CCNA Data Security Governance Questions

A Glue Security configuration allows you to specify a KMS key for S3 encryption, which Glue uses when reading from and writing to S3. By attaching this configuration to the job, all data access uses the specified customer-managed key, satisfying the audit requirement. This is the intended mechanism for controlling encryption in Glue jobs.

AWS CloudTrail records every KMS API call as a management event, capturing the caller identity, key ARN, timestamp and source IP. This directly satisfies the audit requirement, since KMS operations such as Encrypt, Decrypt and CreateKey are logged automatically to the account's event history and any configured trail.

AWS CloudTrail records every IAM policy change as a management event, capturing the API caller, timestamp and request parameters. Streaming those trails into Amazon CloudWatch Logs satisfies the audit requirement, enabling metric filters and alarms on specific `PutPolicy` or `CreatePolicy` calls for continuous monitoring.

A bucket policy with a `aws:SecureTransport` condition set to false denies any request made over plain HTTP, forcing all S3 API calls from the EC2 fleet to use HTTPS/TLS. This directly enforces encryption in transit for internet-based access, satisfying the stem's requirement.

SSE-KMS with a customer managed key encrypts objects at rest while the company retains control over key rotation and access policy, satisfying the requirement that keys not be AWS-managed. It also complements TLS for the in-transit requirement.

With SSE-KMS, the caller needs kms:Decrypt on the CMK in addition to S3 permissions. The bucket policy grants S3 access, but the key policy must separately authorise the analytics account's role, so its absence causes the AccessDenied failure.

The policy's condition matches the encryption context key-value pair aws:pi equal to db-123, so kms:Decrypt succeeds only for ciphertext whose encryption context includes that exact pair, binding decryption to data encrypted under the same context.

S3 Batch Operations applies a batch job that re-encrypts existing objects in place using SSE-KMS or SSE-S3, satisfying the stem's constraint of encrypting past uploads without re-uploading. It reads each object and writes it back encrypted, preserving keys and metadata.

An S3 Gateway Endpoint keeps traffic to S3 on the AWS private network, so TLS is not applied automatically. Forcing the Glue connection to use HTTPS (s3a:// with SSL enabled) encrypts data in transit, satisfying the security team's TLS requirement.

IAM Identity Center centralises workforce access across all accounts in AWS Organizations, assigning permission sets to users and groups from one place. It provides the cross-account fine-grained permissions the company needs without per-account IAM users.

SSL/TLS encryption secures data in transit between clients and the Redshift cluster, directly satisfying the requirement that all traffic be encrypted. Redshift supports SSL connections, and enabling the `require_ssl` parameter forces every client connection to use TLS, preventing unencrypted access.

Column-level permissions in Lake Formation restrict access at the individual column granularity, so the analyst can query non-PII columns while PII columns remain denied. This satisfies the stem's requirement to grant selective column access through Athena without exposing sensitive data, since Lake Formation enforces these controls centrally across integrated analytics services.

The require_SSL parameter in the Redshift cluster's parameter group enforces TLS, rejecting unencrypted client connections. Modifying it satisfies the constraint that the cluster accept only encrypted connections, whereas other parameters govern query behaviour or logging rather than transport encryption.

Specifying a customer-managed AWS KMS key at DB instance creation enables encryption at rest for the underlying storage, volumes, snapshots and read replicas, satisfying the compliance requirement. Encryption cannot be enabled retroactively on an existing unencrypted instance; it must be set at launch.

To enforce encryption in transit, the S3 bucket policy must include a condition that denies requests when aws:SecureTransport is false. This ensures that any request to the bucket, including from AWS Glue, must use TLS. AWS Glue uses HTTPS by default when accessing S3, so the policy will not block legitimate traffic but will reject unencrypted requests, satisfying the security requirement.

AWS Lake Formation supports tag-based access control, which allows you to define permissions based on tags attached to Data Catalog resources and IAM principals. By tagging tables with a Department key and assigning matching tags to users, you can grant or deny access dynamically. This meets the requirement for department-based access without managing individual table permissions.

A security group is stateful and instance-level, so allowing inbound traffic from the on-premises CIDR block restricts Redshift access to that network only, satisfying the requirement that the cluster be reachable solely via Direct Connect.

When S3 uses SSE-KMS with a customer-managed key, writing an object requires the caller to have kms:GenerateDataKey on that key, and reading requires kms:Decrypt. The Glue role has S3 permissions but no KMS permissions, so the PutObject call fails with access denied. Adding the required KMS actions on the output key resolves the failure.

Enforcing TLS for data in transit to S3 is done by adding a bucket policy that denies requests where aws:SecureTransport is false. This ensures that any request, including from Glue crawlers, must use HTTPS. Glue crawlers use the AWS SDK, which uses HTTPS by default, so they will comply. This is the standard method to enforce encryption in transit for S3.

