DEA-C01 Data Security and Governance Practice Question

Exhibit

Refer to the exhibit.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::123456789012:role/DataAnalystRole"
      },
      "Action": [
        "kms:Decrypt",
        "kms:DescribeKey"
      ],
      "Resource": "arn:aws:kms:us-east-1:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab"
    }
  ]
}

Refer to the exhibit. A data engineer creates this KMS key policy. An IAM role in account 123456789012 is granted decrypt access to the key. However, when the DataAnalystRole tries to decrypt an S3 object encrypted with this key, the operation fails. What is the most likely reason?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The S3 bucket policy does not allow the role to call s3:GetObject

KMS key policies grant access to principals. However, if the S3 bucket policy does not allow the role to call kms:Decrypt, the combination of policies might still deny. But the key policy itself grants decrypt. A common issue is that the S3 bucket policy might not allow the s3:GetObject action, or the role might not have S3 permissions. Another possibility is that the KMS key is in a different region (us-east-1) but the S3 object is in another region, causing cross-region access which is not allowed by default. However, the most likely reason based on typical exam scenarios is that the S3 bucket policy does not grant the necessary S3 permissions.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
The S3 bucket policy does not allow the role to call s3:GetObject
Why this is correct
Even with decrypt permission, the role needs s3:GetObject permission on the encrypted object.
✗
The KMS key is in a different region than the S3 bucket
Why it's wrong here
Cross-region access is possible with appropriate policies, but the key policy is in us-east-1; if bucket is in another region, cross-region calls are allowed if both policies permit.
✗
The role does not have permission to call kms:DescribeKey
Why it's wrong here
The policy grants DescribeKey; decryption only requires Decrypt, not DescribeKey.
✗
The KMS key policy does not grant kms:Decrypt permission to the role
Why it's wrong here
The policy grants kms:Decrypt and kms:DescribeKey.

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

1 more way this is tested on DEA-C01

These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.

Variation 1. Refer to the exhibit. A data engineer creates an IAM policy for a service role used by AWS Glue. What does the condition in the policy enforce?

easy

A.The role can use the KMS key from any AWS service
B.The role can only use the KMS key when the request comes from Glue
C.The role can only use the KMS key for decrypting data
✓ D.The role can only use the KMS key when the request comes from S3

Why D: The condition uses the `kms:ViaService` key with value `s3.amazonaws.com`, which restricts KMS actions to requests originating from Amazon S3. Therefore, the role can only use the KMS key when the request comes from S3, making option D correct. Option A is incorrect because it does not allow any service; option B is incorrect because it specifies Glue instead of S3; option C is incorrect because it limits to decrypting only, but the condition does not specify the action.

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

Ready to practise?

Start a scored session and see where you stand.

Start practice session

Practice tests

Quick scored rounds with instant marking and a written explanation per question.

DEA-C01 Practice Exam 4 — 20 Questions→DEA-C01 Practice Exam 2 — 20 Questions→

Domain-focused practice

Each domain maps to a weighted exam section. Focus on the domain where you are weakest.

Data Security and Governance Data Ingestion and Transformation Data Operations and Support

Practice by scenario

Filter questions by type — troubleshooting, exhibit, drag-and-drop, multi-select, and more.

Browse scenarios

Practice by topic

Each topic page collects the questions that test one concept, plus the theory behind it.

Data Security and Governance practice questions Data Store Management practice questions Data Ingestion and Transformation practice questions

Where to go next

AWS Certified Data Engineer Associate DEA-C01 exam guide All DEA-C01 questions Exam domains

This DEA-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DEA-C01 exam.