Data Security and Governance

218. An AWS Glue job must connect to an Amazon RDS database using credentials that rotate automatically without changing the job. Which solution meets these requirements?

1. A Store the credentials in AWS Secrets Manager with rotation enabled and reference the secret from the Glue connection.
2. B Pass the credentials to the job as job parameters and update them after each rotation.
3. C Embed the credentials in the job script and redeploy the script after each rotation.
4. D Store the credentials in AWS Systems Manager Parameter Store as a String parameter and read them in the script.

219. An Amazon Redshift cluster in a private subnet must be queried from an AWS Lambda function without internet traversal. Which solution meets these requirements?

1. A Make the cluster publicly accessible and restrict it by source IP address.
2. B Add an internet gateway route from the function's subnet to the cluster.
3. C Attach the function to the VPC and allow its security group in the cluster's security group.
4. D Route the function's traffic through a NAT gateway to reach the cluster endpoint.

220. Consumers in other AWS accounts must reach a data service in the producer VPC with no routed network path between the VPCs. Which solution meets these requirements?

1. A Publish the service as an AWS PrivateLink endpoint service and have consumers create interface endpoints.
2. B Create a VPC peering connection between the producer VPC and each consumer VPC.
3. C Expose the service on a public endpoint restricted by IP address allow-lists.
4. D Attach all VPCs to a transit gateway with a shared route table.

221. An Amazon S3 bucket shared by many teams has a bucket policy that has grown too large to maintain. Which solution meets these requirements?

1. A Create a separate S3 bucket for each team with its own bucket policy.
2. B Consolidate the bucket policy statements and reference IAM groups instead of users.
3. C Create an S3 Access Point for each team with a policy scoped to that team's prefix.
4. D Attach an IAM policy to each team that grants access to its own prefix.

222. A Lambda function in a data pipeline must call Amazon S3 and AWS Glue without long-term credentials on any host. Which solution meets these requirements?

1. A Attach an execution role to the function with policies scoped to the required actions and resources.
2. B Store IAM access keys in an encrypted Amazon S3 object the function reads at startup.
3. C Store IAM access keys in AWS Systems Manager Parameter Store and read them each invocation.
4. D Store IAM access keys in the function's environment variables.

223. Analysts must query a data lake table but must not be able to see the salary column. Which solution meets these requirements?

1. A Grant column-level permissions in AWS Lake Formation that exclude the salary column for those principals.
2. B Create a filtered copy of the table without the salary column and grant access to the copy.
3. C Apply an Amazon S3 bucket policy that denies access to the underlying files.
4. D Instruct the analysts not to select the salary column in their queries.

224. Analysts in each region must see only the rows for their own region in a shared table. Which solution meets these requirements?

1. A Apply an Amazon S3 prefix per region and grant access with bucket policies.
2. B Define AWS Lake Formation data filters that apply a row-level condition per principal.
3. C Add a WHERE clause to a shared Amazon Athena view and grant access to the view.
4. D Create a separate table for each region and grant each analyst group its own table.

225. A managed IAM policy grants more permissions than a data engineering role requires. Which solution meets these requirements?

1. A Attach the managed policy and rely on AWS CloudTrail to detect misuse.
2. B Attach a permissions boundary that grants the same actions as the managed policy.
3. C Create a customer managed policy that grants only the actions and resources the role uses, and attach it instead.
4. D Attach the managed policy and add an inline deny for the actions the role should not use.

226. Database users in Amazon Redshift must be granted access by team rather than individually. Which solution meets these requirements?

1. A Create database groups or roles, grant object privileges to them, and add users to the appropriate group.
2. B Grant object privileges directly to each database user as they are created.
3. C Share the same database user credentials among the members of each team.
4. D Create a separate Redshift cluster for each team with only that team's data.

227. Data written by an AWS Glue job in one account must be readable by an Amazon Athena query in another account, and the objects are encrypted with a customer managed AWS KMS key. Which combination of steps meets these requirements? (Select TWO.)

