Practise AWS Certified Data Engineer Associate DEA-C01 Data Security and Governance practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.
Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.
A data engineer needs to ensure that all data in an S3 bucket is encrypted at rest. The bucket currently contains unencrypted objects from past uploads. Which action will encrypt these existing objects without re-uploading them?
Trap 1: Attach a bucket policy requiring SSE-S3
Bucket policy only enforces encryption for future uploads.
Trap 2: Enable default encryption on the bucket
Default encryption only applies to new objects.
Trap 3: Use the S3 console to select all objects and apply encryption
The console does not support bulk encryption of existing objects.
A company needs to share a dataset stored in an S3 bucket with a partner account. The dataset contains sensitive information, so the company wants to ensure that the partner account can only access the data using a specific VPC endpoint in the partner's account. Which S3 bucket policy condition key should be used?
Trap 1: aws:SourceVpc
Incorrect. The aws:SourceVpc condition key restricts access to a specific VPC, not a VPC endpoint. The requirement is to restrict to a specific VPC endpoint, not the entire VPC.
Trap 2: aws:SourceArn
Incorrect. The aws:SourceArn condition key restricts access based on the ARN of the resource making the request. This is not used for network endpoint restrictions.
Trap 3: aws:SourceIp
Incorrect. The aws:SourceIp condition key restricts access based on the request's source IP address. This does not enforce access through a specific VPC endpoint.
Why wrong: Incorrect. The aws:SourceVpc condition key restricts access to a specific VPC, not a VPC endpoint. The requirement is to restrict to a specific VPC endpoint, not the entire VPC.
B
aws:SourceArn
Why wrong: Incorrect. The aws:SourceArn condition key restricts access based on the ARN of the resource making the request. This is not used for network endpoint restrictions.
C
aws:SourceIp
Why wrong: Incorrect. The aws:SourceIp condition key restricts access based on the request's source IP address. This does not enforce access through a specific VPC endpoint.
D
aws:SourceVpce
Correct. The aws:SourceVpce condition key restricts access to a specific VPC endpoint, ensuring that the partner account can only access the S3 bucket through that designated endpoint.
A data engineer needs to share a dataset from an S3 bucket in Account A with another AWS account (Account B). The data must remain encrypted at rest with KMS. Which steps are required?
Trap 1: Update the KMS key policy to allow Account B's root user
Updating only the KMS key policy does not grant access to the S3 bucket; bucket policy is also required.
Trap 2: Create an IAM role in Account A and grant cross-account access
Creating an IAM role with cross-account access is a valid method, but the question's correct answer requires both bucket policy and key policy updates.
Trap 3: Update the S3 bucket policy to allow Account B's root user
Updating only the S3 bucket policy does not grant permission to decrypt the KMS key.
Update the KMS key policy to allow Account B's root user
Why wrong: Updating only the KMS key policy does not grant access to the S3 bucket; bucket policy is also required.
B
Create an IAM role in Account A and grant cross-account access
Why wrong: Creating an IAM role with cross-account access is a valid method, but the question's correct answer requires both bucket policy and key policy updates.
C
Update the S3 bucket policy and the KMS key policy to allow Account B
Correct: Both the S3 bucket policy and the KMS key policy must be updated to allow Account B.
D
Update the S3 bucket policy to allow Account B's root user
Why wrong: Updating only the S3 bucket policy does not grant permission to decrypt the KMS key.
A company has a requirement to store audit logs for 7 years for compliance. The logs are stored in S3 and must be immutable. Which S3 feature should be used?
Trap 1: Use a bucket policy that denies s3:DeleteObject
A bucket policy can be changed by authorized users.
Trap 2: Enable MFA Delete on the bucket
MFA Delete requires multi-factor but root can still delete.
Trap 3: Enable S3 Versioning and set a lifecycle policy
Versioning retains deleted objects but does not prevent deletion.
A company is using AWS Glue to process data stored in an S3 bucket that is encrypted with SSE-KMS. The Glue job fails with an 'Access Denied' error when trying to read the data. The IAM role used by the Glue job has permissions to read from the S3 bucket and to use the KMS key. What is the most likely cause of the failure?
Trap 1: The S3 bucket is using SSE-S3 instead of SSE-KMS
The bucket is using SSE-KMS, not SSE-S3, so this is not the cause.
Trap 2: The KMS key is in a different AWS account
While possible, the question does not indicate the key is in another account, making this less likely than a bucket policy issue.
