DEA-C01 Data Security and Governance Practice Question

Exhibit

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::123456789012:role/DataEngineer"
      },
      "Action": [
        "kms:Decrypt",
        "kms:GenerateDataKey"
      ],
      "Resource": "*"
    }
  ]
}

Refer to the exhibit. This KMS key policy is attached to a customer managed key. A data engineer finds that the DataEngineer role can encrypt but cannot decrypt data. What is the most likely cause?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The role does not have an IAM policy allowing kms:Decrypt

The key policy allows kms:Decrypt and kms:GenerateDataKey for the DataEngineer role, so the role can encrypt. However, KMS requires both key policy and IAM policy permissions for IAM roles. Since the role lacks an IAM policy that grants kms:Decrypt, it cannot decrypt. Option A is incorrect because the key policy does include kms:Decrypt. Option C is incorrect because the key policy explicitly allows kms:Decrypt. Option D is incorrect because kms:GenerateDataKey is allowed in the policy; the issue is with decrypt.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The key policy does not include kms:Decrypt in the IAM policy section
Why it's wrong here
The key policy does not need a separate IAM policy section; it just needs to allow the action.
✓
The role does not have an IAM policy allowing kms:Decrypt
Why this is correct
The role needs an IAM policy that allows kms:Decrypt; the key policy alone is insufficient for IAM roles.
✗
The key policy does not allow kms:Decrypt
Why it's wrong here
The key policy explicitly allows kms:Decrypt.
✗
The key policy does not allow kms:GenerateDataKey
Why it's wrong here
The key policy does allow GenerateDataKey, and the role can encrypt, so this is not the issue.

Go deeper

DEA-C01 Data Security and Governance Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question