1. A Grant the consumer account read access to the objects in the bucket policy.
2. B Grant the consumer account kms:Decrypt on the key in the key policy.
3. C Re-encrypt the objects with Amazon S3 managed keys and grant read access.
4. D Copy the objects into a bucket owned by the consumer account after each run.
5. E Make the bucket publicly readable and restrict the consumer by IP address.

228. An Amazon Redshift cluster must refuse any client connection that is not encrypted in transit. Which solution meets these requirements?

1. A Set the require_SSL parameter in the cluster parameter group so unencrypted connections are refused.
2. B Enable encryption at rest on the cluster with an AWS KMS key.
3. C Place the cluster in a private subnet and restrict its security group.
4. D Enable audit logging and review the connection log for unencrypted sessions.

229. National identity numbers must be rendered unusable to analysts while records remain joinable across tables. Which solution meets these requirements?

1. A Encrypt the field with a key the analysts are also given.
2. B Apply deterministic tokenization so each value is replaced with a consistent surrogate.
3. C Remove the field entirely from the analyst-facing dataset.
4. D Truncate the field to its first three characters before analysts receive it.

230. A compliance requirement states that the encryption key protecting analytics data must be controllable and its use auditable by the company. Which solution meets these requirements?

1. A Encrypt the data with an AWS managed key so AWS handles the key lifecycle.
2. B Store the data unencrypted and restrict access with a bucket policy.
3. C Encrypt the data with Amazon S3 managed keys and enable server access logging.
4. D Encrypt the data with a customer managed AWS KMS key whose key policy the company authors, and review key usage in AWS CloudTrail.

231. An auditor must query two years of AWS API activity across an organization using SQL, without building an ingestion pipeline. Which solution meets these requirements?

1. A Deliver an organization trail to Amazon CloudWatch Logs and query it with Logs Insights.
2. B Create an AWS CloudTrail Lake organization event data store with a two-year retention period and query it with SQL.
3. C Stream the trail events into Amazon OpenSearch Service and query them with the search API.
4. D Deliver an organization trail to Amazon S3 and build partitioned Athena tables over the objects.

232. Application logs from an Amazon EMR cluster must survive cluster termination for later analysis. Which solution meets these requirements?

1. A Configure a log URI on the cluster so logs are archived to Amazon S3 while it runs.
2. B Increase the instance storage on the cluster nodes so logs are retained locally.
3. C Connect to the primary node and download the logs before terminating the cluster.
4. D Enable Amazon CloudWatch detailed monitoring on the cluster instances.

233. Very large volumes of pipeline logs must be analysed to produce an audit report covering a full quarter. Which solution meets these requirements?

1. A Download the logs to a workstation and process them with a local script.
2. B Store the logs in Amazon S3 and analyse them with Amazon Athena or Amazon EMR for the reporting period.
3. C Stream the logs to an Amazon SNS topic subscribed by the audit team.
4. D Retain the logs in Amazon CloudWatch Logs for the quarter and read them in the console.

234. Application logs written by an AWS Glue job must be centralized so they can be searched alongside other pipeline logs. Which solution meets these requirements?

1. A Configure the job to write to Amazon CloudWatch Logs and query the log groups with CloudWatch Logs Insights.
2. B Write the logs to the job's local storage and collect them after each run.
3. C Print the logs to standard output and read them from the job run detail page.
4. D Write the logs into the job's output dataset so they are stored with the results.

235. Data in a specific Amazon S3 bucket must not be replicated or backed up into Regions outside the company's jurisdiction. Which solution meets these requirements?

1. A Create an AWS Config rule that reports replication configurations targeting other Regions.
2. B Apply a bucket policy that denies s3:PutObject from outside the permitted Regions.
3. C Apply a service control policy that denies the relevant actions when aws:RequestedRegion is outside the permitted Regions.
4. D Disable S3 Cross-Region Replication on the bucket and document the restriction.

