Data Security and Governance — DEA-C01 Practice Quiz

Question 1

A data engineering team runs ad hoc Athena queries against a data lake containing regulated financial data. A compliance requirement states that all Athena query result sets written to Amazon S3 must be encrypted with a customer-managed KMS key, and this encryption must be enforced consistently for every analyst regardless of individual query settings. What is the most effective way to satisfy this requirement?

Accepted Answer

Configure the Athena workgroup's result configuration to use SSE-KMS with the customer-managed key and enable the setting that overrides client-side result configuration.

Answer

Attach an S3 bucket policy to the query results bucket that denies any PutObject request, forcing analysts to encrypt manually before writing.

Answer

Instruct each analyst to select the customer-managed KMS key in the Athena console encryption settings before running queries.

Answer

Enable default SSE-S3 encryption on the query results bucket so all objects are automatically encrypted at rest.

Question 2

A financial services company must produce an audit trail showing every individual GetObject and PutObject API call made against a specific S3 bucket that stores regulated customer data. Their existing CloudTrail trail already captures management events across all regions, but auditors report they cannot see object-level read and write activity for the bucket. What is the most appropriate way to meet this requirement?

Accepted Answer

Configure CloudTrail data events for the S3 bucket to log object-level (S3 data plane) API activity.

Answer

Enable S3 server access logging on the bucket and deliver logs to a separate logging bucket.

Answer

Enable S3 Event Notifications to send object create and delete events to an SQS queue for review.

Answer

Turn on CloudTrail Insights events on the existing trail to detect unusual API call rates.

Question 3

A financial services company runs a data lake on Amazon S3 governed by AWS Lake Formation, with the Glue Data Catalog holding table definitions. Compliance auditors require a complete, queryable record of every user and role that has read specific sensitive tables, including which columns were accessed and when. The data engineering team needs to enable this auditing with the least custom development. Which approach satisfies the requirement?

Accepted Answer

Enable AWS CloudTrail data events and rely on Lake Formation's integration to log GetDataAccess and related events, then query the CloudTrail logs (or use Lake Formation's audit query capability) to review who accessed which tables and columns.

Answer

Turn on S3 server access logging on the data lake buckets and parse the logs with Athena to determine which principals read each object.

Answer

Enable Glue Data Catalog encryption with KMS and review KMS key usage in CloudTrail to identify who decrypted the catalog metadata.

Answer

Configure Amazon Macie to scan the data lake and generate findings whenever sensitive data is accessed by a principal.

Question 4

A data engineering team stores JDBC connection definitions in the AWS Glue Data Catalog to allow Glue jobs to reach an on-premises database. A security audit requires that the database credentials embedded in these connections not be stored in plaintext within Glue, and that any encryption keys be centrally managed and auditable. Which action best satisfies this requirement?

Accepted Answer

Enable connection password encryption in the Glue Data Catalog settings using a customer managed AWS KMS key

Answer

Enable server-side encryption on the S3 bucket that stores Glue job scripts using SSE-S3

Answer

Attach an IAM policy to the Glue job role that denies read access to the connection object

Answer

Store the connection credentials in a Glue job argument passed at runtime and enable job bookmarks

Question 5

A company runs a central Glue Data Catalog in a shared services account. A data science team in a separate AWS account needs to run Athena queries against several databases and tables registered in that central catalog. The security team requires that access be granted at the Data Catalog level without duplicating table definitions and without using Lake Formation. Which approach should the data engineer implement to enable the cross-account access?

Accepted Answer

Attach a Glue Data Catalog resource policy in the shared services account granting the data science account glue:GetDatabase and glue:GetTable actions, and grant matching IAM permissions in the consumer account.

Answer

Enable a Glue crawler in the data science account that points at the shared services account's S3 buckets to recreate the table definitions locally.

Answer

Create an S3 bucket policy on the underlying data buckets that grants the data science account read access, which automatically shares the catalog metadata.

Answer

Export the databases from the central catalog and import them into a new Glue Data Catalog in the data science account using AWS Backup.

Question 6

A financial services company allows senior data engineers to create IAM roles for their own Glue jobs and Lambda functions. The security team is concerned that engineers could create roles with broader permissions than intended (for example, granting full S3 or KMS access to production buckets). The team wants to guarantee that any role an engineer creates can never exceed a defined maximum set of permissions, regardless of the policies the engineer attaches. Which approach meets this requirement?

