CCNA Data Security and Governance Questions

AWS CloudTrail records API calls including S3 object-level operations. It logs who made the call, from which account, and other details. S3 server access logs provide similar info but are log files themselves, not a queryable service.

Config is for resource configuration tracking. Trusted Advisor gives best practice checks.

The correct condition is s3:x-amz-server-side-encryption-aws-kms-key-id (option A). This condition key allows you to require that objects uploaded to the S3 bucket are encrypted with a specific AWS KMS key by checking the key ID used in the encryption header. Option B (kms:ViaService) restricts KMS key usage to specific AWS services but does not enforce a key ID on S3 objects.

Option C (s3:x-amz-server-side-encryption) only checks whether server-side encryption is enabled, not the specific key. Option D (kms:EncryptionContext) is used to enforce encryption context, not the key ID.

When encrypting data with AWS KMS, an encryption context can be provided as additional authenticated data (AAD). This context must be supplied during decryption; otherwise, decryption fails. The command succeeded during encryption, so the key is not disabled (B is wrong) and the key policy is not the issue (A is wrong).

File corruption would cause a different error (C is wrong).

The bucket policy allows GetObject and PutObject actions only when the request uses HTTPS, and explicitly denies all S3 actions when the request uses HTTP due to the condition `aws:SecureTransport=false`. Therefore, only HTTPS requests for Get and Put are permitted. Option A is incorrect because the policy does not restrict by IP addresses.

Option C is incorrect because both Get and Put are allowed over HTTPS, not just Get. Option D is incorrect because the policy does not grant anonymous access; it requires secure transport and does not allow HTTP.

Enabling SSL/TLS for the database connection encrypts the data in transit between the application and the RDS PostgreSQL instance, ensuring confidentiality. Option A (VPC peering) provides network connectivity but does not encrypt traffic. Option C (encryption at rest) protects data stored on disk, not in transit.

Option D (IAM database authentication) controls access but does not encrypt the connection.

Enabling default encryption on the bucket using SSE-S3 automatically encrypts all new objects written to the bucket, with minimal operational overhead. Option A is incorrect because lifecycle policies do not encrypt objects; they manage transitions and deletions. Option C is redundant since bucket default encryption already denies unencrypted writes via policy, but the policy itself is additional overhead and not automatic.

Option D is incorrect because S3 Batch Operations require manual initiation and only encrypt existing objects, not new ones automatically.

The condition `aws:SecureTransport: false` is used to deny requests that are not sent over SSL/TLS, ensuring encrypted connections for data transfer to S3. Option A (`s3:x-amz-server-side-encryption`) controls encryption at rest, not in transit. Option B (`s3:signatureversion`) checks the signature version used for request authentication, not encryption.

Option C (`aws:SourceIp`) filters by source IP address, which is unrelated to encryption.

The Deny statement in the bucket policy denies PutObject if the encryption header is not AES256. Since the user did not specify any encryption header, the condition StringNotEquals 'AES256' evaluates to true, causing the request to be denied with an Access Denied error. Option A is wrong because the Deny overrides the Allow.

Option B is wrong because the Deny applies to PutObject, not GetObject. Option C is wrong because the Deny is conditional on encryption header, not default encryption.

AWS Systems Manager Parameter Store (A) can securely store secrets and, when using the Advanced tier, supports automatic rotation via AWS Lambda. AWS Secrets Manager (E) provides native automatic rotation for database credentials and other secrets. B (IAM) is for identity and access management, not secret storage.

C (KMS) manages encryption keys, not secrets. D (CloudHSM) provides hardware security modules for key management, not secret storage. Therefore, the correct answers are A and E.

Batch Operations uses a service role that must have kms:Decrypt permission for the source objects and kms:GenerateDataKey for the destination. The source objects are encrypted with SSE-S3, which does not use KMS, so the service role does not need kms:Decrypt for source. However, the error indicates KMS access denied, likely because the service role does not have kms:GenerateDataKey for the destination KMS key.

Option A is wrong because the service role is used. Option B is wrong because the source objects are SSE-S3. Option C is wrong because KMS key policy is for the destination key.

The IAM policy allows s3:PutObject only if the request includes the encryption header x-amz-server-side-encryption with value AES256. Since the user does not specify any encryption, the condition is not met, and the request is denied with an access denied error. Option A is wrong because the condition is not optional.

Option B is wrong because default encryption applies only when the policy does not explicitly require a header; here the policy enforces the header. Option C is wrong because the policy does not require a KMS key; it requires AES256 encryption, which is SSE-S3.