236. Amazon Redshift data must be shared with an analytics team in another AWS account without copying it. Which solution meets these requirements?

1. A Unload the data to Amazon S3 nightly and load it into the consumer's cluster.
2. B Restore a snapshot of the producer cluster into the consumer account.
3. C Create a Redshift datashare on the producer cluster and grant the consumer cluster access to it.
4. D Create a cross-account IAM role that allows the consumer to log in to the producer cluster.

237. Personally identifiable information must be located across a data lake before analysts are granted broader access. Which solution meets these requirements?

1. A Enable AWS CloudTrail data events for the buckets and review the access patterns.
2. B Run Amazon Macie sensitive data discovery jobs against the S3 locations and review the findings before granting access.
3. C Query the data with Amazon Athena and inspect a sample of rows from each table.
4. D Run an AWS Glue crawler over the S3 locations and review the inferred schemas.

238. A governance team must be able to review every configuration change made to the data lake's resources over the past year. Which solution meets these requirements?

1. A Enable AWS Glue job bookmarks so processed state is retained.
2. B Enable Amazon S3 server access logging on the data lake buckets.
3. C Enable AWS CloudTrail and review the management events for the period.
4. D Enable AWS Config with a retention period covering the year and review the configuration timeline for the resources.

239. A Glue job must connect to an Amazon RDS database in a private subnet. Which network configuration is required?

1. A A NAT gateway in the job's subnet.
2. B An internet gateway route from the job.
3. C A Glue connection specifying the subnet and a security group the database permits, so the job runs elastic network interfaces in the VPC.
4. D A public IP address on the database.

240. A pipeline's Lambda functions must authenticate to Amazon Redshift without a stored password. Which approach is appropriate?

1. A Store the password in an environment variable.
2. B Use IAM authentication to obtain temporary database credentials from the function's role.
3. C Embed the password in the function code.
4. D Store the password in a configuration file in the deployment package.

241. An Amazon MSK cluster must authenticate producers without managing certificates. Which approach is appropriate?

1. A Enable IAM access control so producers authenticate with their IAM identity.
2. B Share a single username and password among producers.
3. C Issue TLS client certificates to each producer.
4. D Use plaintext connections restricted by security group.

242. Analysts must query a Lake Formation table but see only rows for their own department. Which approach is appropriate?

1. A Create a separate table per department.
2. B Restrict the S3 prefix per department.
3. C Create a Lake Formation data filter with a row-level condition and grant it per department principal.
4. D Add a WHERE clause to the analysts' saved queries.

243. A Glue job's role must read from one bucket and write to another, and nothing else. Which policy is appropriate?

1. A A policy granting s3:GetObject on all buckets.
2. B A policy granting s3:* on both buckets.
3. C A policy granting s3:GetObject on the source prefix and s3:PutObject on the target prefix, with ListBucket on both.
4. D The AWS managed policy for full S3 access.

244. A Redshift user must query a view but not the underlying tables. Which approach is appropriate?

1. A Grant SELECT on the view only, so the view's owner permissions apply to the underlying tables.
2. B Grant the user superuser access.
3. C Grant SELECT on both the view and the tables.
4. D Copy the view's data into a table the user owns.

245. A Glue job's intermediate data on worker disks must be encrypted. Which configuration is required?

1. A Encryption on the Data Catalog only.
2. B A Glue security configuration enabling job bookmark and local disk encryption.
3. C A KMS key on the source database.
4. D Encryption on the output S3 bucket only.

246. A column containing card numbers must be masked in query results for most users while a compliance role sees the full value. Which approach is appropriate?

1. A Remove the column from the table.
2. B Apply a dynamic data masking policy in Redshift that masks the column except for the compliance role.
3. C Store the column in a separate table only the compliance role can query.
4. D Hash the column at load time for all users.

