How should I use these Data Security and Governance practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

Can I practise just Data Security and Governance questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Data Security and Governance domain.

DEA-C01 · topic practice

Data Security and Governance practice questions

This domain covers encryption at rest and in transit, IAM and Lake Formation permissions, and audit/governance controls across AWS analytics services. Questions are scenario-based: you pick the right encryption option for S3, RDS, or Redshift, diagnose access-denied errors, or sequence a DMS migration with correct credentials and endpoints.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Editorial oversight:Johnson Ajibi· MSc IT Security, IEEE Senior Member

20 questionsDomain: Data Security and Governance

Practice 10 questions Browse domain →

What the exam tests

What to know about Data Security and Governance

Be able to choose the correct encryption mechanism per service, grant least-privilege access through IAM and Lake Formation, and read permission-denied errors to find the missing schema, role, or policy. The single most important skill is mapping a data-access failure to its exact AWS control.

Selecting SSE-S3, SSE-KMS, or SSE-C for Amazon S3 data-at-rest encryption

Granting Lake Formation table and column permissions for Athena and Redshift Spectrum

Enforcing TLS for Amazon RDS for MySQL connections with require_secure_transport

Diagnosing Redshift 'permission denied for relation' from schema, ownership, or search_path issues

Watch out for

Common Data Security and Governance exam traps

▸Assuming a table-level SELECT grant is sufficient in Redshift when the user also lacks USAGE on the schema or is not the owner.
▸Confusing SSE-C, where the customer supplies and manages the key, with SSE-KMS, where AWS KMS stores and rotates the key.
▸Forgetting that AWS DMS needs source and target endpoints plus a replication instance and IAM roles before starting the task.

Practice set

Data Security and Governance questions

20 questions · select your answer, then reveal the explanation

Question 1mediummultiple choice

Read the full Data Security and Governance explanation →

A data engineer needs to ensure that an Amazon S3 bucket used for sensitive data is encrypted at rest using a customer-managed AWS KMS key. The bucket policy must enforce encryption for all PUT requests. Which policy statement should be added to the bucket policy?

Trap 1: {"Effect":"Deny","Principal":"*","Action":"s3:PutObject","Resource":…

This denies unencrypted requests but does not enforce the specific KMS key.

Trap 2: {"Effect":"Allow","Principal":"*","Action":"s3:PutObject","Resource"…

This allows requests with the specific key but does not deny unencrypted requests.

Trap 3: {"Effect":"Deny","Principal":"*","Action":"s3:PutObject","Resource":…

This denies only if the key does not match, but allows unencrypted requests because the condition is not checked when the header is missing.

Study all Data Security and Governance common traps →

A
{"Effect":"Deny","Principal":"*","Action":"s3:PutObject","Resource":"arn:aws:s3:::bucket/*","Condition":{"Null":{"s3:x-amz-server-side-encryption":"true"}}}
Why it fails: This denies unencrypted requests but does not enforce the specific KMS key.
B
{"Effect":"Allow","Principal":"*","Action":"s3:PutObject","Resource":"arn:aws:s3:::bucket/*","Condition":{"StringEquals":{"s3:x-amz-server-side-encryption-aws-kms-key-id":"arn:aws:kms:us-east-1:123456789012:key/abc123"}}}
Why it fails: This allows requests with the specific key but does not deny unencrypted requests.
C
{"Effect":"Deny","Principal":"*","Action":"s3:PutObject","Resource":"arn:aws:s3:::bucket/*","Condition":{"StringNotEquals":{"s3:x-amz-server-side-encryption":"aws:kms"},"Null":{"s3:x-amz-server-side-encryption-aws-kms-key-id":"true"}}}
This denies if encryption is not aws:kms or if the key ID is not provided, enforcing the required encryption.
D
{"Effect":"Deny","Principal":"*","Action":"s3:PutObject","Resource":"arn:aws:s3:::bucket/*","Condition":{"StringNotEquals":{"s3:x-amz-server-side-encryption-aws-kms-key-id":"arn:aws:kms:us-east-1:123456789012:key/abc123"}}}
Why it fails: This denies only if the key does not match, but allows unencrypted requests because the condition is not checked when the header is missing.

Full breakdown with real-world context →

Question 2hardmultiple choice

Read the full Data Security and Governance explanation →

A data engineer is troubleshooting an AWS Lake Formation permissions issue. A user is able to query an Amazon Athena table but cannot see the underlying S3 data in the AWS Glue Data Catalog. The user has been granted SELECT permission on the table in Lake Formation. What is the most likely cause?

Trap 1: The data location is not registered with Lake Formation.

If the table exists, the location is likely registered.

Trap 2: The S3 bucket policy does not grant the user access.

Lake Formation can grant access without explicit bucket policy.

Trap 3: The user does not have the aws:SourceArn condition in the IAM…

This is not required for accessing the Data Catalog.

Study all Data Security and Governance common traps →

A
The user does not have DESCRIBE permission on the table in Lake Formation.
SELECT permission allows querying but not viewing the table metadata; DESCRIBE is needed to see the table in the catalog.
B
The data location is not registered with Lake Formation.
Why it fails: If the table exists, the location is likely registered.
C
The S3 bucket policy does not grant the user access.
Why it fails: Lake Formation can grant access without explicit bucket policy.
D
The user does not have the aws:SourceArn condition in the IAM policy.
Why it fails: This is not required for accessing the Data Catalog.

Full breakdown with real-world context →

Question 3mediummulti select

Read the full Data Security and Governance explanation →

A company is designing a data lake on Amazon S3. The security policy requires that all data be encrypted at rest using AWS KMS with automatic key rotation. Which encryption option meets these requirements? (Select THREE.)

