CCNA Data Security Governance Questions

For JDBC connections to RDS for MySQL, encryption in transit is enabled by setting sslMode=REQUIRED in the JDBC URL and providing the RDS CA certificate for validation. This ensures that the connection between AWS Glue and RDS is encrypted using SSL/TLS. This is the standard method to enforce encryption in transit for Glue JDBC connections.

When writing to an SSE-KMS encrypted S3 bucket, the writer must call kms:GenerateDataKey to obtain a data key for encryption. Without this permission, the write fails. The role already has read access and decrypt permission on the source key, but the target key requires GenerateDataKey to encrypt the data.

Cross-account S3 access requires both the bucket policy to allow the principal and the principal's own IAM identity policy to permit the S3 action. The bucket policy alone is insufficient, so the missing identity-based permission causes the denial.

Cross-account Lake Formation access requires two grants: the resource owner grants permissions to the external principal, and the recipient account grants its role access. The Security account never granted the Producer role, so lakeformation:GetTable fails despite correct IAM permissions.

CloudTrail data events record object-level S3 operations, capturing the requester's identity and source IP address for every GetObject and PutObject call. Management events alone omit these object reads, so enabling data events satisfies the audit requirement for who accessed which object and from where.

CloudTrail records API activity as management and data events, capturing the identity, source IP, timestamp and request details for every call, including root user actions. This satisfies the requirement to audit all API calls across the account.

Object Lock in compliance mode prevents any principal, including the root user, from deleting or overwriting a protected object version until the retain-until date passes. A default retention rule applies the 365-day period automatically to new objects. Because the lock protects object versions rather than the bucket, the bucket can still be removed once all versions age out and are deleted.

Lake Formation supports column-level permissions, allowing you to grant SELECT on specific columns of a table. By granting only the non-sensitive columns, the analysts can query those columns in Athena while the Social Security number column remains inaccessible. This directly implements the least-privilege requirement without duplicating data.

Correct. The most likely cause is that the KMS key policy does not grant the Glue job's IAM role permission to use the key. Even with kms:Decrypt in the role, the key policy must allow it.

Enabling encryption on the cluster applies AWS KMS-backed encryption to all data at rest, including the cluster's storage volumes and snapshots. This directly satisfies the stem's requirement that the Redshift cluster encrypt all data at rest, and it is the setting exposed during cluster creation.

Security groups are stateful and evaluated after subnet-level filtering; a restrictive NACL on the cluster's subnet silently drops inbound traffic before it reaches the security group. Checking the NACL is therefore the correct next diagnostic step.

Audit logging captures connection, user, and query activity, then delivers it to Amazon S3 for durable retention. This directly satisfies the security team's requirement that all queries are logged for auditing, since S3 provides the persistent, reviewable store auditors need.

A bucket policy with a Deny effect and the s3:x-amz-server-side-encryption condition key rejects any PUT that does not carry a server-side encryption header. This enforces encryption at the bucket level for every principal, including the root account, and works with SSE-S3, SSE-KMS, or DSSE-KMS. It directly satisfies the requirement to block unencrypted writes.

AWS CloudTrail data events capture object-level API activity, such as GetObject and PutObject, including the identity of the caller and the object accessed. This provides the audit trail required to identify which IAM principals accessed specific objects. Management events alone do not log object-level access, so data events are necessary for this granular auditing.

Lake Formation tag-based access control lets an LF-Tag named DataClass be attached to catalog resources, and permissions are granted based on tag values rather than per-table grants. Tables without the required tag value receive no matching grant, so they are not queryable, which enforces the rule centrally with minimal ongoing effort.

SSE-KMS encrypts S3 objects with customer-managed KMS keys, satisfying the encryption-at-rest requirement. CloudTrail records every KMS API call, including Encrypt, Decrypt and GenerateDataKey, delivering the key-access audit trail. Together they meet both constraints: customer-managed keys plus auditable key usage.

A bucket policy with a Deny effect on s3:PutObject conditioned on the absence of encryption headers (for example, s3:x-amz-server-side-encryption) rejects unencrypted uploads at the API layer, satisfying the requirement to enforce encryption at rest for every object written to the bucket.

Secrets Manager natively stores credentials and performs scheduled rotation via Lambda, satisfying the automatic rotation requirement. Unlike Systems Manager Parameter Store, it includes built-in rotation for RDS, Redshift and DocumentDB, so no custom rotation logic is needed.