KMS key policies are the primary access control for KMS keys. Even if an IAM policy grants kms:Decrypt and kms:GenerateDataKey, the key policy must also allow the principal to use the key. If the key policy does not explicitly grant access to the Glue job's role, access is denied. Updating the key policy to allow the role resolves the error while maintaining least privilege.

CloudTrail records the identity of the principal making each S3 data-plane API call, including the IAM user or role ARN and the source account. This satisfies the stem's need to attribute unexpected cross-account object access to a specific identity.

The s3:x-amz-server-side-encryption-aws-kms-key-id condition key inspects the KMS key ID supplied in the upload request, so the bucket policy denies any PutObject not encrypted with the specified key. This directly enforces the stem's single-key upload restriction.

The encryption context supplied during encryption is cryptographically bound to the ciphertext, so KMS requires the identical key-value pairs to authorise decryption. Omitting them causes the request to fail, satisfying the stem's constraint that the same key alone is insufficient.

An S3 bucket policy with a condition that denies requests when aws:SecureTransport is false enforces that all requests to the bucket must use TLS. This applies to AWS Glue and any other client, ensuring data in transit is encrypted. This is a standard method to enforce TLS for S3 access.

The policy's `aws:SecureTransport` condition evaluates the request protocol, so `"aws:SecureTransport": "false"` in a Deny statement blocks any non-TLS call. This satisfies the stem's requirement to enforce encryption in transit: plain HTTP `GetObject` and `PutObject` attempts are rejected, while HTTPS equivalents remain permitted.

Amazon Redshift supports encryption at rest using a hardware security module (HSM) for key management. When creating or modifying a cluster, you can enable encryption and specify an HSM connection. This meets the requirement for HSM-based encryption. The HSM must be configured with the appropriate keys and network access.

AWS CloudTrail delivers account activity events across all accounts to one centralised S3 bucket, satisfying the multi-account aggregation requirement. Its organisation trail captures management and data events from every member account, writing them to a single destination bucket, which is precisely the centralised audit-log consolidation the stem demands.

SSL/TLS encrypts the wire protocol between the application and PostgreSQL, protecting credentials and query results from interception. Enabling it on the RDS connection satisfies the requirement for encryption of data in transit rather than at rest.

Enabling SSE-S3 default encryption applies AES-256 encryption automatically to every new object with no key management, and existing unencrypted objects remain readable. This satisfies both requirements with minimal operational overhead compared with SSE-KMS or re-uploading objects.

Lake Formation requires that the S3 location be registered as a data location to manage fine-grained access. Without registration, Lake Formation cannot grant access to the underlying data, even if table permissions are granted. The analyst would need direct S3 permissions or the location must be registered.

Lake Formation supports fine-grained access control, including column-level permissions. You can grant SELECT on a subset of columns in a table. When the analyst queries via Athena, Lake Formation filters the columns, and the analyst can only see the permitted columns. This directly meets the requirement to hide PII columns while allowing access to others.

The bucket policy denies `s3:PutObject` unless the request includes the `s3:x-amz-server-side-encryption` header, so an upload without any encryption header fails the condition and is explicitly denied. Because an explicit Deny in a bucket policy overrides any IAM allow, S3 returns Access Denied.

An S3 Lifecycle policy defines expiration rules that automatically delete objects after a specified number of days, directly meeting the 30-day deletion requirement. It applies at bucket or prefix level without custom code, unlike versioning or replication, which retain data rather than remove it.

The CMK's key policy must explicitly allow the GlueETLRole to call kms:Decrypt and kms:GenerateDataKey; IAM permissions alone are insufficient because KMS authorises against both the key policy and the identity policy. Since SSE-KMS now wraps every S3 object read, the missing key policy grant produces the Access Denied failures.

Amazon Macie uses machine learning and pattern matching to discover sensitive data such as personally identifiable information across S3 buckets, satisfying the automated detection requirement. It continuously evaluates bucket inventory, assigns severity-based findings, and produces reports, directly meeting the reporting constraint without custom code or manual review.

Data Catalog operations such as CreateTable, UpdateTable, and BatchCreatePartition are management events recorded by CloudTrail. A trail that logs management events captures the caller identity and request details, and delivering to a dedicated S3 bucket with a 365-day lifecycle rule meets the retention requirement for auditors.

EncryptionConfiguration specifies SSE-S3 or SSE-KMS settings applied to the query result files Athena writes into the S3 query-result location. This satisfies the parameter's purpose: protecting results at rest in Amazon S3, not encrypting data in transit or the source data being queried.

SSL/TLS encrypts the wire protocol between the application and the RDS for MySQL endpoint, satisfying the in-transit encryption requirement. RDS MySQL supports TLS connections natively; clients negotiate certificates during the handshake, protecting credentials and query data from interception. Encryption at rest options such as KMS keys do not address data moving across the network.