Accepted Answer

Attach a permissions boundary to the engineers' IAM roles that constrains the maximum permissions of any roles they create, and require the boundary to be attached to newly created roles

Answer

Attach a resource-based S3 bucket policy that denies access to any role created by the data engineers

Answer

Enable IAM Access Analyzer to automatically remove excessive permissions from roles the engineers create

Answer

Grant the engineers only the iam:CreateRole permission and rely on the least-privilege default of new roles

Question 7

A data engineering team runs a pipeline that streams financial transaction records from an on-premises system into an Amazon Kinesis Data Stream, then delivers them to Amazon S3 via Amazon Data Firehose. Compliance requires that the data be encrypted both in transit and at rest throughout the pipeline, and that all encryption keys be centrally managed and auditable. Which combination of measures satisfies these requirements with the least custom code?

Accepted Answer

Use HTTPS/TLS endpoints for all API calls, enable server-side encryption on the Kinesis Data Stream with an AWS KMS customer managed key, and configure Firehose to encrypt the S3 destination with a KMS customer managed key.

Answer

Encrypt records in the on-premises application using a custom AES routine before sending them, and store the encryption key in the application's config file so no AWS KMS integration is needed.

Answer

Rely on the default S3 SSE-S3 encryption for data at rest and disable TLS on the Kinesis endpoints to reduce latency, since VPC traffic is already isolated.

Answer

Enable server-side encryption only on the final S3 bucket with an AWS managed key, and allow Kinesis and Firehose to transmit data unencrypted because the pipeline stays within AWS.

Question 8

A data engineering team runs a Glue ETL job under an IAM role that must decrypt objects in an S3 bucket encrypted with a customer managed KMS key. The KMS key is owned by a separate security team who manages the key policy centrally and refuses to add every new consumer role directly into the key policy. The security team wants to allow the Glue role to perform decrypt operations while retaining full control over the key and enabling the permission to be revoked programmatically at any time without editing the key policy. Which approach best meets these requirements?

Accepted Answer

Create a KMS grant on the key that permits the Glue role the Decrypt and GenerateDataKey operations, and revoke the grant when access is no longer needed.

Answer

Add the Glue role's ARN as a principal in the KMS key policy with kms:Decrypt permission.

Answer

Attach an IAM policy to the Glue role granting kms:Decrypt on the key, with no changes to the key policy.

Answer

Enable automatic key rotation on the KMS key so the Glue role inherits decrypt access on each rotation.

Question 9

A data engineering team ingests customer records into an S3-based data lake. A compliance auditor requires that the data be protected both while moving between the on-premises source and AWS, and while stored in S3, using customer-managed keys where feasible. The team currently uploads files over the public internet using the AWS CLI with default S3 settings. Which combination of actions BEST satisfies both the in-transit and at-rest encryption requirements?

Accepted Answer

Enable S3 default encryption with SSE-KMS using a customer-managed CMK, and rely on HTTPS (TLS) endpoints for the CLI uploads to encrypt data in transit.

Answer

Enable S3 default encryption with SSE-S3, and add a bucket policy that denies any request where aws:SecureTransport is false.

Answer

Enable S3 Object Lock in compliance mode and use the CLI with default settings, since Object Lock encrypts data at rest and in transit.

Answer

Encrypt files locally with a static passphrase before upload and store them in an unencrypted S3 bucket accessed over HTTP.

Question 10

A data engineering team in Account A runs a Glue job that must read Parquet files stored in an S3 bucket owned by Account B. The objects in Account B are encrypted with a customer-managed KMS key (also in Account B). The bucket policy already grants Account A's Glue role s3:GetObject. However, the Glue job fails with an AccessDenied error when attempting to decrypt objects. What is the MOST appropriate action to resolve this while following least-privilege principles?

Accepted Answer

Add a statement to the KMS key policy in Account B that grants the Glue role in Account A kms:Decrypt permission, and attach an IAM policy in Account A allowing the Glue role kms:Decrypt on that key ARN.

Answer

Change the S3 objects in Account B to use SSE-S3 (Amazon S3-managed keys) instead of SSE-KMS so no key permissions are needed.

Answer

Grant the Glue role in Account A full administrative access to KMS by attaching the AWS managed AWSKeyManagementServicePowerUser policy.

Answer

Copy the KMS key from Account B into Account A and re-encrypt all objects so the Glue role can use a local key.

Question 11

A data engineering team stores sensitive customer records in an S3 bucket encrypted with a customer managed AWS KMS key (SSE-KMS). A new compliance mandate requires that the encryption key material be rotated automatically every year and that all decryption operations against the key be logged for audit purposes. The team must implement this with the least operational overhead. Which combination of actions meets these requirements?