Trap 3: The IAM role is missing the kms:Decrypt permission
The premise states the role has permissions to use the KMS key, so missing kms:Decrypt is not the cause.
A company wants to monitor and alert on any IAM user creation in their AWS account. Which THREE services should be used together to achieve this? (Choose three.)
Trap 1: Amazon Simple Notification Service (SNS)
SNS is a notification service, but EventBridge can directly use SNS for alerts; however, the question asks for three services, and including SNS would replace one of the others. The best three are CloudTrail, CloudWatch Logs, and EventBridge.
Trap 2: AWS Config
Tracks resource configuration changes, not API calls.
Why wrong: SNS is a notification service, but EventBridge can directly use SNS for alerts; however, the question asks for three services, and including SNS would replace one of the others. The best three are CloudTrail, CloudWatch Logs, and EventBridge.
B
AWS CloudTrail
Records API calls including IAM user creation.
C
Amazon CloudWatch Logs
Stores CloudTrail logs for monitoring.
D
Amazon CloudWatch Events (EventBridge)
Creates rules to detect CreateUser API calls and trigger alerts.
E
AWS Config
Why wrong: Tracks resource configuration changes, not API calls.
A company runs a data lake on AWS using S3 for storage and AWS Glue for ETL. The security team discovers that a contractor who left the company two months ago still has access to an S3 bucket containing sensitive data. The access was granted via an IAM user that was not deleted. The data engineer is asked to implement a solution to prevent future occurrences. The company uses AWS Organizations and has multiple accounts. The requirement is to automatically detect and remediate IAM users that have not been used for 90 days by disabling their access keys and notifying the security team. The solution must be least privilege and use AWS-native services. Which approach should the data engineer take?
Trap 1: Use AWS IAM Access Analyzer to generate findings for unused access…
AWS Config managed rules do not provide automatic remediation; they only evaluate compliance. To automatically disable access keys, a custom AWS Config rule with a Lambda function is needed. IAM Access Analyzer can generate findings for unused access, but a managed rule cannot directly trigger disabling keys.
Trap 2: Use AWS CloudTrail to monitor IAM user activity and set up a…
Manual process, not automated remediation.
Trap 3: Use AWS Lake Formation to revoke the permissions of the IAM user…
Use AWS IAM Access Analyzer to generate findings for unused access and create an AWS Config managed rule to automatically disable the IAM user's access keys.
Why wrong: AWS Config managed rules do not provide automatic remediation; they only evaluate compliance. To automatically disable access keys, a custom AWS Config rule with a Lambda function is needed. IAM Access Analyzer can generate findings for unused access, but a managed rule cannot directly trigger disabling keys.
B
Use AWS CloudTrail to monitor IAM user activity and set up a CloudWatch alarm that triggers an SNS notification to the security team to manually disable the keys.
Why wrong: Manual process, not automated remediation.
C
Use AWS Lake Formation to revoke the permissions of the IAM user and set up a scheduled Lambda function to check for unused IAM users.
Why wrong: Lake Formation does not manage IAM users.
D
Use AWS IAM Access Analyzer to generate findings for unused access and create an AWS Config custom rule with a Lambda function that automatically disables the access keys and sends a notification via SNS.
A company uses Amazon DynamoDB with encryption at rest using an AWS managed KMS key. The security team requires that the encryption key be rotated every 90 days. What should the data engineer do to meet this requirement?
Trap 1: Switch to AWS CloudHSM to manage the encryption key
CloudHSM does not provide automatic rotation.
Trap 2: Create a scheduled AWS Lambda function to rotate the AWS managed key
AWS managed keys cannot be rotated manually.
Trap 3: Enable a custom encryption context in DynamoDB to trigger rotation
A data engineer needs to restrict access to an S3 bucket so that only users from a specific AWS account can read objects. Which S3 bucket policy element should be used?
A data engineer is troubleshooting an AWS Glue ETL job that fails with an access denied error when writing to an S3 bucket. The Glue job uses an IAM role that has an S3 bucket policy attached. The bucket policy denies access to any principal that does not use server-side encryption. What is the most likely cause of the failure?
Trap 1: The VPC endpoint policy for S3 is too restrictive.
VPC endpoints do not cause access denied errors for encryption.
Trap 2: The IAM role does not have s3:PutObject permission.
Glue requires permissions on the S3 bucket and KMS key.
Trap 3: The S3 bucket uses S3 Block Public Access which denies all writes.
S3 Block Public Access prevents public access, not authorized writes.