The KMS key policy must name the third-party account as a principal granted kms:Decrypt, because key policies govern who may use a customer managed key. Without this grant, cross-account decryption of the S3 objects fails regardless of bucket permissions.

Secrets Manager with automatic rotation directly satisfies the credential-rotation constraint, unlike static Glue connection passwords. Enabling SSL encrypts data in transit between Glue and RDS MySQL, meeting the encryption requirement. Together these address both security mandates without custom rotation logic or manual credential updates.

Amazon Redshift supports SSL encryption for connections. To enforce encryption in transit between Glue and Redshift, the JDBC connection must use SSL. Setting sslmode=require in the JDBC URL ensures that the connection uses SSL and fails if SSL is not available. This is the standard method to encrypt data in transit for Redshift connections from Glue.

SSE-KMS requires the caller to hold kms:Decrypt on the customer-managed key before S3 can return the object. The role's S3 permissions are irrelevant here; the missing KMS grant is what blocks the ETL job's reads.

AWS CloudTrail records API activity, capturing every IAM policy change as a management event with the caller's identity, timestamp and source IP. This satisfies the audit requirement by providing an immutable, queryable log of who modified which policy and when, which CloudWatch metrics or Config rules alone cannot deliver.

Lake Formation supports column-level security by allowing you to grant or deny access to specific columns within a table. When granting SELECT on a table, you can exclude sensitive columns, ensuring the analyst can query only approved columns. This directly meets the requirement without duplicating data.

CloudTrail records all API activity for auditing.

Lake Formation tag-based access control (LF-TBAC) allows you to attach LF-Tags to databases, tables, and columns, and then grant permissions based on those tags. By tagging sensitive columns and granting access only to the steward role, all other users are denied access to those columns by default. This satisfies the requirement to mask by default while allowing the steward full access.

SSE-S3 applies AES-256 encryption with keys fully managed and rotated by AWS, requiring no key configuration from the engineer. It satisfies the data-at-rest encryption requirement for S3 objects while removing customer key management overhead entirely.

Attaching an IAM role to the cluster provides temporary credentials that Redshift assumes automatically, so no long-term keys appear in SQL. Granting s3:GetObject and kms:Decrypt allows the COPY to read SSE-KMS encrypted objects. Because the role is attached to the cluster, deleting the cluster removes the role association, satisfying automatic revocation.

Redshift dynamic data masking policies are attached to roles and applied automatically whenever a user in that role queries the column, so no SQL changes are required. The fraud team, not attached to the masking policy, continues to see full values. This satisfies both the blanket masking requirement and role-based visibility in a single column-level control.

Restricting the Resource element to the specific KMS key ARN satisfies the least-privilege constraint, since AWS evaluates the Resource field against the key's ARN during the kms:Decrypt authorisation call. The Glue job's IAM role then decrypts only data encrypted under that customer-managed key, eliminating access to every other key in the account.

The `secretsmanager:RotateSecret` action authorises triggering immediate rotation of a stored secret, satisfying the requirement to rotate the RDS credential. It differs from `PutSecretValue`, which merely writes a new value without invoking the rotation Lambda, and from `UpdateSecret`, which modifies metadata or encryption rather than performing rotation.

AWS KMS centrally creates, rotates and controls the customer-managed keys used for S3 server-side encryption (SSE-KMS), satisfying the encryption-at-rest requirement. KMS also provides audit trails of key usage through CloudTrail, giving the key management capability the scenario demands.

Lake Formation integrates with SAML and SCIM identity providers, so permissions granted to an external group propagate to its members without per-user grants. This satisfies the stem's requirement for valid access-granting methods, alongside IAM principals and tag-based LF-TBAC grants, reducing administrative overhead.

AWS CloudTrail records DeleteCluster API calls, capturing the identity, source IP and timestamp of the deletion. This event history lets the engineer confirm whether the cluster was deleted, by whom, and when, which CloudWatch metrics or cluster logs alone cannot establish.

The Glue job assumes an IAM role to access AWS services. Even if the KMS key policy grants access, the IAM role must also have explicit permissions for kms:Decrypt and kms:GenerateDataKey to use the key for reading and writing encrypted data. Without these IAM permissions, the job cannot decrypt source objects or generate data keys for encryption, resulting in access denied.

Using SSE-KMS with a customer-managed key ensures data at rest is encrypted with that key, and CloudTrail logs all KMS API calls, providing an audit trail of key usage. This directly meets the encryption and auditing requirements. The Glue job will automatically use the key when reading and writing if permissions are granted.

Cross-account SSE-KMS access requires both the S3 bucket policy and the KMS key policy to permit the target account. Because the key is customer managed, its key policy must explicitly grant the other account kms:Decrypt, otherwise S3 cannot unwrap the data key for that account's requests.