S3 Lifecycle policies can automatically delete objects after a specified time period, such as 30 days. Option B (MFA Delete) requires multi-factor authentication for deletion but does not automate deletion. Option C (Versioning) keeps multiple versions but does not delete.

Option D (Object Lock) prevents deletion or modification but does not schedule automatic deletion.

Macie only scans buckets in the same AWS Region as the Macie session. If the bucket is in a different region, Macie cannot discover sensitive data in it. Option A is incorrect because Macie uses service-linked roles, not the bucket policy, to access buckets in the same account.

Option B is incorrect because Macie does not require cross-account access for buckets in the same account. Option D is incorrect because Macie can read objects regardless of ACLs as long as the appropriate IAM permissions are granted.

AWS Organizations with SCPs can centrally control permissions across all accounts, including blocking public access to S3 buckets. Option A is wrong because IAM policies are per-identity and not account-wide. Option B is wrong because S3 Block Public Access settings exist per bucket or account, but to enforce across all accounts, Organizations is needed.

Option D is wrong because AWS Config can detect non-compliance but not enforce. Option C is correct.

Amazon Macie is the correct service for automating detection of sensitive data in S3 and generating reports. It uses machine learning to discover and classify sensitive data. Amazon Inspector is for vulnerability management, not sensitive data detection.

Amazon GuardDuty is for threat detection. AWS Config is for resource compliance and configuration auditing.

The most likely reason for the denial is that the VPC endpoint policy denies the action. Even if the bucket policy allows access to the IAM role, the VPC endpoint policy can explicitly deny the action, which overrides the bucket policy. Option A is incorrect because AES-256 encryption does not require additional permissions like s3:Decrypt.

Option B is incorrect because the question indicates the bucket policy allows access, not denies. Option D is incorrect because S3 Block Public Access settings only apply to public access, not to requests from an IAM role.

SSL/TLS is used to encrypt data in transit between clients and RDS. Option A is wrong because KMS encrypts data at rest, not in transit. Option C is wrong because S3 is not involved in this scenario.

Option D is wrong because CloudHSM provides hardware security modules for key storage, not encryption in transit.

An S3 bucket policy can deny PutObject requests that do not include the x-amz-server-side-encryption header, thereby enforcing encryption for all new objects. Option A is wrong because S3 Block Public Access does not enforce encryption. Option B is wrong because default encryption applies only if the upload request does not specify encryption headers; it does not enforce encryption for requests that specify 'None'.

Option C is wrong because S3 Object Lock prevents deletion but does not enforce encryption.

AWS Secrets Manager provides automatic rotation of RDS credentials, and AWS Glue can be configured to use SSL for an encrypted connection to RDS MySQL. Option A (Systems Manager Parameter Store) stores encrypted parameters but does not natively support automatic rotation of RDS credentials. Option B (IAM database authentication) provides authentication but does not encrypt the connection itself; SSL is still required for encryption.

Option C (encrypted S3 bucket) is not a service designed for dynamic credential management and lacks automatic rotation.

AWS managed keys (AWS-managed KMS keys) have automatic rotation enabled by default every year, making option B correct. AWS owned keys are not visible to the customer and cannot be managed. Customer managed keys require explicit enabling of rotation, so they are not automatically rotated.

Custom key stores do not support automatic rotation. Therefore, only AWS managed keys provide automatic annual rotation without additional configuration.

Kms:Decrypt. When an S3 object is encrypted with SSE-KMS, the IAM role must have the kms:Decrypt permission to decrypt the object before reading it. Option A (kms:GenerateDataKey) is used for encryption, not decryption, so it is incorrect.

Option B (s3:ListBucket) only allows listing objects in the bucket, not reading or decrypting them. Option D (s3:GetObject) allows reading the object, but without kms:Decrypt, the encrypted object cannot be decrypted, so the read fails.

AWS CloudTrail records API calls, including IAM policy changes. AWS Config records resource configurations but not all API calls. CloudWatch Logs can store logs but does not record API calls itself.

S3 is the destination for logs, not the recording service.

WS CloudTrail because it records API calls made in the account, including changes to IAM policies. AWS Config tracks resource configuration changes, not API calls. AWS Organizations is for multi-account management.

Amazon CloudWatch Logs is for log storage and monitoring, not auditing API calls.

S3 bucket policies can require server-side encryption by denying PutObject without encryption headers. Option C (default encryption) is a bucket-level setting that automatically encrypts objects, but it does not enforce encryption via policy. Option A (object lock) prevents deletion.

Option B (MFA delete) requires multi-factor authentication.