SSE-KMS encrypts objects with a KMS key, so reading them requires both S3 access and kms:Decrypt on that key. The Glue job's IAM role lacks this permission, producing AccessDenied despite valid S3 permissions. Granting kms:Decrypt on the key to the Glue role resolves the failure.

The aws:SecureTransport condition key evaluates whether the request arrived over TLS; denying when it is false blocks plain HTTP calls to S3. This enforces encryption in transit at the bucket policy layer, satisfying the requirement that EC2-to-S3 traffic never travel unencrypted.

Reading SSE-KMS encrypted S3 objects requires both S3 GetObject and kms:Decrypt on the customer managed key. The Glue execution role's policy grants S3 access but omits the KMS decrypt action, so the job cannot unwrap the data key and fails with an access-denied error.

Server-side encryption with an AWS KMS key encrypts stream data at rest, meeting the compliance mandate. Kinesis encrypts using the specified customer managed key before writing to storage and decrypts on retrieval, so producers and consumers need no changes beyond KMS permissions.

CloudTrail data events capture object-level S3 operations, recording the caller identity, source IP address and action performed. Management events alone omit GetObject and PutObject, so enabling data events for the bucket is necessary to audit who accessed the sensitive data.

S3 Object Lock in compliance mode prevents objects from being overwritten or deleted for the specified retention period, even by the root user. This meets the requirement that data cannot be altered for 7 years. It also provides immutability, which is essential for compliance. Enabling Object Lock requires versioning to be enabled on the bucket.

Correct: Both the S3 bucket policy and the KMS key policy must be updated to allow Account B.

Redshift cannot enable encryption in place on an existing unencrypted cluster. Snapshotting and restoring into a new cluster with encryption enabled is the supported, least-effort migration path, preserving data while applying KMS encryption at rest.

Configuring default bucket encryption with SSE-KMS and the customer-managed key ensures that any object PUT without explicit encryption headers is automatically encrypted with that key. This meets the requirement with no changes to the Glue job and works even if the job omits encryption parameters. The bucket policy can still deny non-compliant requests as an additional layer.

AWS Secrets Manager natively stores and rotates credentials on a schedule, satisfying the 90-day rotation requirement without custom code. Lambda retrieves secrets via the SDK at runtime, so database passwords never persist in environment variables or code.

Customer managed keys in AWS KMS support automatic annual rotation, which AWS-managed keys handle on a fixed three-year cycle you cannot change. Enabling rotation on a customer managed key satisfies the yearly compliance requirement, since the key material is replaced without altering the key ID or ARN.

Amazon Macie uses machine learning and pattern matching to automatically discover, classify, and alert on sensitive data such as personally identifiable information in S3. It is the managed service that fulfils the automatic classification requirement without custom code.

AWS Control Tower applies guardrails and account baselines across an organisation, enforcing governance at scale. It satisfies the multi-account central governance requirement by orchestrating AWS Organizations, IAM Identity Center and CloudTrail into a managed landing zone.

AWS Secrets Manager stores the database credentials encrypted and rotates them, and Glue connections reference the secret rather than embedding plaintext passwords in job scripts or catalog properties. This removes hard-coded credentials from the PII pipeline, satisfying the protection requirement.

aws:SecureTransport is a boolean condition key that evaluates whether the request arrived over HTTPS. Setting it to false in a Deny statement blocks unencrypted connections, satisfying the bucket policy requirement that only encrypted transport be permitted to the Transfer Family endpoint.

Lake Formation data filters allow column-level and row-level access control. By creating a data filter that excludes PII columns, the engineer can grant SELECT permission on that filtered view to the IAM role. This ensures the role can query only the non-sensitive columns. This is the correct approach because Lake Formation enforces these permissions at the table level without modifying the underlying data.

AWS Glue uses the AWS SDK for S3 operations, and the SDK defaults to HTTPS endpoints. Therefore, data in transit between Glue and S3 is encrypted with TLS by default. No additional configuration is required to meet the requirement. This is the correct and simplest answer.

AWS CloudTrail captures API activity, including IAM policy creation, modification and deletion, recording each event with the caller identity, timestamp and request parameters. This satisfies the requirement to monitor and record all IAM policy changes, since CloudTrail logs management events by default and delivers them to S3 or CloudWatch for auditing.

Views restrict the projection to non-sensitive columns, so grantees query only exposed attributes; the underlying sensitive columns remain inaccessible through the view. This delivers column-level security by omission, satisfying the requirement without granting base-table access.