Lake Formation uses a permission model that requires the principal to have no direct IAM access to the underlying S3 data. If the analyst has IAM permissions to read the S3 bucket, they can bypass Lake Formation's column-level restrictions and access all data directly. To enforce Lake Formation permissions, the analyst's IAM policy must not allow direct S3 access, and all access should go through Lake Formation-enabled services.

SSEAlgorithm AES256 indicates server-side encryption with Amazon S3-managed keys (SSE-S3), where S3 owns and rotates the AES-256 keys. This satisfies the stem's observed output directly: SSE-KMS would report aws:kms, and SSE-C would not appear as a bucket default algorithm.

The CloudTrail record shows the PutObject request carried the x-amz-server-side-encryption header set to aws:kms, confirming the object was written using SSE-KMS rather than SSE-S3 or SSE-C. This satisfies the investigation's need to identify the encryption mechanism applied to sensitive.csv at upload time.

SSE-KMS encrypts objects with a KMS key, and decryption requires kms:Decrypt permission on that key. This satisfies the requirement for team-managed keys and explicit decrypt authorisation, unlike SSE-S3 where AWS owns the key and access is governed solely by S3 permissions.

Enforcing HTTPS via bucket policy satisfies the in-transit encryption mandate, while default SSE-S3 provides AES-256 server-side encryption at rest without key management overhead. S3 Inventory delivers scheduled CSV or Parquet reports of all objects and their metadata, meeting the compliance inventory requirement. Together these three controls cover every stated constraint.

S3 Object Lock in COMPLIANCE mode enforces a WORM retention period that no user, including the root account, can shorten or bypass, directly satisfying the requirement that objects cannot be deleted or overwritten for 7 years. GOVERNANCE mode would permit privileged users to alter retention, so it fails this constraint.

AWS Glue integrates with Secrets Manager through the connection's secretId property, letting the job fetch credentials at runtime. Granting secretsmanager:GetSecretValue scoped to the specific secret ARN provides least-privilege access. This avoids embedding plaintext credentials in scripts or job parameters while giving the job the password it needs.

Dynamic data masking in Amazon Redshift applies masking policies at query time, so PII columns return redacted values without altering stored data. Attaching these policies to roles satisfies GDPR's data-minimisation requirement, and unlike views, masking persists across all queries against the table, including ad-hoc analyst access.

SSE-KMS encrypts objects with a KMS key, so s3:GetObject alone is insufficient: S3 must call KMS to unwrap the data key on the caller's behalf. The role therefore needs kms:Decrypt on that key, satisfying the stem's requirement to read the SSE-KMS-encrypted objects.

Lake Formation data filters allow column-level and row-level security. Granting SELECT on the table with a data filter that specifies the allowed columns and a row filter expression restricts the analyst to only the permitted columns and rows. This meets the requirement precisely without granting broader access.

Granting the partner account kms:Decrypt in the KMS key policy satisfies the stem's requirement that cross-account readers decrypt SSE-KMS objects. S3 bucket policies alone cannot authorise key usage; the customer-managed key's policy must separately permit the partner principal, since KMS enforces its own authorisation independently of S3.

A bucket policy with a Deny effect on s3:PutObject can evaluate conditions on request headers such as s3:x-amz-server-side-encryption and s3:x-amz-server-side-encryption-aws-kms-key-id. This explicitly blocks uploads that do not use the required encryption method and key. This is the only option that enforces rejection of non-compliant uploads at the bucket level, satisfying the requirement.

AWS CloudTrail records S3 API activity, including object-level data events when enabled, capturing who accessed sensitive objects and when. It satisfies the regulation by providing an auditable log of all access requests to the bucket.

The permissions dataset must map each user or group to specific Department values; if its columns or entries are malformed, QuickSight applies no matching rule and defaults to showing all rows. Correctly mapping users to department values satisfies the stem's requirement that each user sees only their own department's data.

AWS Glue jobs run with an IAM role that the service assumes on your behalf, and the AWS SDK and Glue runtime retrieve temporary credentials automatically. No access keys are created or stored, and permissions are governed by the role's policies. This is the standard, secure way to grant a Glue job access to S3.

AWS Config rules continuously evaluate S3 bucket encryption against your desired configuration and can trigger automatic remediation, such as invoking a Systems Manager automation to enable default encryption. This satisfies the requirement to remediate non-compliant buckets automatically, rather than merely detecting or reporting drift.

SSE-KMS requires both kms:Decrypt to read encrypted objects and kms:GenerateDataKey to obtain a data key for writing. Granting these two actions on the key resource satisfies the stem's read-and-write requirement, since Glue cannot access KMS-encrypted S3 data with either permission missing.

The aws:SourceVpc condition key only matches when the request arrives through a VPC endpoint. A typo or wrong VPC ID in that condition lets external IP addresses bypass the intended restriction, so verify it first.