247. Data in transit between a Glue job and an Amazon Redshift target must be encrypted. Which configuration is required?

1. A Place the job and cluster in the same subnet.
2. B Require SSL on the Redshift connection used by the job.
3. C Encrypt the job's output S3 bucket.
4. D Encrypt the Redshift cluster at rest.

248. An Athena query's results must be encrypted with a key the security team controls. Which configuration is appropriate?

1. A Enable encryption on the Athena query editor.
2. B Configure the workgroup's result location with SSE-KMS using the security team's customer managed key.
3. C Restrict access to the results bucket by IAM.
4. D Encrypt the source data with the security team's key.

249. An audit must establish which user ran a specific Athena query and what it returned. Which sources provide this?

1. A The Data Catalog's table access history.
2. B CloudTrail for the StartQueryExecution call with its identity, and the workgroup's query history for the query text and results location.
3. C CloudWatch Logs for the Athena service.
4. D VPC Flow Logs for the analyst's subnet.

250. Redshift must log every user query for a compliance review. Which configuration is required?

1. A Enable Redshift performance insights.
2. B Enable CloudTrail for the Redshift service.
3. C Enable enhanced VPC routing.
4. D Enable audit logging on the cluster with the user activity log delivered to Amazon S3.

251. Access to objects in a data lake bucket must be logged with reliable attribution of the calling principal. Which approach is appropriate?

1. A Enable CloudTrail data events for the bucket.
2. B Enable S3 Storage Lens.
3. C Enable S3 server access logging.
4. D Enable VPC Flow Logs on the consumers' subnets.

252. A data lake must prevent any table from being shared with an account outside the organization. Which approach is appropriate?

1. A Ask administrators not to share externally.
2. B Review grants quarterly for external accounts.
3. C Apply a service control policy or Lake Formation setting that restricts cross-account grants to organization principals.
4. D Encrypt all tables with an organization-only key.

253. Personal data in a data lake must be located and classified before analysts receive broader access. Which approach is appropriate?

1. A Run Amazon Macie discovery jobs over the lake and review the findings before granting access.
2. B Ask the data owners which tables contain personal data.
3. C Sample rows from each table manually.
4. D Run a Glue crawler and inspect column names.

254. A dataset must be shared with a partner organization for analysis without the partner receiving a copy. Which approach is appropriate?

1. A Publish the dataset on a public endpoint.
2. B Share the data through AWS Clean Rooms or a Redshift datashare so the partner queries without extracting.
3. C Grant the partner read access to the S3 bucket.
4. D Export the dataset and send it to the partner.

255. A data governance requirement states that every dataset must have a documented owner and retention period. Which approach is appropriate?

1. A Maintain a spreadsheet of owners and retention periods.
2. B Ask each team to document their datasets in a wiki.
3. C Record owner and retention as required metadata on each catalog entry and enforce their presence with a policy or check.
4. D Include the owner's name in each dataset's S3 prefix.

256. An Athena query must run with permissions belonging to the querying user rather than a shared role. Which approach is appropriate?

1. A Grant all users direct access to the underlying S3 buckets.
2. B Have all users share one role with broad permissions.
3. C Run all queries from a single service account.
4. D Have each user assume their own role with Lake Formation permissions granted to that principal.

257. A Redshift cluster must authenticate users from a corporate identity provider without local database passwords. Which approach is appropriate?

1. A Share a single database user among the analysts.
2. B Configure federated access so users obtain temporary database credentials from their IAM identity.
3. C Create a database user with a password for each employee.
4. D Store database passwords in a spreadsheet.

258. Lake Formation permissions must apply to a table's data regardless of which query engine reads it. Which mechanism provides this?

1. A An S3 bucket policy on the underlying objects.
2. B Lake Formation permissions registered against the catalog, which Athena, Redshift Spectrum, and EMR all enforce.
3. C A separate copy of the table per engine.
4. D An IAM policy attached to each analyst.