AWS Key Management Service provides customer managed keys with automatic annual rotation, satisfying the yearly rotation requirement. It integrates natively across multiple AWS services, enabling centralised key management. Unlike CloudHSM, which offers dedicated hardware but no built-in automatic rotation, KMS delivers the managed rotation and multi-service integration the scenario demands.

Default encryption ensures all objects are encrypted with the specified KMS key, but it does not prevent uploads with a different encryption method. A bucket policy that denies PutObject requests lacking the correct encryption header enforces the use of the specific KMS key. Together, they meet the requirement.

A customer-managed KMS key lets you attach a key policy restricting kms:Decrypt to named IAM roles, satisfying the stem's requirement that only specific roles decrypt. AWS-managed keys use fixed policies you cannot edit, so they cannot enforce this restriction.

CloudTrail records every API call as a management event, capturing the caller identity and whether it was authorised. CloudWatch Events (EventBridge) then matches those unauthorised-call patterns via rules and triggers notifications, satisfying the requirement to both detect and alert on unauthorised API activity.

Enabling encryption on the Redshift cluster with AWS KMS satisfies the at-rest requirement, as it encrypts cluster data and snapshots using customer-managed or AWS-managed keys. This addresses the storage-layer constraint directly, though it does nothing for data in transit, which requires separate SSL/TLS configuration.

The bucket policy denies requests without encryption, causing access denied even if the role has PutObject permission.

Client-side encryption with AWS KMS encrypts PII before it reaches PostgreSQL, so ciphertext alone is stored. Database administrators lack the KMS key permissions needed to decrypt, satisfying the requirement that they cannot view plaintext PII. Server-side options such as RDS encryption leave administrators able to read data through SQL queries.

This uses Lake Formation TBAC to restrict access based on the user's tag.

Lake Formation column-level permissions allow granular control over specific columns in a table. By registering the S3 location and granting column-level permissions, the engineer ensures that only authorized principals can access PII columns, and this enforcement is applied across integrated services like Athena, Redshift Spectrum, and Glue ETL. This directly meets the requirement for consistent column-level access control.

Bucket policies requiring MFA for delete operations enforce multi-factor authentication before objects can be removed, guarding against compromised credentials and accidental deletion. This satisfies the protection requirement by adding a strong authentication control at the S3 API layer.

Specifying the other account's AWS account ID as the Principal delegates access at the account level, letting that account's administrators manage their own users without IAM role assumption. This satisfies the stem's constraint of cross-account access without roles, since S3 bucket policies accept account ARNs directly as valid principals.

S3 Object Lock in COMPLIANCE mode enforces a write-once-read-many (WORM) model, preventing any user, including the root account, from overwriting or deleting objects for the defined retention period. Setting a 7-year retention directly satisfies the regulatory immutability requirement, unlike GOVERNANCE mode, which privileged users can bypass.

MFA Delete requires multi-factor authentication for permanently deleting object versions or changing bucket versioning state, so a compromised credential alone cannot purge the critical logs. This directly satisfies the requirement that versioned data must not be permanently deleted.

Deleting an object in a versioned bucket inserts a delete marker rather than erasing prior versions. Removing that delete marker restores the object to its previous state instantly, with no data transfer and no re-upload, since the original version's bytes were never removed from the bucket.

An S3 bucket policy denying requests where aws:SecureTransport is false enforces TLS on every request, so Glue-to-S3 traffic cannot fall back to plain HTTP. This satisfies the in-transit encryption requirement at the bucket level, covering all clients including AWS Glue.

CloudTrail records S3 data-plane and management API activity, capturing both successful and failed calls with identity, timestamp and source IP. This satisfies the compliance requirement to audit all bucket access, which S3 server access logging cannot match for failed calls.

The aws:SourceVpc condition key evaluates the VPC endpoint through which the request arrives, so the bucket policy denies any traffic not originating from the specified VPC. This directly satisfies the requirement that the bucket be accessible only from that VPC.

The Action element lists the specific API operations a policy allows or denies, so specifying dynamodb:GetItem and dynamodb:Query grants exactly those read-only calls and nothing else. This directly satisfies the stem's constraint of restricting access to only those two DynamoDB actions within the account.

Redshift dynamic data masking applies a masking policy to a column so that unauthorized users see a masked value at query time, while authorized roles see the full value. It is role-based and does not require changing the stored data. This directly satisfies the requirement to show partial values to most users and full values only to a specific role.

Lake Formation provides fine-grained access control and can be used to enforce anonymization policies.