Trap 1: Use SSE-KMS with an AWS managed key.

SSE-KMS with an AWS managed key encrypts via KMS, but its key rotation is fixed at three years and cannot be configured to meet a policy demanding automatic rotation on a defined schedule. It tempts because AWS managed keys need no key administration, suiting workloads with no rotation or audit requirements.

Trap 2: Use SSE-C with a customer-provided key.

SSE-C uses a customer-supplied key held entirely outside AWS KMS, so KMS key rotation never applies and the service cannot rotate the key. It tempts when an organisation must retain sole custody of encryption keys for compliance, accepting manual rotation responsibility.

Study all Data Security and Governance common traps →

A
Enable automatic key rotation on the KMS key.
Enabling automatic key rotation on the customer-managed KMS key satisfies the policy's rotation requirement, since AWS KMS rotates the backing key material annually without changing the key ID. Rotation applies only to customer-managed keys, not AWS-managed or S3-managed keys.
B
Use SSE-KMS with an AWS managed key.
Why it fails: SSE-KMS with an AWS managed key encrypts via KMS, but its key rotation is fixed at three years and cannot be configured to meet a policy demanding automatic rotation on a defined schedule. It tempts because AWS managed keys need no key administration, suiting workloads with no rotation or audit requirements.
C
Set the default encryption on the S3 bucket to SSE-KMS with the CMK.
Setting the bucket's default encryption to SSE-KMS with the CMK ensures every newly written object is encrypted at rest under that KMS key automatically, without per-request headers. This enforces the policy's KMS encryption requirement across the whole data lake.
D
Use SSE-KMS with a customer-managed key (CMK).
SSE-KMS with a customer-managed key encrypts objects at rest using AWS KMS and is the prerequisite for automatic key rotation, which AWS-managed keys do not support. This satisfies the policy's KMS-with-rotation requirement, unlike SSE-S3 or client-side encryption.
E
Use SSE-C with a customer-provided key.
Why it fails: SSE-C uses a customer-supplied key held entirely outside AWS KMS, so KMS key rotation never applies and the service cannot rotate the key. It tempts when an organisation must retain sole custody of encryption keys for compliance, accepting manual rotation responsibility.

Full breakdown with real-world context →

Question 4hardmultiple choice

Read the full Data Security and Governance explanation →

Refer to the exhibit. A data engineer is running an AWS Glue job that reads from an S3 bucket encrypted with a customer-managed KMS key. The job fails with the error shown. What is the most likely cause?

Exhibit

Refer to the exhibit.

Error from AWS Glue job:
```
ERROR: An error occurred while calling o75.pyWriteDynamicFrame.
Access Denied. User: arn:aws:sts::123456789012:assumed-role/GlueServiceRole/i-abc123 is not authorized to perform: kms:Decrypt on resource: arn:aws:kms:us-east-1:123456789012:key/mrk-1234567890 because no identity-based policy allows the kms:Decrypt action
```

Trap 1: The S3 bucket policy denies the kms:Decrypt action.

The error points to identity-based policy, not bucket policy.

Trap 2: The Glue job does not have permission to call kms:GenerateDataKey.

The error specifies kms:Decrypt, not GenerateDataKey.

Trap 3: The KMS key policy does not grant the Glue service principal access.

The role is used, not the service principal directly.

Study all Data Security and Governance common traps →

A
The S3 bucket policy denies the kms:Decrypt action.
Why it fails: The error points to identity-based policy, not bucket policy.
B
The IAM role used by the Glue job is missing the kms:Decrypt permission.
The error says no identity-based policy allows kms:Decrypt.
C
The Glue job does not have permission to call kms:GenerateDataKey.
Why it fails: The error specifies kms:Decrypt, not GenerateDataKey.
D
The KMS key policy does not grant the Glue service principal access.
Why it fails: The role is used, not the service principal directly.

Full breakdown with real-world context →

Question 5easymultiple choice

Read the full Data Security and Governance explanation →

Refer to the exhibit. A security analyst is reviewing CloudTrail logs and notices a PutObject event to the 'company-data-lake' bucket. The bucket policy requires all objects to be encrypted with SSE-KMS. What should the analyst conclude?

Exhibit

Refer to the exhibit.

AWS CloudTrail log entry:
```
{
  "eventVersion": "1.08",
  "userIdentity": {
    "arn": "arn:aws:iam::123456789012:user/DataEngineer",
    "principalId": "AIDACKCEVSQ6C2EXAMPLE"
  },
  "eventTime": "2023-09-15T14:30:00Z",
  "eventSource": "s3.amazonaws.com",
  "eventName": "PutObject",
  "awsRegion": "us-east-1",
  "sourceIPAddress": "203.0.113.5",
  "userAgent": "[S3Console]",
  "requestParameters": {
    "bucketName": "company-data-lake",
    "key": "sensitive/customer-data.csv",
    "x-amz-server-side-encryption": "AES256"
  },
  "responseElements": null,
  "additionalEventData": {
    "AuthenticationMethod": "AuthHeader"
  }
}
```

Trap 1: The object was uploaded by the bucket owner, bypassing the policy.

CloudTrail records the API call, not the encryption applied, and the bucket owner can still be denied by a policy condition; ownership alone proves nothing. It is tempting because the owner often holds broad permissions, and would be correct only if the policy explicitly exempted the owner.

Trap 2: The request succeeded because SSE-S3 is acceptable.

