Data Security and Governance
Free AWS Certified Data Engineer - Associate practice — 6 questions on Data Security and Governance, with explanations. No sign-up. Full 12-question mixed test →
A retail company stores a single 'transactions' table in the AWS Glue Data Catalog, registered in Lake Formation. A partner company in a separate AWS account needs SELECT access, but only to rows where region = 'EU'. The data engineering team must NOT duplicate the table or create a separate physical copy for the partner. Which approach BEST meets this requirement?
Lake Formation data cell filters support row-level (and column-level) security on a single shared table. A data filter can be attached to a cross-account grant, so the partner account only sees rows matching the filter without any data duplication, and Lake Formation enforces this centrally regardless of which query engine (Athena, Redshift Spectrum, EMR) reads the table.
A Glue ETL job connects to an Amazon Redshift cluster using a database username and password. Security policy requires the password to be rotated automatically every 30 days without any manual intervention or job code changes when the password changes. Which solution meets this requirement with the LEAST operational overhead?
AWS Secrets Manager provides native, built-in rotation templates (via a managed Lambda function) for Amazon Redshift, RDS, and DocumentDB credentials. Once configured, rotation happens automatically on a schedule (e.g., every 30 days) with zero code changes needed — the Glue job simply retrieves the current secret value by ARN at runtime using the Secrets Manager API/connector.
A Lake Formation table 'customers' contains columns: customer_id, name, email, ssn, purchase_total. An analytics group needs SELECT access to all columns EXCEPT ssn for ad-hoc querying via Athena. Which Lake Formation configuration correctly implements this?
Lake Formation data cell filters natively support column-level permissions by specifying an 'Exclude columns' list (or an explicit include list). Granting SELECT with this filter attached ensures the ssn column is never returned to the group across any Lake Formation-integrated engine (Athena, Redshift Spectrum, EMR), enforced centrally rather than per-client.
AWS Glue ETL jobs run inside a private subnet with no route to an internet gateway or NAT gateway. The jobs must read and write objects in Amazon S3 without traversing the public internet. Which solution meets this requirement?
Amazon S3 (along with DynamoDB) supports Gateway VPC endpoints, which work by adding a prefix-list route to the subnet's route table — no ENIs, no internet gateway, and no NAT gateway required. This keeps all S3 traffic on the AWS network backbone, satisfying the private connectivity requirement at no additional cost.
A compliance team requires an audit trail of every individual GetObject and PutObject API call made against a specific sensitive S3 bucket, including the requester identity and object key. The team checks CloudTrail's default trail but finds no record of these individual object-level calls. What is the correct explanation and fix?
CloudTrail trails capture management events by default (e.g., CreateBucket, PutBucketPolicy), but object-level data events like GetObject, PutObject, and DeleteObject are a separate category that must be explicitly configured on the trail (often scoped to specific buckets/prefixes) and typically incur additional CloudTrail charges.
A company uses S3 Cross-Region Replication (CRR) to replicate SSE-KMS-encrypted objects from a bucket in us-east-1 to a bucket in eu-west-1 for disaster recovery. They want customer-managed keys (not AWS managed keys) in both regions, and want to minimize the operational overhead of managing entirely separate keys and key policies per region. Which approach BEST satisfies these requirements?
AWS KMS multi-Region keys consist of a primary key and one or more replica keys in other regions that share the same key material and key ID structure, letting encrypted data be decrypted in another region without re-encryption gymnastics. For S3 CRR, the destination key must reside in the destination region, so creating a replica key in eu-west-1 lets the company keep customer-managed keys in both regions while treating them as a single logical key for management, policy, and rotation purposes.
Ready for the real thing?
The full course: two full-length practice tests, video lessons for every exam domain, hands-on labs and detailed explanations.
$109.99 $34.99 with code FREETEST33 — valid through September 14.
Get my $34.99 deal →