A data engineer is designing a data lake on S3 that must be encrypted at rest using customer-managed keys in AWS KMS. The security team requires that the key be used only for S3 operations and that the key be rotated every 180 days. Which solution meets these requirements?
Trap 1: Use an AWS managed key (aws/s3) and enable automatic rotation.
AWS managed keys rotate annually, not every 180 days.
Trap 2: Use an S3 bucket policy to enforce SSE-KMS with a CloudHSM key.
CloudHSM keys are not directly used by S3 for encryption; KMS is required.
Trap 3: Use a custom key store backed by CloudHSM and rotate the key…
Custom key stores do not support automatic rotation.
A company uses AWS Glue to process sensitive data stored in S3. The security team requires that all data be encrypted at rest using customer-managed KMS keys. The data engineers are encountering 'Access Denied' errors when running Glue ETL jobs. What is the most likely cause?
Trap 1: The KMS key policy does not allow the AWS Glue service to use the…
Incorrect. The KMS key policy can grant access to the Glue service principal, but the error is more likely due to missing IAM permissions on the Glue service role.
Trap 2: The Glue Data Catalog is encrypted with a different KMS key.
Incorrect. The KMS Data Catalog encryption uses a different key, but the error is about accessing S3 data, not the catalog.
Trap 3: The S3 bucket policy denies access to the Glue service role.
Incorrect. The 'Access Denied' error is related to KMS key permissions, not S3 bucket policy. S3 bucket policy denials would result in a different error message.
The Glue service role does not have kms:Decrypt and kms:Encrypt permissions for the KMS key.
Correct. The Glue service role must have kms:Decrypt and kms:Encrypt permissions for the KMS key to read/write encrypted data from S3.
B
The KMS key policy does not allow the AWS Glue service to use the key.
Why wrong: Incorrect. The KMS key policy can grant access to the Glue service principal, but the error is more likely due to missing IAM permissions on the Glue service role.
C
The Glue Data Catalog is encrypted with a different KMS key.
Why wrong: Incorrect. The KMS Data Catalog encryption uses a different key, but the error is about accessing S3 data, not the catalog.
D
The S3 bucket policy denies access to the Glue service role.
Why wrong: Incorrect. The 'Access Denied' error is related to KMS key permissions, not S3 bucket policy. S3 bucket policy denials would result in a different error message.
A company has an AWS Glue ETL job that reads data from an S3 bucket, transforms it, and writes to another S3 bucket. The security team requires that data in transit between the Glue job and S3 be encrypted using TLS. The Glue job runs in a VPC with a VPC endpoint for S3. Which configuration ensures TLS encryption for all data transfer?
Trap 1: Use an S3 Gateway Endpoint and ensure the Glue job uses HTTP…
HTTP is not encrypted.
Trap 2: Use an S3 Interface Endpoint and disable TLS.
Disabling TLS removes encryption.
Trap 3: Enable SSE-KMS encryption on both source and destination S3 buckets.
A data engineering team uses AWS Lambda functions to process streaming data from Amazon Kinesis Data Streams and write the results to an S3 bucket. The S3 bucket is encrypted with SSE-KMS using a customer-managed key (CMK). The Lambda function's IAM role has permissions for kms:Decrypt and kms:GenerateDataKey on the CMK. However, the Lambda function fails with an 'Access Denied' error when writing to S3. The S3 bucket policy allows s3:PutObject from the Lambda function's IAM role. What is the most likely cause?
Trap 1: The Lambda function's execution role does not have permission to…
Incorrect. The error occurs during S3 write, not during invocation. Invocation was successful if the function started.
Trap 2: The Lambda function's IAM role is missing the kms:Encrypt…
Incorrect. For SSE-KMS writes, only kms:GenerateDataKey is required; kms:Encrypt is not used by the caller. The role already has kms:GenerateDataKey and kms:Decrypt, so KMS permissions are sufficient.
Trap 3: The Kinesis data stream is not encrypted, causing the Lambda…
Incorrect. Stream encryption does not affect S3 write operations.
The Lambda function's execution role does not have permission to invoke the function.
Why wrong: Incorrect. The error occurs during S3 write, not during invocation. Invocation was successful if the function started.
B
The Lambda function's IAM role is missing the kms:Encrypt permission on the CMK.
Why wrong: Incorrect. For SSE-KMS writes, only kms:GenerateDataKey is required; kms:Encrypt is not used by the caller. The role already has kms:GenerateDataKey and kms:Decrypt, so KMS permissions are sufficient.