Accepted Answer

Enable automatic key rotation on the customer managed KMS key and use AWS CloudTrail to capture KMS API events such as Decrypt and GenerateDataKey.

Answer

Manually create a new KMS key each year, re-encrypt all objects, and query the KMS key metadata through the AWS CLI to review usage.

Answer

Switch the bucket to SSE-S3 (Amazon S3 managed keys) and enable S3 server access logging to capture encryption activity.

Answer

Enable automatic key rotation on an AWS managed KMS key and rely on Amazon Macie to log all decryption calls.

Question 12

A data engineering team stores encrypted datasets in an S3 bucket in us-east-1 using SSE-KMS with a customer managed key. To meet disaster recovery requirements, they configure S3 Cross-Region Replication to a destination bucket in eu-west-1. After enabling replication, they notice that objects encrypted with the customer managed key fail to replicate, while unencrypted objects replicate successfully. What must the team do to enable replication of the KMS-encrypted objects?

Accepted Answer

Enable replication of SSE-KMS encrypted objects in the replication configuration and specify a destination KMS key in eu-west-1, granting the replication IAM role permission to decrypt with the source key and encrypt with the destination key

Answer

Change the source bucket encryption to SSE-S3 because SSE-KMS encrypted objects cannot be replicated across Regions

Answer

Enable S3 Bucket Keys on the destination bucket, which automatically allows the replication role to reuse the source Region KMS key across Regions

Answer

Create a multi-Region KMS key and manually re-upload all objects, since replication does not support any form of KMS encryption

Question 13

A data engineering team manages a central data lake in a producer AWS account, governed by AWS Lake Formation with the Glue Data Catalog. An analytics team in a separate consumer AWS account needs read access to a specific database and several tables in the producer's catalog. The producer team wants to grant access without copying data and while retaining fine-grained control over which tables the consumer can query. What is the recommended approach to enable this cross-account access?

Accepted Answer

Grant Lake Formation permissions on the database and tables to the consumer account, which shares the resources via AWS Resource Access Manager (RAM), then have the consumer accept the invitation and create resource links.

Answer

Copy the underlying S3 data to a bucket in the consumer account and run a Glue crawler there to recreate the catalog tables.

Answer

Attach an S3 bucket policy in the producer account granting the consumer account's IAM roles direct s3:GetObject access to the data lake bucket.

Answer

Create an IAM role in the producer account with catalog read permissions and have all consumer users assume that role for every query.

Question 14

A healthcare company stores patient records in an S3 data lake governed by AWS Lake Formation and cataloged in the Glue Data Catalog. Analysts in the research team must be able to query the patients table, but they should only see rows where the consent_flag column equals 'true', and they must not see the ssn or full_name columns. Compliance requires that this restriction be enforced centrally without duplicating or transforming the underlying data. What is the MOST efficient way to meet these requirements?

Accepted Answer

Create a Lake Formation data filter that combines a row-level filter expression on consent_flag with column-level exclusion of ssn and full_name, then grant SELECT on the table to the research role using that filter.

Answer

Create a Glue ETL job that writes a filtered and column-pruned copy of the table to a separate S3 prefix and grant the research role access only to that prefix.

Answer

Attach an IAM policy to the research role that denies s3:GetObject on the objects containing ssn and full_name values.

Answer

Enable Redshift dynamic data masking on the patients table so ssn and full_name are masked for the research role.

Question 15

A data engineering team manages a data lake where table metadata is stored in the AWS Glue Data Catalog and underlying files reside in an S3 bucket. They have enabled Lake Formation and granted a business analyst SELECT permission on a specific table through Lake Formation. However, the analyst still cannot query the table in Amazon Athena and receives an access denied error. Upon investigation, the engineer finds that the analyst's IAM identity has no S3 permissions and no Glue permissions attached directly. What is the MOST likely cause of the access failure?

Accepted Answer

The analyst's IAM identity lacks the baseline Lake Formation and Athena API permissions (such as lakeformation:GetDataAccess and athena:StartQueryExecution) needed to invoke the services, even though the data-level SELECT grant exists.

Answer

Lake Formation SELECT permissions require the analyst to also have a direct S3 bucket policy granting GetObject on the data location.

Answer

The Glue Data Catalog table must have its encryption disabled before Lake Formation grants can take effect.

Answer

Lake Formation cannot govern tables that are queried through Athena, so the grant is ignored entirely.