SSE-S3 uses AES-256 with S3-managed keys, which the bucket policy explicitly rejects; the policy demands SSE-KMS, so the PutObject would fail with AccessDenied. SSE-S3 suits buckets with no KMS key requirement, where default encryption and zero key-management overhead are wanted.

Trap 3: The object was encrypted with SSE-KMS as required.

The encryption header shows AES256, which is SSE-S3.

Study all Data Security and Governance common traps →

A
The object was uploaded by the bucket owner, bypassing the policy.
Why it fails: CloudTrail records the API call, not the encryption applied, and the bucket owner can still be denied by a policy condition; ownership alone proves nothing. It is tempting because the owner often holds broad permissions, and would be correct only if the policy explicitly exempted the owner.
B
The request succeeded because SSE-S3 is acceptable.
Why it fails: SSE-S3 uses AES-256 with S3-managed keys, which the bucket policy explicitly rejects; the policy demands SSE-KMS, so the PutObject would fail with AccessDenied. SSE-S3 suits buckets with no KMS key requirement, where default encryption and zero key-management overhead are wanted.
C
The object was encrypted with SSE-KMS as required.
Why it fails: The encryption header shows AES256, which is SSE-S3.
D
The object was encrypted with SSE-S3, which violates the bucket policy.
AES256 indicates SSE-S3, not KMS.

Full breakdown with real-world context →

Question 6mediummultiple choice

Read the full Data Security and Governance explanation →

A company is using Amazon Redshift Spectrum to query data in Amazon S3. The S3 bucket uses SSE-KMS encryption. The Redshift cluster has an IAM role that allows access to S3 and KMS. However, queries fail with an 'Access Denied' error. What is the most likely cause?

Trap 1: The Redshift cluster does not have the IAM role attached.

The stem states the cluster already has an IAM role permitting S3 and KMS access, so a missing role contradicts the given configuration. Attaching a role is the fix when Spectrum queries fail because no credentials reach S3 at all, which is not the case here.

Trap 2: The IAM role does not have the kms:Decrypt permission.

The stem explicitly says the role allows KMS access, so kms:Decrypt is already granted; the actual gap is the KMS key policy, which must also permit the role. Missing kms:Decrypt is the cause when the role's policy omits it, not when the key policy denies it.

Trap 3: The external table is not defined in the schema.

A missing external table definition produces a 'relation does not exist' or catalog error, not Access Denied, because Spectrum never reaches S3. Defining the external table is required when queries cannot resolve the table at all, which is a different failure mode.

Study all Data Security and Governance common traps →

A
The Redshift cluster does not have the IAM role attached.
Why it fails: The stem states the cluster already has an IAM role permitting S3 and KMS access, so a missing role contradicts the given configuration. Attaching a role is the fix when Spectrum queries fail because no credentials reach S3 at all, which is not the case here.
B
The external schema does not have the IAM role specified.
Redshift Spectrum reads S3 through the external schema, which must carry the IAM role via CREATE EXTERNAL SCHEMA ... IAM_ROLE. Without it, Spectrum cannot assume the role to decrypt SSE-KMS objects, producing Access Denied despite the cluster role's permissions.
C
The IAM role does not have the kms:Decrypt permission.
Why it fails: The stem explicitly says the role allows KMS access, so kms:Decrypt is already granted; the actual gap is the KMS key policy, which must also permit the role. Missing kms:Decrypt is the cause when the role's policy omits it, not when the key policy denies it.
D
The external table is not defined in the schema.
Why it fails: A missing external table definition produces a 'relation does not exist' or catalog error, not Access Denied, because Spectrum never reaches S3. Defining the external table is required when queries cannot resolve the table at all, which is a different failure mode.

Full breakdown with real-world context →

Question 7hardmultiple choice

Read the full Data Security and Governance explanation →

A financial services company uses AWS KMS to encrypt data in Amazon S3. The compliance team requires that all encryption keys be rotated automatically every 365 days. The data engineer needs to implement this requirement without manual intervention. Which solution meets the requirement with the LEAST operational overhead?

Trap 1: Create a customer managed key (CMK) in KMS with automatic rotation…

CMKs with automatic rotation work but have more overhead (cost, key policy management) than AWS managed keys.

Trap 2: Create a customer managed key with imported key material and…

Imported key material does not support automatic rotation; manual or custom rotation is required.

Trap 3: Use S3 server-side encryption with S3 managed keys (SSE-S3).

SSE-S3 also rotates keys automatically but the question expects KMS; SSE-S3 is less configurable but still rotates, but AWS managed key is the intended answer for KMS scenario.

Study all Data Security and Governance common traps →

A
Create a customer managed key (CMK) in KMS with automatic rotation enabled every 365 days. Use this CMK to encrypt S3 objects.
Why it fails: CMKs with automatic rotation work but have more overhead (cost, key policy management) than AWS managed keys.
B
Create a customer managed key with imported key material and configure a Lambda function to rotate the key every 365 days.
Why it fails: Imported key material does not support automatic rotation; manual or custom rotation is required.
C
Use the AWS managed key for Amazon S3 (aws/s3) for server-side encryption.
AWS managed keys are automatically rotated every year with no operational overhead.
D
Use S3 server-side encryption with S3 managed keys (SSE-S3).
Why it fails: SSE-S3 also rotates keys automatically but the question expects KMS; SSE-S3 is less configurable but still rotates, but AWS managed key is the intended answer for KMS scenario.