259. A data engineer must grant a team access to a table while hiding two sensitive columns. Which approach is appropriate?

1. A Create a view excluding the columns and grant access to the view only.
2. B Grant Lake Formation column-level permissions excluding the sensitive columns.
3. C Ask the team not to select those columns.
4. D Copy the table without the sensitive columns.

260. An EMR cluster must encrypt data written to its local disks. Which configuration is required?

1. A Encryption in transit between nodes.
2. B A security configuration with local disk encryption enabled, applied when the cluster is created.
3. C A KMS key attached to the cluster's IAM role.
4. D Encryption on the output S3 bucket only.

261. A pipeline must tokenize an identifier so the same input always produces the same token across runs. Which property is required?

1. A Hashing with a random salt per record.
2. B Random tokenization with a new value each time.
3. C Truncation of the identifier to its first characters.
4. D Deterministic tokenization, so joins on the token remain valid across datasets and runs.

262. An audit must reconstruct which Glue job run produced a specific output file. Which approach is appropriate?

1. A Record the job run identifier in the output path or object metadata so each file traces to its run.
2. B Rely on the file's last modified timestamp.
3. C Record the number of files each run produced.
4. D Record the job's start time only.

263. Redshift audit logs must be retained for several years at low cost. Which approach is appropriate?

1. A Retain the logs in the cluster's system tables.
2. B Deliver the audit logs to Amazon S3 and apply a lifecycle policy transitioning them to archival storage.
3. C Export the logs to a spreadsheet monthly.
4. D Increase the cluster's storage.

264. A dataset shared with a partner must exclude rows belonging to other customers. Which approach is appropriate?

1. A Send the partner the full dataset and ask them to filter it.
2. B Grant the partner read access to the source bucket.
3. C Apply a row-level filter in the sharing mechanism so the partner sees only permitted rows.
4. D Create a filtered copy and send it to the partner.

265. A governance requirement states that every dataset must record the legal basis for processing personal data. Which approach is appropriate?

1. A Record it in a separate compliance document.
2. B Record it in the dataset's file names.
3. C Record the legal basis as required metadata on the catalog entry and enforce its presence before the dataset is published.
4. D Record it in the pipeline's source code comments.

266. A pipeline must authenticate to a third-party API using a credential that rotates. Which approach is appropriate?

1. A Store the credential in AWS Secrets Manager with rotation and retrieve it at run time.
2. B Store the credential in an environment variable.
3. C Store the credential in the job's parameters.
4. D Store the credential in the pipeline's code.

267. An EMR cluster must authenticate users against the organization's directory. Which approach is appropriate?

1. A Configure the cluster with a security configuration enabling Kerberos authentication against the directory.
2. B Disable authentication within the cluster.
3. C Share a single set of credentials among users.
4. D Create local Linux users on each node.

268. A pipeline running outside AWS must obtain temporary credentials without a stored access key. Which approach is appropriate?

1. A Create an IAM user and store its keys on the host.
2. B Use the account root user credentials.
3. C Share credentials from an existing workload.
4. D Use IAM Roles Anywhere with a certificate issued by a registered authority to exchange for temporary credentials.

269. An Athena query must run under the identity of the user who submitted it rather than a shared role. Which approach is appropriate?

1. A Have each user assume their own role, with Lake Formation permissions granted to that principal.
2. B Grant every user the same broad role.
3. C Grant users direct access to the underlying buckets.
4. D Run all queries through a single service role.

270. A pipeline component must access a resource in a VPC while running outside it. Which approach is appropriate?

1. A Assign the component a public IP address.
2. B Make the resource publicly accessible.
3. C Attach the component to the VPC with subnets and a security group the resource permits, or expose the resource through a private endpoint.
4. D Route the traffic through a NAT gateway.

271. A Lake Formation permission must apply to a table's future partitions as well as its current ones. Which consideration applies?