S3 Batch Operations can apply SSE-KMS encryption to existing objects without disrupting access. It uses a Lambda function to re-encrypt each object with the specified KMS key. Option A is wrong because copying objects to themselves with the --sse-kms-key-id parameter does not work - it requires a full copy to a new location and back.

Option B is wrong because the bucket policy only prevents new unencrypted uploads, it does not fix existing objects. Option C is wrong because deleting and re-uploading disrupts access and is inefficient.

SSE-S3 (Option A) and SSE-KMS (Option E) are the two server-side encryption options for Amazon S3. SSE-S3 uses Amazon-managed keys, while SSE-KMS uses AWS KMS-managed keys. Option B (SSL/TLS) is encryption in transit, not at rest.

Option C (AWS SDK client-side encryption) encrypts data before it reaches S3, so it is client-side, not server-side. Option D (AWS CloudHSM) is a hardware security module for managing keys, but it is not a direct server-side encryption option for S3; S3 does not natively integrate with CloudHSM for SSE.

AWS Glue uses TLS for data in transit by default. Option B is wrong because S3 default encryption is for at-rest. Option C is wrong because VPC endpoints use AWS PrivateLink but don't enforce encryption.

Option D is wrong because it's not required for TLS.

Options A, B, and C are correct. Lake Formation can grant permissions directly to IAM users/roles (C), to SAML/SCIM groups (A), and via tag-based access control using LF-Tags (B). Option D is incorrect because AWS Organizations units manage accounts, not individual permissions.

Option E is incorrect because S3 bucket policies are separate from Lake Formation and cannot be used to grant Lake Formation permissions.

AWS CloudTrail records API calls made to the AWS environment. To investigate if an Amazon Redshift cluster was accidentally deleted, you would use CloudTrail to review the DeleteCluster API call, including who made the call and when. AWS Config tracks resource configuration changes and can show that a cluster was deleted, but it does not directly record API calls; CloudTrail is the primary service for auditing API activity.

Amazon CloudWatch Logs stores log data from applications and services, not API calls. AWS Trusted Advisor provides best practice recommendations, not deletion history.

Options B, C, and D are correct. To enable automatic rotation for a customer-managed KMS key, you must enable rotation via the KMS console or API (B), ensure the key is a symmetric key (C) as asymmetric keys do not support automatic rotation, and configure the RDS instance to use the key (D) for encryption. Option A is incorrect because rotation can be enabled for existing keys.

Option E is incorrect because CloudHSM is not involved.

AES256 refers to SSE-S3, where Amazon S3 manages the encryption keys using AES-256. Option B (SSE-KMS) would show 'aws:kms'. Option C (SSE-C) would require the customer to provide keys.

Option D (no encryption) is incorrect because encryption is enabled.

The CloudTrail event contains `x-amz-server-side-encryption: aws:kms`, which confirms the object was uploaded with server-side encryption using AWS KMS (SSE-KMS). Option A is incorrect because the event shows a successful upload, not a failure. Option C is incorrect because the event indicates encryption was applied.

Option D is incorrect because SSE-S3 would show `AES256`, not `aws:kms`.

SSE-KMS is the correct option because it uses a customer-managed AWS KMS key, allowing the data engineering team to control access and permissions for decryption. Client-side encryption is not an S3 server-side encryption option and does not use KMS. SSE-S3 uses Amazon S3-managed keys, which do not provide customer-controlled access.

SSE-C requires the customer to manage their own encryption keys and does not use KMS, nor does it allow the same level of access control as a CMK.

It covers all requirements: encryption in transit (HTTPS enforcement via bucket policy), encryption at rest (default SSE-S3), and compliance inventory (S3 Inventory). Option B uses SSE-KMS which is not required and lacks inventory. Option C includes at-rest encryption and inventory but misses in-transit encryption.

Option D includes in-transit encryption but lacks at-rest encryption and compliance inventory.

Secrets Manager's automatic rotation feature, combined with a custom Lambda function to update the RDS password, provides a fully automated, low-overhead solution. Option A is incorrect because Parameter Store does not natively support automatic rotation and would require additional automation. Option C is incorrect because it involves manual steps to update the application configuration, increasing operational overhead.

Option D is incorrect because IAM database authentication does not rotate credentials automatically and would require significant application changes.

S3 Object Lock with retention mode COMPLIANCE prevents objects from being deleted or overwritten for the specified retention period. Versioning alone does not prevent deletion. MFA Delete prevents accidental deletion but not overwrite.

Lifecycle policies can expire objects but do not prevent deletion.

The most likely reason is that the user-defined function current_user_department() is not invoked correctly in the view definition. In Athena, views store the SQL logic, and when queried, the filter condition is evaluated. If the function is not registered properly or is not supported in view filters, the query may ignore it.