Full breakdown with real-world context →

Question 8hardmultiple choice

Read the full Data Security and Governance explanation →

Refer to the exhibit. A data engineer is troubleshooting a permissions issue. The IAM role 'DataEngineerRole' is used by an AWS Glue job that needs to read data from an S3 bucket encrypted with a customer managed KMS key. The above key policy is attached to the KMS key. The Glue job fails with an AccessDenied error when trying to read the data. What is the MOST likely cause?

Exhibit

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::123456789012:role/DataEngineerRole"
      },
      "Action": [
        "kms:Decrypt",
        "kms:GenerateDataKey"
      ],
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "kms:ViaService": "s3.us-east-1.amazonaws.com"
        }
      }
    },
    {
      "Effect": "Deny",
      "Principal": "*",
      "Action": "kms:*",
      "Resource": "*",
      "Condition": {
        "BoolIfExists": {
          "aws:SecureTransport": "false"
        }
      }
    }
  ]
}

Trap 1: The key policy requires requests to originate from a VPC endpoint,…

The policy does not reference VPC endpoints; it references kms:ViaService.

Trap 2: The key policy denies requests that are not using HTTPS, but the…

The Deny statement with SecureTransport=false would deny non-HTTPS; if HTTPS is used, it's allowed.

Trap 3: The Glue job is running in a different AWS region than the S3…

The kms:ViaService condition restricts the AWS service making the request, not the caller's region.

Study all Data Security and Governance common traps →

A
The key policy requires requests to originate from a VPC endpoint, but the Glue job is not using one.
Why it fails: The policy does not reference VPC endpoints; it references kms:ViaService.
B
The key policy denies requests that are not using HTTPS, but the Glue job is using HTTPS.
Why it fails: The Deny statement with SecureTransport=false would deny non-HTTPS; if HTTPS is used, it's allowed.
C
The key policy condition 'kms:ViaService' restricts KMS actions to only when they are made through S3, but AWS Glue calls KMS directly, not via S3.
Glue does not use S3 to make KMS calls; it calls KMS directly, so the condition fails.
D
The Glue job is running in a different AWS region than the S3 bucket.
Why it fails: The kms:ViaService condition restricts the AWS service making the request, not the caller's region.

Full breakdown with real-world context →

Question 9hardmulti select

Read the full Data Security and Governance explanation →

A data engineer is designing a data lake on Amazon S3 with AWS Lake Formation. The data lake contains personally identifiable information (PII). The company has a policy that only users who have completed data privacy training can access the PII data. The training status is stored in an external identity provider (IdP) as an attribute. The data engineer needs to enforce this policy using Lake Formation. Which THREE steps should the data engineer take? (Choose THREE.)

Trap 1: Create a column-level filter on the PII columns that limits access…

Column-level filters do not support attributes; they filter by column name.

Trap 2: Create an IAM role for each user and attach a policy that allows…

IAM roles cannot be granted LF-tag permissions; Lake Formation manages grants.

Study all Data Security and Governance common traps →

A
Create an LF-tag called 'trainingCompleted' with values 'true' and 'false'. Grant 'SELECT' permission on the LF-tag 'trainingCompleted=true' to the federated users.
This allows users with the tag to access data associated with that tag.
B
Configure SAML-based federation between the IdP and AWS to pass the training status attribute in the SAML assertion.
This allows Lake Formation to receive the attribute.
C
Create a column-level filter on the PII columns that limits access based on the user's training attribute.
Why it fails: Column-level filters do not support attributes; they filter by column name.
D
Create an IAM role for each user and attach a policy that allows 'lakeformation:GetDataAccess' only if the user has the training attribute.
Why it fails: IAM roles cannot be granted LF-tag permissions; Lake Formation manages grants.
E
Associate the LF-tag 'trainingCompleted=true' with the PII columns in the tables.
This marks the PII columns as accessible only to users with that tag.

Full breakdown with real-world context →

Question 10mediummultiple choice

Read the full Data Security and Governance explanation →

A healthcare company uses AWS Glue to process patient data stored in Amazon S3. The data is encrypted at rest using SSE-KMS with a customer managed key. The Glue ETL job runs on a schedule and reads from an S3 bucket, transforms the data, and writes to another S3 bucket also encrypted with the same KMS key. Recently, the security team rotated the KMS key. After the rotation, the Glue job started failing with 'AccessDenied' errors when trying to read from the source bucket. The Glue job's IAM role has permissions to use the KMS key (kms:Decrypt, kms:GenerateDataKey). The S3 bucket policies allow the role to read/write. What is the MOST likely cause of the failure?

Trap 1: The Glue job's IAM role is missing the kms:Encrypt permission on…

kms:Encrypt is not needed for reading encrypted data.

Trap 2: The Glue job is using the wrong encryption context when calling KMS.

Encryption context mismatches can cause failures, but rotation does not change the encryption context.

Trap 3: The S3 bucket policy has a condition that requires the request to…

S3 bucket policies do not have such conditions; they can use kms:EncryptionContext but not key version.

Study all Data Security and Governance common traps →

A
The KMS key rotation created a new backing key, but the Glue job's IAM role does not have permission to decrypt with the old backing key.
If automatic rotation is enabled, old backing keys are retained, but if the key was manually rotated (new key created), the old key may be disabled. Also, the key policy may have been updated incorrectly.
B
The Glue job's IAM role is missing the kms:Encrypt permission on the KMS key.
Why it fails: kms:Encrypt is not needed for reading encrypted data.
C
The Glue job is using the wrong encryption context when calling KMS.
Why it fails: Encryption context mismatches can cause failures, but rotation does not change the encryption context.
D
The S3 bucket policy has a condition that requires the request to use the latest version of the KMS key.
Why it fails: S3 bucket policies do not have such conditions; they can use kms:EncryptionContext but not key version.

