Data Security and Governance — AWS Data Engineer Associate practice questions

Which is the RECOMMENDED way to share cross-account data lake resources?

1. A daily Glue export job replicating tables into the recipient account
2. AWS Resource Access Manager with Lake Formation cross-account permissions
3. An S3 bucket policy setting the recipient account as principal on the raw bucket
4. A signed URL emailed to the recipient team on every ETL job success

Answer: B — AWS Resource Access Manager with Lake Formation cross-account permissions

B) RAM plus Lake Formation cross-account permissions is the recommended, fine-grained pattern. A) Copy-based sharing loses lineage and doubles cost. C) Raw bucket sharing bypasses LF governance. D) Signed URLs do not scale to catalog sharing.

Which action activates Lake Formation control over a Glue database?

1. Enabling S3 Object Lock on the underlying bucket for the database
2. Attaching an IAM identity policy granting glue:GetTable to analysts
3. Registering the S3 location and granting via Lake Formation permissions
4. Enabling Macie sensitive-data classifiers on the bucket prefix

Answer: C — Registering the S3 location and granting via Lake Formation permissions

A) Object Lock is retention, not access control. C) Lake Formation manages access only after the S3 location is registered and permissions are granted via LF instead of raw IAM. B) IAM glue:GetTable bypasses LF filters. D) Macie discovers PII but does not enforce access.

Which is TRUE about IAM Access Analyzer findings for a data lake?

1. It automatically remediates over-permissive bucket policies without any approval step
2. It reports S3 resources that can be accessed from outside the account or organization
3. It replaces S3 Storage Lens dashboards as the primary usage analytics tool
4. It requires CloudTrail Lake to be enabled with 90 days of retained data first

Answer: B — It reports S3 resources that can be accessed from outside the account or organization

B) IAM Access Analyzer inspects resource policies and flags external access — the primary use for lake buckets. A) It reports; it does not auto-remediate. C) Access Analyzer is distinct from Storage Lens. D) It has no CloudTrail Lake dependency.

Which is TRUE about applying least privilege to data-engineering IAM roles?

1. Skip IAM entirely and rely on network ACLs to constrain who can call APIs across accounts
2. Grant full wildcards to all data engineers because auditing is easier with fewer policies to review
3. Scope role permissions to specific service actions and resources, and use permission boundaries as guardrails
4. Attach AdministratorAccess to every role so on-call engineers can respond quickly anywhere

Answer: C — Scope role permissions to specific service actions and resources, and use permission boundaries as guardrails

C) Standard least-privilege pattern: scoped actions on scoped resources, permission boundaries as ceilings. B) Wildcard grants are the opposite of least privilege. A) Network ACLs do not authorize API calls. D) AdministratorAccess is the highest-risk grant.

Which is TRUE about VPC endpoints for S3?

1. Gateway endpoints keep S3 traffic on the AWS backbone and support bucket-policy conditions
2. Interface endpoints for S3 are the only supported mode and use public IPs by default
3. Gateway endpoints require an internet gateway attached to the subnet route table
4. VPC endpoints for S3 replace IAM permissions on the buckets they route to

Answer: A — Gateway endpoints keep S3 traffic on the AWS backbone and support bucket-policy conditions

A) S3 gateway endpoints keep traffic on the AWS backbone and enable aws:sourceVpce policy conditions. B) Both gateway and interface endpoints exist; gateway is the classic mode. C) Gateway endpoints avoid needing an IGW. D) Endpoints do not replace IAM.

Which encryption approach fits a Redshift cluster storing regulated PII?

1. AES-256 with an AWS-owned KMS key managed transparently by Redshift
2. Client-side encryption performed inside each ELT script before COPY runs
3. AES-256 with a customer-managed KMS key and CloudTrail data events
4. Column-level encryption disabled to accelerate queries on large tables

Answer: C — AES-256 with a customer-managed KMS key and CloudTrail data events

A) An AWS-owned key gives no audit or rotation control. C) A customer-managed KMS key plus CloudTrail data-event logging supports rotation and audit — the compliance pattern. B) Client-side encryption breaks Redshift's query engine — it cannot filter encrypted values. D) Disabling encryption is the opposite of the requirement.

Which is the BEST way to secure Athena query results?

1. A DynamoDB table storing query results and readable by every analyst
2. A shared S3 bucket for all workgroups with public read enabled for convenience
3. A workgroup-scoped S3 result location encrypted with SSE-KMS and access-logged
4. A CloudFront distribution serving the results without any origin authentication

Answer: C — A workgroup-scoped S3 result location encrypted with SSE-KMS and access-logged

C) Per-workgroup, encrypted, access-logged result buckets are the recommended pattern. B) Public buckets are a critical anti-pattern. A) Athena writes to S3, not DynamoDB. D) No-auth CloudFront exposes results.

Which BEST protects secrets used by a Glue job such as database passwords?

1. A DynamoDB table with the secret readable by every IAM role for simplicity
2. Environment variables in the Glue job containing the raw plaintext password
3. A public S3 object holding the secret file for portability across accounts
4. AWS Secrets Manager referenced from Glue job parameters, rotated on a schedule

Answer: D — AWS Secrets Manager referenced from Glue job parameters, rotated on a schedule

D) Secrets Manager with automatic rotation is the standard; Glue jobs fetch by ARN. B) Plaintext env vars leak into logs and configuration exports. C) Public storage of secrets is critical. A) DynamoDB with wide read access is insecure.

Which BEST hides sensitive columns from most analysts while allowing full access to a compliance role?

1. Lake Formation column-level permissions filtering PII columns from all but the compliance role
2. An S3 bucket policy denying s3:GetObject for the sensitive Parquet files entirely
3. A CloudFront signed-URL requirement on the Athena query result files
4. A Redshift-only Row Level Security policy applied to the bucket policy directly

Answer: A — Lake Formation column-level permissions filtering PII columns from all but the compliance role

A) Lake Formation column permissions provide column-level filtering across Athena, Redshift Spectrum, and EMR. B) Bucket policy is object-level, not column-level. C) CloudFront cannot filter columns. D) RLS is Redshift-side, not bucket-side.

Which service enforces fine-grained (column, row, cell) access to lake tables across Athena, Redshift Spectrum, and EMR?

1. S3 bucket policies with prefix-scoped IAM conditions
2. IAM identity policies granting glue:GetTable to each analyst
3. AWS Lake Formation with data filters and LF-TBAC tags
4. Amazon Macie with sensitive-data classifiers on the source bucket

Answer: C — AWS Lake Formation with data filters and LF-TBAC tags

A) Bucket policies grant object-level access, not column or row filtering. B) IAM is too coarse — no column/row predicates. C) Lake Formation applies column, row, and cell filters uniformly across integrated engines using LF-TBAC. D) Macie discovers sensitive data but does not enforce access.

AWS Lake Formation?

Build secure data lakes on S3. Fine-grained access (table, column, row, cell), tag-based access control, cross-account sharing.