Data Security and Governance

Applying authentication and authorization mechanisms, ensuring data encryption and masking, preparing audit logs, and understanding data privacy and governance on AWS.

5 minutes 5 Questions

Data Security and Governance in AWS is a critical domain for the AWS Certified Data Engineer - Associate exam, encompassing the practices, tools, and strategies used to protect data assets and ensure compliance throughout the data lifecycle. **Data Security** involves protecting data at rest and i…

Concepts covered
VPC Security Groups and Network ConfigurationData Masking and Anonymization for ComplianceCredential Management with Secrets ManagerCustom IAM Policies and Least PrivilegeLake Formation Permissions ManagementData Encryption with AWS KMSPII Identification with Amazon MacieData Governance Frameworks and Sharing PatternsIAM Roles, Groups, and Policies for Data AccessS3 Access Points and AWS PrivateLinkDatabase User Access and Role ManagementTag-Based and Attribute-Based Access ControlEncryption in Transit and Cross-Account EncryptionCloudTrail Lake and Centralized Audit LoggingData Privacy, Sovereignty, and Region Restrictions
Test mode:
Start practice test

AWS DEA-C01 - Data Security and Governance Example Questions

Test your knowledge of Data Security and Governance

Question 1

Which combination of IAM policy elements must be defined to construct a valid custom IAM policy statement that enforces least privilege?

Correct Answer: Effect, Action, and Resource elements together define the scope of permissions granted or denied

A valid IAM policy statement requires at minimum the Effect (Allow or Deny), Action (which API operations), and Resource (which AWS resources) elements to properly scope permissions and enforce least privilege by specifying exactly what actions are permitted on which specific resources.

Principal and Condition are optional elements; Principal is used in resource-based policies, not identity-based policies, and Condition adds constraints but is not required. Version is a top-level policy element, not a statement-level element, and does not define authorization boundaries. The combination of Effect, Action, and Principal does not establish trust relationships; trust relationships are defined in assume role policies.

Key concept tested: required IAM policy statement elements for least privilege enforcement.

Question 2

A team creates an IAM policy for an AWS Lambda function that writes processed records to a DynamoDB table named 'SalesData'. The policy grants 'dynamodb:PutItem' and 'dynamodb:UpdateItem' actions on the resource ARN 'arn:aws:dynamodb:us-east-1:123456789012:table/*'. The function works correctly, but a security review flags the policy. What change best aligns this policy with least privilege?

Correct Answer: Narrow the resource ARN to specify only the 'SalesData' table instead of using a wildcard for all tables

Narrowing the resource ARN from a wildcard (table/*) to the specific table (table/SalesData) ensures the Lambda function can only write to the intended table, directly applying the principle of least privilege by granting access to only the required resource.

Adding a Deny statement for other actions does not address the overly broad resource scope, which is the core issue. Adding dynamodb:GetItem grants more permissions than needed, violating least privilege rather than enforcing it. Restricting by encryption status is unrelated to limiting resource scope and does not address the wildcard concern.

The key concept tested is applying least privilege by scoping IAM resource ARNs to specific resources.

Question 3

A team needs to grant three data analysts access to read objects in a specific S3 bucket. The analysts should all have the same permissions, and managing access should be simple as new analysts join. What is the most appropriate approach?

Correct Answer: Create an IAM group for the analysts and attach a policy granting S3 read access to the group

Creating an IAM group with an attached policy granting S3 read access is the most appropriate approach because it centralizes permission management, allowing new analysts to simply be added to the group and automatically inherit the correct permissions.

Using an IAM role with read and write access is wrong because the requirement is read-only access, and roles are typically assumed temporarily rather than serving as a permanent group membership mechanism. Creating individual IAM policies for each analyst is inefficient and does not scale well as new analysts join. Embedding inline policies on each user within a group defeats the purpose of using a group, as policies should be attached at the group level.

Key concept tested: IAM groups for scalable, centralized permission management.

More Data Security and Governance questions
627 questions (total)
Practice 100 questions
One session at a time, always new questions