Full breakdown with real-world context →

Question 11hardmultiple choice

Read the full Data Security and Governance explanation →

Refer to the exhibit. A data engineer applies this bucket policy to an S3 bucket named my-data-bucket. The bucket contains sensitive data. The company's security team reports that data was accessed from an IP address outside the allowed range. What is the MOST likely reason that the policy failed to block the unauthorized access?

Exhibit

Refer to the exhibit.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": "*",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::my-data-bucket/*",
      "Condition": {
        "IpAddress": {
          "aws:SourceIp": "10.0.0.0/24"
        }
      }
    },
    {
      "Effect": "Deny",
      "Principal": "*",
      "Action": "s3:*",
      "Resource": "arn:aws:s3:::my-data-bucket/*",
      "Condition": {
        "Bool": {
          "aws:SecureTransport": "false"
        }
      }
    }
  ]
}

Trap 1: The Deny statement's condition on SecureTransport overrides the IP…

SecureTransport and the IP condition sit in separate statements, so neither overrides the other; a request failing SecureTransport is simply denied by that statement. It is tempting because overlapping conditions can conflict, but here the IP Deny remains independently effective.

Trap 2: The policy has a syntax error in the Condition element.

A malformed Condition element would cause the policy to be rejected at save time, not silently permit traffic, and the exhibit shows valid JSON. It is tempting because syntax faults are a common cause of policy failures, but this policy was accepted and evaluated.

Trap 3: The bucket policy does not apply to requests made from within the…

Bucket policies do apply to principals within the owning account, so this is not the cause; the request would still be evaluated against the Deny. It is tempting because same-account access often bypasses identity-based policies, but resource policies govern those callers too.

Study all Data Security and Governance common traps →

A
The Deny statement's condition on SecureTransport overrides the IP condition.
Why it fails: SecureTransport and the IP condition sit in separate statements, so neither overrides the other; a request failing SecureTransport is simply denied by that statement. It is tempting because overlapping conditions can conflict, but here the IP Deny remains independently effective.
B
The policy has a syntax error in the Condition element.
Why it fails: A malformed Condition element would cause the policy to be rejected at save time, not silently permit traffic, and the exhibit shows valid JSON. It is tempting because syntax faults are a common cause of policy failures, but this policy was accepted and evaluated.
C
The Deny statement does not restrict access based on IP address; it only denies non-HTTPS requests.
The Deny statement only rejects requests not using HTTPS, so it never evaluates source IP. An attacker connecting over HTTPS from outside the allowed range therefore passes, because no condition in the policy restricts access by IP address.
D
The bucket policy does not apply to requests made from within the same AWS account.
Why it fails: Bucket policies do apply to principals within the owning account, so this is not the cause; the request would still be evaluated against the Deny. It is tempting because same-account access often bypasses identity-based policies, but resource policies govern those callers too.

Full breakdown with real-world context →

Question 12easymultiple choice

Study the full Python automation breakdown →

A financial services company uses AWS Glue ETL jobs to process credit card transaction data stored in Amazon S3. The data includes PII such as names and credit card numbers. The security team requires that all PII be masked before the data is written to the curated zone of the data lake. The data engineer has implemented a Glue job that reads from the raw zone, applies a custom transform to mask credit card numbers using a regular expression, and writes to the curated zone. However, during a recent audit, the security team discovered that some masked data still contained partial credit card numbers (e.g., showing the last four digits) when viewed by analysts who should only see masked data. The company's policy is that credit card numbers must be completely masked, showing only asterisks or a fixed string like "XXXX-XXXX-XXXX-XXXX". The Glue job uses a DynamicFrame and applies a Map transform with a Python function that replaces digits with 'X'. The data is stored in Parquet format. What should the data engineer do to ensure complete masking of credit card numbers?

Trap 1: Use an AWS Glue crawler to classify the data and apply a masking…

Crawlers classify schemas but do not mask data; masking must be part of the ETL job.

Trap 2: Enable server-side encryption with AWS KMS on the curated S3 bucket.

Encryption protects data at rest but does not mask the content for authorized users.

Trap 3: Change the output format from Parquet to CSV and use a different…

Format change does not fix masking logic.

Study all Data Security and Governance common traps →

A
Use an AWS Glue crawler to classify the data and apply a masking rule based on the classification.
Why it fails: Crawlers classify schemas but do not mask data; masking must be part of the ETL job.
B
Enable server-side encryption with AWS KMS on the curated S3 bucket.
Why it fails: Encryption protects data at rest but does not mask the content for authorized users.
C
Replace the custom Python Map transform with a built-in Glue Transform for data masking, such as the Mask transform available in Glue Studio.
Built-in masking transforms are designed to handle common patterns and ensure complete masking.
D
Change the output format from Parquet to CSV and use a different write mode.
Why it fails: Format change does not fix masking logic.

Full breakdown with real-world context →

Question 13mediummatching

Read the full Data Security and Governance explanation →

Match each AWS networking concept to its definition.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Virtual private cloud isolated network

Segment of VPC IP address range

Stateful firewall for instances

Stateless firewall for subnets

Enables VPC to internet communication

Trap 1: Security Group: A stateless firewall that controls traffic at the…

Incorrect — this describes a Network ACL (NACL), not a Security Group.

Trap 2: NACL: A virtual firewall that controls traffic at the instance…

Incorrect — this describes a Security Group, not a NACL.

