation permissions are separate from IAM permissions. Even if the IAM user has Athena access, Lake Formation must grant the user DESCRIBE and SELECT permissions on the tables to see them in the console and query them. Option B is incorrect because encryption settings do not affect table visibility.
Option C is incorrect because the Glue Data Catalog is enabled (since the user can query data). Option D is incorrect because the user can query data, so they have s3:GetObject permissions implicitly.
Refer to the exhibit. A security analyst is reviewing CloudTrail logs and notices a PutObject event to the 'company-data-lake' bucket. The bucket policy requires all objects to be encrypted with SSE-KMS. What should the analyst conclude?
A.The object was uploaded by the bucket owner, bypassing the policy.
B.The request succeeded because SSE-S3 is acceptable.
C.The object was encrypted with SSE-KMS as required.
D.The object was encrypted with SSE-S3, which violates the bucket policy.
AnswerD
AES256 indicates SSE-S3, not KMS.
Why this answer
The bucket policy requires all objects to be encrypted with SSE-KMS. The CloudTrail log shows a PutObject event, but the encryption context (not shown in the exhibit) would indicate the encryption method used. Since the correct answer states the object was encrypted with SSE-S3, this violates the bucket policy, which mandates SSE-KMS.
Therefore, the analyst should conclude that the request succeeded but violated the policy, as SSE-S3 does not meet the requirement.
Exam trap
AWS often tests the nuance that a bucket policy requiring SSE-KMS does not automatically deny requests using SSE-S3; the policy must include an explicit Deny effect for non-compliant encryption to block the upload, so candidates may mistakenly think a requirement alone prevents the action.
How to eliminate wrong answers
Option A is wrong because the bucket owner does not bypass bucket policies; all principals, including the owner, are subject to the policy unless explicitly exempted (which is not indicated). Option B is wrong because the bucket policy explicitly requires SSE-KMS, so SSE-S3 is not acceptable; the request would succeed only if the policy allowed it, but it does not. Option C is wrong because if the object were encrypted with SSE-KMS as required, there would be no violation, but the correct answer indicates a violation occurred, meaning SSE-KMS was not used.
A company is using Amazon S3 to store log files. The security team wants to ensure that any object uploaded to the S3 bucket is automatically scanned for malware before being processed by downstream applications. The data engineer needs to implement a solution that integrates with AWS services and minimizes latency. The bucket receives thousands of objects per day. Which solution should the data engineer use?
A.Deploy an EC2 instance with antivirus software that triggers on S3 events.
B.Enable Amazon GuardDuty with malware protection for S3.
C.Use AWS WAF to inspect objects as they are uploaded.
D.Enable Amazon Macie on the S3 bucket to detect malware.
AnswerB
GuardDuty malware protection scans S3 objects.
Why this answer
Amazon GuardDuty has a malware protection feature that can scan S3 objects for malware upon upload. It integrates with S3 events and minimizes latency. Option A is incorrect because Amazon Macie is for sensitive data discovery, not malware.
Option C is incorrect because AWS WAF is for web application firewall, not S3 scanning. Option D is incorrect because running a custom scanning solution on EC2 adds operational overhead and latency.
A data engineer receives the error shown in the exhibit when trying to upload a file to my-bucket. The engineer uses the AWS CLI with the following command: aws s3 cp file.txt s3://my-bucket/. What is the most likely cause of the error?
A.The KMS key specified in the command is incorrect
B.The VPC endpoint policy is blocking the request
C.The object is not encrypted with SSE-KMS
D.The bucket does not have a default encryption configuration
AnswerC
The policy requires SSE-KMS encryption header.
Why this answer
The error indicates that the upload was denied because the object is not encrypted with SSE-KMS. The bucket policy likely requires SSE-KMS for all PutObject requests, but the AWS CLI command `aws s3 cp file.txt s3://my-bucket/` does not specify the `--sse aws:kms` flag, so the object is uploaded without the required encryption header. This causes the policy condition to evaluate to false, resulting in an access denied error.
Option A is wrong because the command does not specify any KMS key; the error is about encryption header, not key validity. Option B is wrong because the error is not related to VPC endpoint policies. Option D is wrong because a default encryption configuration would automatically apply encryption, but the error suggests the upload attempted to skip encryption entirely, which is denied by the explicit policy requirement.