4.0 Data Security and Governance DEA-C01 Practice Quiz
90 exam-style questions covering 18% of the DEA-C01 exam. Instant feedback on every answer, progress tracking, no signup required.
This domain is part of the AWS Certified Data Engineer Associate practice test. Each question is tagged by exam objective and difficulty so you can drill exactly the areas you need.
Sample Questions
A Glue job running in a VPC must connect to an Amazon RDS source on port 5432. Which security control should allow the connection?
- A. A security group rule that allows the Glue job security group to reach the RDS security group on port 5432
- B. VPC security groups
- C. AWS Trusted Advisor
- D. AWS Encryption SDK
Security groups can reference other security groups, allowing only the Glue job's network interfaces to reach the database on the required port. This is the correct answer.
A group of analysts needs the same read-only access to curated datasets. Which IAM structure helps manage the users?
- A. An IAM group with a read-only policy for the required resources
- B. Amazon GuardDuty
- C. AWS Resource Access Manager (RAM)
- D. AWS Organizations
An IAM group centralizes permissions for users with the same job function and simplifies updates to analyst access. This is the correct answer.
A Redshift cluster should accept connections only from a private analytics subnet. What should be updated?
- A. AWS Audit Manager
- B. The Redshift security group inbound rules
- C. AWS CloudHSM
- D. Network ACLs
Inbound security group rules control which sources can connect to the Redshift endpoint, so restricting them to the analytics subnet limits database access. This is the correct answer.
A Glue job must access S3 and the Data Catalog without static credentials. What IAM identity should be assigned?
- A. AWS Lake Formation tag-based access
- B. An IAM role for the Glue job
- C. AWS Glue Data Catalog
- D. AWS Signer
A Glue job assumes an IAM role at runtime, receiving temporary credentials for the S3 and Data Catalog operations it needs. This is the correct answer.
A long-term access key used by an ingestion script was exposed. What should happen first?
- A. AWS Lake Formation tag-based access
- B. Deactivate or rotate the exposed credential and review recent usage
- C. AWS IAM policies
- D. AWS Glue
An exposed credential must be made unusable quickly, then logs should be reviewed to determine whether it was misused. This is the correct answer.
A pipeline can no longer reach a private database after a security group cleanup. What should the engineer check?
- A. VPC security groups
- B. AWS Resource Access Manager (RAM)
- C. Whether the database port is still allowed between the pipeline and database security groups
- D. AWS Audit Manager
A removed or changed security group rule can block the database listener port even when routes and credentials are correct. This is the correct answer.
A private workload should call supported AWS services without using public internet paths. What should be configured?
- A. AWS CloudTrail
- B. AWS Secrets Manager
- C. VPC endpoints with appropriate endpoint policies
- D. Network ACLs
VPC endpoints provide private connectivity to supported AWS services, and endpoint policies can limit which service actions are allowed. This is the correct answer.
A data processing task should not allow unrestricted outbound access. What security group practice helps?
- A. Amazon EMR
- B. AWS CloudTrail Lake
- C. AWS CloudTrail
- D. Restrict egress rules to required destinations and ports
Restricting egress narrows where the workload can send traffic, reducing exposure if the processing task is compromised. This is the correct answer.
Key Terms in This Domain
- S3 Access Points: Named network endpoints with their own access policies for S3 buckets
- AWS Lake Formation: Build, secure, and govern data lakes with fine-grained access
- Amazon S3 Lifecycle policies: Automate object transitions and expiration for cost control
- IAM roles: Temporary-credential identities assumed by services or users
- IAM policies: JSON documents that grant or deny permissions on resources
- AWS KMS: Managed key management for encryption at rest and in transit
- AWS CloudTrail: Audit log of AWS API activity for governance
- AWS CloudTrail Lake: Managed audit-data lake for centralized event queries
- AWS Glue Data Catalog: Central technical metadata catalog for data lakes
- Amazon SageMaker AI: End-to-end platform to build, train, and deploy ML models
Link to this quiz
Studying with a group or teaching a class? Send this address or paste the link into your notes, wiki, or course page:
https://quizbuffet.com/aws-data-engineer-associate/data-security-and-governance/
<a href="https://quizbuffet.com/aws-data-engineer-associate/data-security-and-governance/">AWS Data Engineer Associate Data Security and Governance practice quiz on QuizBuffet</a>
Other DEA-C01 Domains
← Back to DEA-C01 practice test overview
Questions are written against the published DEA-C01 objectives and checked for accuracy and balance before they go live. How QuizBuffet writes and reviews its questions.