For a Glue job to read SSE-KMS encrypted data, its IAM role must have permissions to use the KMS key for decryption. The required permissions are kms:Decrypt and kms:GenerateDataKey (for some operations). Attaching a policy with these actions on the specific key resource grants the necessary access. Without these permissions, the Glue job will fail with access denied errors.

ListBucket operates on the bucket resource and GetObject on the object resource, so both actions are required for listing and reading. An Allow effect grants the analyst read-only access without write permissions, matching the least-privilege requirement for listing objects and retrieving their content.

Lake Formation grants SELECT on the analytics tables, letting the data scientist query them through Athena while Lake Formation mediates access to the underlying S3 objects. Direct S3 access stays blocked because permissions are enforced at the catalog and table level, not through S3 bucket policies.

Lake Formation supports column-level permissions, allowing fine-grained access control. By granting SELECT on sensitive columns only to the Cardiology role and on non-sensitive columns to other roles, the engineer enforces the requirement with minimal overhead. Lake Formation manages the permissions centrally, and no additional ETL or view creation is needed. This is the most efficient and secure approach.

Specifying a customer-managed KMS key at cluster creation makes Redshift encrypt all data at rest with that key, satisfying the requirement for customer-managed encryption. Redshift cannot retroactively swap the key type, so this must be set during provisioning.

SSE-KMS with a customer managed key encrypts objects at rest under a key the team controls, and enabling automatic rotation on that key satisfies the rotation requirement. SSE-S3 and AWS managed keys cannot provide customer-controlled rotation.

Lake Formation supports column-level security through data filters. A data filter allows you to specify which columns are included or excluded. By granting SELECT on the table and then creating a data filter that includes only customer_id and purchase_amount, the role can access only those columns. This is the correct way to implement column-level access control in Lake Formation.

RDS does not support encrypting an existing unencrypted instance in place. Snapshot-copy with encryption re-encrypts the data under a customer-managed KMS key, and restoring creates a new encrypted instance, meeting the policy with only the brief downtime of a snapshot restore.

SSE-KMS encrypts objects using keys held in AWS KMS, and selecting a customer managed key means the customer generates and controls that key, including its policy and rotation. SSE-S3 uses AWS-owned keys the customer cannot manage.

Firehose assumes the `firehose.amazonaws.com` service principal to call KMS GenerateDataKey and Decrypt on your behalf, so the CMK's key policy must explicitly grant that principal those actions. Without this grant, the key is inaccessible and delivery fails, even though the IAM role used for S3 access is correctly configured.

DynamoDB supports customer managed KMS keys for encryption at rest. By specifying the key during table creation and granting DynamoDB permissions in the key policy, the table data is encrypted with that key. KMS key usage is logged in CloudTrail, providing the required auditability. This meets the security team's requirements.

Lake Formation data filters allow row-level and cell-level security by attaching a filter expression to a table resource. When you grant SELECT with a data filter, Athena queries automatically include the filter condition, so analysts only see rows where region equals 'EU'. This is the native Lake Formation mechanism for row-level access control without modifying the underlying data.

S3 Object Lock in compliance mode enforces a write-once-read-many (WORM) retention period that no user, including the root account, can shorten or bypass. This directly satisfies the seven-year immutability requirement, unlike governance mode, which privileged users can override.

The aws:SecureTransport condition key checks whether the request was sent over HTTPS. By adding a bucket policy that denies requests where aws:SecureTransport is false, you enforce that all data in transit uses TLS encryption. This is a standard and effective method to enforce encryption in transit for S3.

This statement grants the exact permission needed (kms:Decrypt) to the specific IAM role. It follows least privilege by not granting additional actions and by scoping the principal to the role. This is the correct and simplest way to allow the Lambda function to decrypt data using the KMS key.

IAM Access Analyzer surfaces unused-access findings, and an AWS Config custom rule with Lambda disables stale access keys automatically, notifying via SNS. This satisfies the stem's least-privilege, AWS-native requirement for detecting and remediating 90-day-unused IAM users.

When writing objects to the destination S3 bucket with SSE-KMS, S3 uses the KMS key to generate a data key for encryption. The Glue job role must have kms:GenerateDataKey permission on the destination key to allow S3 to encrypt the data on its behalf. This is required for the write operation to succeed.

RDS encryption at rest can only be enabled when the instance is created; existing unencrypted instances cannot be encrypted in place. Creating a new instance with encryption enabled using AWS KMS therefore satisfies the requirement directly, unlike modifying an existing instance, which cannot add storage encryption.