Question 16

A data engineer uses AWS Lake Formation with tag-based access control (LF-TBAC). They assign the LF-Tag 'Classification=Confidential' to a database named 'finance_db'. The database contains 40 tables, none of which have any LF-Tags directly assigned to them. An analyst is granted SELECT permission on resources matching the LF-Tag expression 'Classification=Confidential'. What access will the analyst have to the tables in 'finance_db'?

Accepted Answer

The analyst can query all 40 tables, because LF-Tags assigned to a database are inherited by all tables within it unless a table overrides the tag.

Answer

The analyst cannot query any tables, because LF-Tags must be assigned directly to each table for permissions to apply.

Answer

The analyst can query the tables only after an IAM policy is attached granting explicit s3:GetObject on the underlying data.

Answer

The analyst can query only the database metadata, not the table data, until a data filter is created for each table.

Question 17

A data engineering team manages a data lake registered with AWS Lake Formation. A compliance auditor needs a complete, centralized record of every principal that has queried or accessed data lake tables and columns over the past 90 days, including which specific columns were read. The team wants to enable this auditing with minimal custom development. Which approach meets the requirement?

Accepted Answer

Enable AWS CloudTrail data events and rely on Lake Formation to log data access events, then query the CloudTrail logs to review principal-level access to tables and columns.

Answer

Enable S3 server access logging on the underlying data lake buckets and parse the logs to determine which IAM users accessed which objects.

Answer

Turn on Amazon Macie on the data lake buckets to continuously classify data and produce access reports for each principal.

Answer

Configure Glue Data Catalog crawlers to run daily and capture a history of who queried each table in the crawler run logs.

Question 18

A data engineer registers a new S3 data lake location with AWS Lake Formation and creates several databases and tables in the Glue Data Catalog. The team wants Lake Formation permissions to be the sole mechanism controlling access to these tables. However, after granting fine-grained SELECT permissions to specific analyst roles, they discover that IAM principals with broad Glue and S3 permissions can still access the tables directly. What is the root cause and correct fix?

Accepted Answer

The IAMAllowedPrincipals group still has Super permission on the databases and tables; revoke it so only explicit Lake Formation grants apply.

Answer

Lake Formation cannot govern Glue Catalog tables unless a resource link is created; create resource links for each table.

Answer

The S3 bucket policy is overriding Lake Formation; remove all S3 bucket policies to let Lake Formation take effect.

Answer

KMS key policies are granting access; update the CMK policy to deny the analyst roles direct decrypt access.

Question 19

A data engineering team manages a central data lake registered in AWS Lake Formation. A compliance auditor needs read-only access to the customer_transactions table, but must NOT be able to see the ssn or credit_card_number columns. The team wants a solution that avoids creating duplicate masked tables and can be reused for other auditors added later. Which approach best meets these requirements?

Accepted Answer

Grant the auditor SELECT permission on the table in Lake Formation using a column-level data filter that excludes the ssn and credit_card_number columns.

Answer

Create an IAM policy that denies s3:GetObject on the underlying S3 objects containing the sensitive columns and attach it to the auditor's role.

Answer

Build a Glue ETL job that copies the table into a new table with the sensitive columns removed, and grant the auditor access to the copy.

Answer

Enable server-side encryption with KMS on the table's S3 location and withhold the KMS key permissions from the auditor.

Question 20

A data engineer grants a data analyst SELECT permission on a Glue Data Catalog table using AWS Lake Formation. The underlying data is stored in an S3 location that Lake Formation manages (the S3 location is registered with Lake Formation). When the analyst runs an Athena query against the table, the query fails with an access-denied error on the S3 objects, even though Lake Formation shows the SELECT grant. The analyst's IAM role has no direct S3 bucket policy or IAM permission granting access to the S3 path. What is the correct explanation and fix?

Accepted Answer

The S3 location must be registered with Lake Formation using a service role, allowing Lake Formation to vend temporary credentials so the analyst does not need direct S3 IAM permissions; verify the location registration and that Lake Formation credential vending is being used.

Answer

Lake Formation permissions never control S3 object access, so the analyst's IAM role must always be granted explicit s3:GetObject permissions on the bucket path in addition to the Lake Formation SELECT grant.

Answer

The analyst needs a KMS key policy update because Lake Formation cannot decrypt the S3 objects on the analyst's behalf under any circumstances.

Answer

SELECT permission in Lake Formation only applies to metadata in the Glue Data Catalog; a separate Lake Formation DATA_LOCATION_ACCESS grant on the S3 path is required for the analyst to read the objects.

More DEA-C01 practice