Option A is incorrect because the function is already defined in the Glue Data Catalog. Option B is incorrect because Athena does support user-defined functions in views. Option C is incorrect because the analyst's role does have the tag.

For SSE-KMS, the IAM role needs kms:Decrypt permission on the KMS key to read encrypted objects. Option A (s3:GetObjectVersion) is not required because the bucket policy already allows s3:GetObject; versioning is not relevant here. Option C (s3:GetObjectAcl) is for access control lists, not encryption.

Option D (kms:GenerateDataKey) is used for encrypting new objects, not reading existing ones. Therefore, the correct answer is B.

The bucket policy explicitly denies access to any principal that is not from the AWS organization. Since the Lambda execution role is not part of the organization, the explicit deny overrides any allow permissions granted to the role. Option B is incorrect because the VPC endpoint policy is not mentioned in the scenario.

Option C is incorrect because the bucket is in the same account. Option D is incorrect because KMS permissions are not relevant to this access denial.

For cross-account access with SSE-KMS, the KMS key policy must grant the partner account access to use the key. The bucket policy alone is insufficient. The partner account does not need VPC endpoints, and the bucket policy for decryption is not needed.

The partner account does not need access to the S3 bucket's encryption configuration.

The command output shows that the key's KeyManager is 'AWS', indicating it is an AWS managed key, which corresponds to option D. Option A is incorrect because the key state is 'Enabled', not 'PendingDeletion'. Option B is incorrect because the ARN does not specify a region; the key was created in us-east-1 by default.

Option C is incorrect because AWS managed keys have KeyManager set to 'AWS', not 'CUSTOMER'.

Options C and D are correct. AWS CloudTrail can be configured to log API calls to S3, including data events for object-level access. Amazon S3 server access logs provide detailed records of requests made to an S3 bucket.

Option A is wrong because AWS Config records configuration changes, not data access logs. Option B is wrong because Amazon CloudWatch Logs can store logs but does not generate S3 access logs directly. Option E is wrong because VPC Flow Logs capture IP traffic metadata, not S3 object-level access.

The most likely reason because the RLS permissions dataset must correctly map each user to the specific department values they are allowed to see. If this mapping is misconfigured or missing, QuickSight will default to showing all rows, making the RLS ineffective. The 'Department' column is present in the dataset (Option B is false).

Admin access to the dashboard does not bypass RLS at the dataset level (Option C is false). SPICE datasets fully support row-level security (Option D is false).

Redshift audit logging captures all queries, and creating views that expose only non-sensitive columns with access granted to those views enforces column-level access control for non-admin users. Option B is incorrect because row-level security is not supported in Redshift, and CloudTrail logging alone does not block access. Option C is incorrect because CloudWatch Logs do not control access; they only provide monitoring.

Option D is incorrect because IAM policies cannot restrict access to specific columns in Redshift.

The key policy grants Decrypt and ReEncrypt* actions, but not Encrypt. Therefore, the DataEngineer role does not have permission to encrypt data using this key. Option A is incorrect because IAM roles can be used as principals in key policies.

Option B is incorrect because there is no explicit deny statement in the policy. Option C is incorrect because "Resource": "*" is valid in KMS key policies and refers to the current key.

Amazon Macie discovers sensitive data, and then AWS Glue can apply transformations to mask the PII before loading into Redshift. CloudWatch Logs is for monitoring, not detection. IAM Access Analyzer is for analyzing resource policies.

S3 Object Lambda can redact data during retrieval but not during Glue ETL.

Options B and D are correct. AWS Lake Formation provides fine-grained access control for the Glue Data Catalog, and AWS Glue DataBrew offers data lineage visualization. Option A is incorrect because CloudTrail logs API calls but does not manage permissions or access control.

Option C is incorrect because Athena is a query service, not for access control or lineage. Option E is incorrect because Kinesis is for streaming data.

Options A, B, and D are correct. Lake Formation column-level access requires defining the policy in Lake Formation, granting permissions to the IAM role, and the user must use Lake Formation-enabled services. Option C is wrong because S3 bucket policies are not used for column-level control.

Option E is wrong because the table must be registered with Lake Formation.

(AWS Secrets Manager) is correct because it can automatically rotate secrets, including database credentials, with built-in rotation support. Option B (AWS Systems Manager Parameter Store) can store secrets but lacks automatic rotation capability. Option C (AWS Key Management Service) manages encryption keys, not secrets.

Option D (AWS Identity and Access Management) manages users and roles, not credential rotation.