Study all Data Security and Governance common traps →

A
VPC: A virtual network dedicated to your AWS account.
This is the correct definition of a Virtual Private Cloud (VPC).
B
Subnet: A segment of a VPC's IP address range where you place resources.
This correctly describes a subnet as a subdivision within a VPC.
C
Security Group: A virtual firewall that controls inbound and outbound traffic at the instance level.
Security groups are stateful and operate at the instance level.
D
NACL: A stateless firewall that controls inbound and outbound traffic at the subnet level.
Network ACLs are stateless and operate at the subnet level.
E
Security Group: A stateless firewall that controls traffic at the subnet level.
Why it fails: Incorrect — this describes a Network ACL (NACL), not a Security Group.
F
NACL: A virtual firewall that controls traffic at the instance level.
Why it fails: Incorrect — this describes a Security Group, not a NACL.

Full breakdown with real-world context →

Question 14mediummultiple choice

Read the full Data Security and Governance explanation →

A data engineer is configuring S3 bucket policies to restrict access to a specific VPC. Which condition key should be used in the bucket policy to enforce that requests originate only from the desired VPC?

Trap 1: aws:VpcSourceIp

aws:VpcSourceIp is not a valid condition key.

Trap 2: aws:RequestedRegion

aws:RequestedRegion restricts by AWS region.

Trap 3: aws:SourceIp

aws:SourceIp restricts by IP address, not VPC.

Study all Data Security and Governance common traps →

A
aws:VpcSourceIp
Why it fails: aws:VpcSourceIp is not a valid condition key.
B
aws:SourceVpc
The aws:SourceVpc condition key evaluates the VPC ID from which the request originates, letting the bucket policy allow only traffic from the specified VPC endpoint. aws:SourceVpce restricts to a specific endpoint, whereas aws:SourceVpc matches any endpoint within the named VPC.
C
aws:RequestedRegion
Why it fails: aws:RequestedRegion restricts by AWS region.
D
aws:SourceIp
Why it fails: aws:SourceIp restricts by IP address, not VPC.

Full breakdown with real-world context →

Question 15hardmultiple choice

Read the full Data Security and Governance explanation →

A company stores sensitive data in S3 and uses VPC endpoints to access the bucket. They need to ensure that only traffic from their VPC can access the data, and that the traffic cannot leave the AWS network. Which combination of bucket policy and endpoint policy should they use?

Trap 1: Use only a bucket policy with aws:SourceIp condition

SourceIp does not restrict to VPC.

Trap 2: Use an S3 VPC Interface endpoint and add a bucket policy with…

Interface endpoints use public internet for some traffic.

Trap 3: Use an S3 VPC Gateway endpoint with no bucket policy

Without bucket policy, any VPC can access.

Study all Data Security and Governance common traps →

A
Use only a bucket policy with aws:SourceIp condition
Why it fails: SourceIp does not restrict to VPC.
B
Use an S3 VPC Gateway endpoint and add a bucket policy with aws:SourceVpc condition
An S3 gateway endpoint routes traffic privately within the AWS network, satisfying the requirement that data never traverse the public internet. The bucket policy's `aws:SourceVpc` condition then restricts access to requests originating from that specific VPC, ensuring only internal traffic reaches the bucket.
C
Use an S3 VPC Interface endpoint and add a bucket policy with aws:SourceVpce condition
Why it fails: Interface endpoints use public internet for some traffic.
D
Use an S3 VPC Gateway endpoint with no bucket policy
Why it fails: Without bucket policy, any VPC can access.

Full breakdown with real-world context →

Question 16easymultiple choice

Read the full Data Security and Governance explanation →

A data engineer needs to ensure that an S3 bucket is not publicly accessible. Which S3 block public access setting should be applied to achieve this?

Trap 1: BlockPublicAcls (both new and existing)

Incorrect. Blocking public ACLs does not prevent public bucket policies, which can still grant public access.

Trap 2: IgnorePublicAcls

Incorrect. IgnorePublicAcls is not a valid block public access setting and would not block public access.

Trap 3: BlockPublicAcls (new ACLs)

Incorrect. Blocking only new public ACLs does not address existing ones, leaving potential exposure.

Study all Data Security and Governance common traps →

A
BlockPublicAcls (both new and existing)
Why it fails: Incorrect. Blocking public ACLs does not prevent public bucket policies, which can still grant public access.
B
IgnorePublicAcls
Why it fails: Incorrect. IgnorePublicAcls is not a valid block public access setting and would not block public access.
C
BlockPublicAcls (new ACLs)
Why it fails: Incorrect. Blocking only new public ACLs does not address existing ones, leaving potential exposure.
D
BlockPublicPolicy
BlockPublicPolicy rejects PUT Bucket policy calls that would grant public access, preventing a public bucket policy from being attached at all. This directly satisfies the requirement that the S3 bucket must not be publicly accessible, stopping the exposure at the policy layer before any public permissions can take effect.

Full breakdown with real-world context →

Question 17mediummulti select

Read the full Data Security and Governance explanation →

A data engineer is designing a data pipeline that processes PII data in AWS Glue. They need to ensure data is encrypted at rest and in transit. Which TWO actions should they take? (Choose TWO.)

Trap 1: Disable SSL for Glue connections

SSL should be enabled for encryption in transit.

Trap 2: Use a KMS key for Glue job bookmarks

Bookmarks are for job state, not data encryption.

Trap 3: Use CloudWatch Logs for encryption

CloudWatch Logs does not provide data encryption.