C
The S3 bucket policy denies s3:PutObject from the Lambda function.
Correct. Although the stem says the bucket policy allows, an explicit deny statement in the policy would override the allow and cause an access denied error. This is the most likely cause given the error.
D
The Kinesis data stream is not encrypted, causing the Lambda function to fail.
Why wrong: Incorrect. Stream encryption does not affect S3 write operations.
A data engineer needs to ensure that an Amazon S3 bucket used for sensitive data is encrypted at rest using a customer-managed AWS KMS key. The bucket policy must enforce encryption for all PUT requests. Which policy statement should be added to the bucket policy?
Why wrong: This denies only if the key does not match, but allows unencrypted requests because the condition is not checked when the header is missing.
A company uses AWS Glue to process sensitive data stored in Amazon S3. The security team requires that all data in transit between AWS Glue and S3 be encrypted. Which configuration should be used to meet this requirement?
Trap 1: Use an AWS KMS key to encrypt the data before uploading to S3.
Client-side encryption does not guarantee encryption in transit.
Trap 2: Configure AWS Glue to use SSL by setting the 'ssl' parameter to…
SSL is already enabled by default; a bucket policy is needed to enforce it.
Trap 3: Enable default encryption on the S3 bucket using SSE-S3.
A data engineer is troubleshooting an AWS Lake Formation permissions issue. A user is able to query an Amazon Athena table but cannot see the underlying S3 data in the AWS Glue Data Catalog. The user has been granted SELECT permission on the table in Lake Formation. What is the most likely cause?
Trap 1: The data location is not registered with Lake Formation.
If the table exists, the location is likely registered.
Trap 2: The S3 bucket policy does not grant the user access.
Lake Formation can grant access without explicit bucket policy.
Trap 3: The user does not have the aws:SourceArn condition in the IAM…
This is not required for accessing the Data Catalog.
A company uses Amazon Redshift to store customer data. The security team requires that all queries are logged for auditing purposes. Which step should be taken to meet this requirement? (Select ONE.)
AWS CloudTrail does not have a feature called 'database audit logging' for Redshift. This option is incorrect.
Trap 2: Use AWS CloudTrail to log Redshift API calls.
AWS CloudTrail logs Redshift API calls such as CreateCluster or ModifyCluster, but it does not log SQL queries. This does not meet the requirement to log all queries.
Trap 3: Enable logging on the Redshift security group.
Security groups control network traffic, not query logging. This option is incorrect.
Why wrong: AWS CloudTrail does not have a feature called 'database audit logging' for Redshift. This option is incorrect.
B
Use AWS CloudTrail to log Redshift API calls.
Why wrong: AWS CloudTrail logs Redshift API calls such as CreateCluster or ModifyCluster, but it does not log SQL queries. This does not meet the requirement to log all queries.
C
Enable logging on the Redshift security group.
Why wrong: Security groups control network traffic, not query logging. This option is incorrect.
D
Enable VPC Flow Logs for the Redshift cluster.
Why wrong: VPC Flow Logs capture network traffic metadata, not SQL queries. This option is incorrect.
E
Enable Amazon Redshift audit logging to an S3 bucket.
Amazon Redshift supports native audit logging that captures query logs, connection logs, and user activity logs, which can be exported to an S3 bucket. This directly meets the requirement.
A company is designing a data lake on Amazon S3. The security policy requires that all data be encrypted at rest using AWS KMS with automatic key rotation. Which encryption option meets these requirements? (Select THREE.)
Trap 1: Use SSE-KMS with an AWS managed key.
AWS managed keys do not support automatic rotation.
What does the DEA-C01 exam test about Data Security and Governance?
Data Security and Governance questions test whether you can apply the concept in context, not just recognise a definition.
How should I use these practice questions?
Select your answer before revealing the explanation. Then read why each option is right or wrong — this active recall approach builds retention far faster than re-reading notes.
Can I practise just Data Security and Governance questions in a focused session?
Yes — the session launcher on this page draws every question from the Data Security and Governance domain. Use a 10-question session first to gauge your baseline, then move to 20 or 30 once the weak spots are clear.
Where can I practise other DEA-C01 topics?
Use the topic links above to move to related areas, or go back to the DEA-C01 question bank to see all topics.
Are these real exam questions or dumps?
These are original practice questions written to test the same concepts the DEA-C01 exam covers. They are not copied from any real exam or dump site.