Study all Data Security and Governance common traps →

A
Disable SSL for Glue connections
Why it fails: SSL should be enabled for encryption in transit.
B
Configure S3 bucket server-side encryption for job output
Configuring S3 server-side encryption with SSE-KMS satisfies the at-rest requirement for Glue job output written to S3, since Glue's Data Catalog and job bookmarks store metadata separately. This addresses only data at rest; the in-transit constraint still needs a separate control, such as TLS enforcement on the S3 endpoint.
C
Use a KMS key for Glue job bookmarks
Why it fails: Bookmarks are for job state, not data encryption.
D
Use CloudWatch Logs for encryption
Why it fails: CloudWatch Logs does not provide data encryption.
E
Enable encryption at rest for the AWS Glue Data Catalog
Encrypting the AWS Glue Data Catalog secures metadata such as table definitions, partition keys and column statistics at rest, satisfying the encryption-at-rest constraint for catalog-stored PII schema information. It complements, rather than replaces, encryption of the underlying Amazon S3 data and job bookmarks, which the other correct option addresses.

Full breakdown with real-world context →

Question 18hardmultiple choice

Read the full Data Security and Governance explanation →

Refer to the exhibit. A data engineer attached this S3 bucket policy to the bucket 'example-bucket'. What is the effect of this policy?

Exhibit

Refer to the exhibit.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Deny",
      "Principal": "*",
      "Action": "s3:PutObject",
      "Resource": "arn:aws:s3:::example-bucket/*",
      "Condition": {
        "StringNotEquals": {
          "s3:x-amz-server-side-encryption": "AES256"
        }
      }
    }
  ]
}

Trap 1: It allows all PutObject requests that do not use encryption

This option says it allows all PutObject requests that do not use encryption. The policy actually denies such requests, so A is incorrect.

Trap 2: It denies all PutObject requests unless they use SSE-KMS

This option says it denies all PutObject requests unless they use SSE-KMS. The policy requires SSE-S3, not SSE-KMS, so C is incorrect.

Trap 3: It denies all PutObject requests from anonymous users

This option says it denies all PutObject requests from anonymous users. The policy does not restrict based on user identity, so D is incorrect.

Study all Data Security and Governance common traps →

A
It allows all PutObject requests that do not use encryption
Why it fails: This option says it allows all PutObject requests that do not use encryption. The policy actually denies such requests, so A is incorrect.
B
It denies PutObject requests that do not use SSE-S3
Ly states that the policy denies PutObject requests that do not use SSE-S3. This matches the policy's condition.
C
It denies all PutObject requests unless they use SSE-KMS
Why it fails: This option says it denies all PutObject requests unless they use SSE-KMS. The policy requires SSE-S3, not SSE-KMS, so C is incorrect.
D
It denies all PutObject requests from anonymous users
Why it fails: This option says it denies all PutObject requests from anonymous users. The policy does not restrict based on user identity, so D is incorrect.

Full breakdown with real-world context →

Question 19mediummultiple choice

Read the full Data Security and Governance explanation →

Refer to the exhibit. The exhibit shows output from AWS CLI commands. Which key can be used to enable automatic annual rotation?

Network Topology

Trap 1: The second key (5678efgh-...)

Automatic annual rotation applies to customer-managed KMS keys, not to AWS-managed keys. The second key, if AWS-managed, rotates on AWS's schedule without the configurable annual option. The customer-managed key is the one that exposes the EnableKeyRotation setting for yearly rotation.

Trap 2: Both keys

Automatic annual rotation requires the key to be a customer managed KMS key with rotation enabled; the exhibit shows only one key meeting that criterion, so claiming both is wrong. It is tempting because both keys appear in the same listing, but only the customer managed key supports configurable rotation.

Trap 3: Neither key

At least one key in the exhibit is a customer managed KMS key that supports enabling annual rotation, so neither is incorrect. It is tempting when both keys look similar in the CLI output, but the distinction is key manager type: only customer managed keys expose the rotation setting.

Study all Data Security and Governance common traps →

A
The second key (5678efgh-...)
Why it fails: Automatic annual rotation applies to customer-managed KMS keys, not to AWS-managed keys. The second key, if AWS-managed, rotates on AWS's schedule without the configurable annual option. The customer-managed key is the one that exposes the EnableKeyRotation setting for yearly rotation.
B
Both keys
Why it fails: Automatic annual rotation requires the key to be a customer managed KMS key with rotation enabled; the exhibit shows only one key meeting that criterion, so claiming both is wrong. It is tempting because both keys appear in the same listing, but only the customer managed key supports configurable rotation.
C
Neither key
Why it fails: At least one key in the exhibit is a customer managed KMS key that supports enabling annual rotation, so neither is incorrect. It is tempting when both keys look similar in the CLI output, but the distinction is key manager type: only customer managed keys expose the rotation setting.
D
The first key (1234abcd-...)
The first key listed is the active customer managed KMS key, and automatic annual rotation is enabled per key via the AWS CLI or console. Rotation applies only to the key material of that specific key, satisfying the annual rotation requirement.

Full breakdown with real-world context →

Question 20easymultiple choice

Read the full Data Security and Governance explanation →

Refer to the exhibit. An IAM policy includes this statement. What access does it grant?

Exhibit

Refer to the exhibit.

{
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::example-bucket/*",
      "Condition": {
        "IpAddress": {
          "aws:SourceIp": "10.0.0.0/8"
        }
      }
    }
  ]
}

Trap 1: It denies GetObject access to the bucket from IP addresses in…

The effect is Allow, not Deny.

Trap 2: It allows GetObject access to the bucket only from a specific VPC

The condition uses IP address, not VPC.

Trap 3: It allows PutObject access to the bucket from any IP address

The action is GetObject, not PutObject.

Study all Data Security and Governance common traps →

A
It denies GetObject access to the bucket from IP addresses in 10.0.0.0/8
Why it fails: The effect is Allow, not Deny.
B
It allows GetObject access to the bucket only from a specific VPC
Why it fails: The condition uses IP address, not VPC.
C
It allows PutObject access to the bucket from any IP address
Why it fails: The action is GetObject, not PutObject.
D
It allows GetObject access to the bucket only from IP addresses in 10.0.0.0/8
The policy's Condition block uses IpAddress with aws:SourceIp, restricting the s3:GetObject action to requests originating within the 10.0.0.0/8 CIDR range. This satisfies the stem's requirement that access be limited by source network, granting object retrieval only to callers whose requests arrive from those private addresses.

Full breakdown with real-world context →

Continue with 20-question session →

Free account

Track your progress over time

Create a free account to save your results and see which topics improve across sessions.

Focused Data Security and Governance sessions

Start a Data Security and Governance only practice session

Every question in these sessions is drawn from the Data Security and Governance domain — nothing else.

10 questions 20 questions 30 questions 50 questions

Browse all Data Security and Governance questions →Mixed DEA-C01 session

Frequently asked questions

What does the DEA-C01 exam test about Data Security and Governance?: Be able to choose the correct encryption mechanism per service, grant least-privilege access through IAM and Lake Formation, and read permission-denied errors to find the missing schema, role, or policy. The single most important skill is mapping a data-access failure to its exact AWS control.
How should I use these practice questions?: Select your answer before revealing the explanation. Then read why each option is right or wrong — this active recall approach builds retention far faster than re-reading notes.
Can I practise just Data Security and Governance questions in a focused session?: Yes — the session launcher on this page draws every question from the Data Security and Governance domain. Use a 10-question session first to gauge your baseline, then move to 20 or 30 once the weak spots are clear.
Where can I practise other DEA-C01 topics?: Use the topic links above to move to related areas, or go back to the DEA-C01 question bank to see all topics.
Are these real exam questions or dumps?: These are original practice questions written to test the same concepts the DEA-C01 exam covers. They are not copied from any real exam or dump site.

Data Security and Governance only

10 questions 20 questions 30 questions 50 questions

Mixed DEA-C01 session

Track your progress

A free account saves results across sessions and highlights which topics need work.

Study resources

All DEA-C01 questions Data Security and Governance domain overview DEA-C01 exam guide

Exam traps to avoid

▸Assuming a table-level SELECT grant is sufficient in Redshift when the user also lacks USAGE on the schema or is not the owner.
▸Confusing SSE-C, where the customer supplies and manages the key, with SSE-KMS, where AWS KMS stores and rotates the key.
▸Forgetting that AWS DMS needs source and target endpoints plus a replication instance and IAM roles before starting the task.

Data Security and Governance practice questions

What to know about Data Security and Governance

Common Data Security and Governance exam traps

Data Security and Governance questions

A data engineer needs to ensure that an Amazon S3 bucket used for sensitive data is encrypted at rest using a customer-managed AWS KMS key. The bucket policy must enforce encryption for all PUT requests. Which policy statement should be added to the bucket policy?

A data engineer is troubleshooting an AWS Lake Formation permissions issue. A user is able to query an Amazon Athena table but cannot see the underlying S3 data in the AWS Glue Data Catalog. The user has been granted SELECT permission on the table in Lake Formation. What is the most likely cause?

A company is designing a data lake on Amazon S3. The security policy requires that all data be encrypted at rest using AWS KMS with automatic key rotation. Which encryption option meets these requirements? (Select THREE.)

Refer to the exhibit. A data engineer is running an AWS Glue job that reads from an S3 bucket encrypted with a customer-managed KMS key. The job fails with the error shown. What is the most likely cause?

Exhibit

Refer to the exhibit. A security analyst is reviewing CloudTrail logs and notices a PutObject event to the 'company-data-lake' bucket. The bucket policy requires all objects to be encrypted with SSE-KMS. What should the analyst conclude?

Exhibit

A company is using Amazon Redshift Spectrum to query data in Amazon S3. The S3 bucket uses SSE-KMS encryption. The Redshift cluster has an IAM role that allows access to S3 and KMS. However, queries fail with an 'Access Denied' error. What is the most likely cause?

Exhibit

Exhibit

Match each AWS networking concept to its definition.

A data engineer is configuring S3 bucket policies to restrict access to a specific VPC. Which condition key should be used in the bucket policy to enforce that requests originate only from the desired VPC?

A company stores sensitive data in S3 and uses VPC endpoints to access the bucket. They need to ensure that only traffic from their VPC can access the data, and that the traffic cannot leave the AWS network. Which combination of bucket policy and endpoint policy should they use?

A data engineer needs to ensure that an S3 bucket is not publicly accessible. Which S3 block public access setting should be applied to achieve this?

A data engineer is designing a data pipeline that processes PII data in AWS Glue. They need to ensure data is encrypted at rest and in transit. Which TWO actions should they take? (Choose TWO.)

Refer to the exhibit. A data engineer attached this S3 bucket policy to the bucket 'example-bucket'. What is the effect of this policy?

Exhibit

Refer to the exhibit. The exhibit shows output from AWS CLI commands. Which key can be used to enable automatic annual rotation?

Refer to the exhibit. An IAM policy includes this statement. What access does it grant?

Exhibit

Track your progress over time

Start a Data Security and Governance only practice session

Related DEA-C01 topic practice pages

Data Ingestion and Transformation practice questions

Data Operations and Support practice questions