1. A Partitions require a separate permission model.
2. B Permissions apply only to partitions existing at grant time.
3. C Each partition must be granted individually as it is created.
4. D Permissions are granted on the table, so they apply to partitions added later without further action.

272. A Redshift user must be prevented from querying a table outside business hours. Which consideration applies?

1. A A GRANT statement can include a time condition.
2. B A workload management queue can enforce the restriction.
3. C Time-based restriction is not expressed in database grants, so it must be enforced through the access path such as conditional credentials or a proxy.
4. D Row-level security can express the restriction.

273. An S3 bucket policy must permit a Glue job while denying every other principal. Which approach is appropriate?

1. A Permit all principals in the account.
2. B Permit the job's role explicitly and add a deny for principals other than that role, taking care not to lock out administrators.
3. C Deny all principals and rely on the job's IAM policy.
4. D Remove the bucket policy entirely.

274. A pipeline must write data that can be decrypted only by a specific downstream account. Which approach is appropriate?

1. A Encrypt with the default service key and share the objects.
2. B Rely on bucket policy restrictions without encryption.
3. C Encrypt with a KMS key whose policy grants decrypt to that account's principals and to no others.
4. D Encrypt client-side with a key stored alongside the data.

275. A column containing free text must be scanned for sensitive values before the dataset is shared. Which approach is appropriate?

1. A Rely on the column name to indicate its content.
2. B Inspect a sample of rows manually.
3. C Run a sensitive data discovery job over the dataset and review the findings before sharing.
4. D Hash the column and share it.

276. An audit must establish which principal modified a Glue job's script. Which source is appropriate?

1. A CloudTrail records of the UpdateJob call, which include the calling identity.
2. B The job's CloudWatch Logs output.
3. C The job's run history.
4. D The job's current script content.

277. Audit logs for a data platform must be queryable without moving them out of Amazon S3. Which approach is appropriate?

1. A Catalog the log location and query it with Amazon Athena.
2. B Download the logs and search them locally.
3. C Load the logs into a relational database.
4. D Load the logs into Amazon Redshift.

278. An audit must cover a period longer than CloudTrail's default event history retains. Which approach is required?

1. A Requesting the events from AWS Support.
2. B A trail delivering to Amazon S3 or a CloudTrail Lake event data store configured before the period began.
3. C Reconstructing the events from resource configuration.
4. D Querying the event history for the period.

279. An audit must show which datasets a specific user queried over the past month. Which source is appropriate?

1. A The query history in the query engine's workgroup or system tables, correlated with the user's identity.
2. B The user's IAM policy.
3. C The datasets' catalog metadata.
4. D The datasets' object access counts.

280. Audit evidence must be protected from modification by the team that produces it. Which approach is appropriate?

1. A Deliver the logs to a separate account with Object Lock, so the producing team cannot alter them.
2. B Retain the logs for a longer period.
3. C Store the logs in the producing team's account with restricted permissions.
4. D Encrypt the logs with the producing team's key.

281. An audit must confirm that a pipeline's output was not modified after it was produced. Which approach is appropriate?

1. A Compare the object's size against the expected value.
2. B Confirm the pipeline run completed successfully.
3. C Check the object's last modified timestamp.
4. D Record a checksum of the output at production time and verify it against the stored object during the audit.

282. A dataset must be shared with a partner in a way that can be revoked immediately. Which approach is appropriate?

1. A Grant the partner's account read access to the bucket indefinitely.
2. B Generate long-lived presigned URLs for the objects.
3. C Send the partner a copy of the dataset.
4. D Grant access through a mechanism the owner controls, such as Lake Formation permissions or a datashare, so revocation is a single action.

283. A data platform must record the purpose for which each dataset may be used. Which approach is appropriate?

1. A Record it in the data sharing agreement only.
2. B Record it in the pipeline's code comments.
3. C Record the permitted purpose as catalog metadata and reference it when access is granted.
4. D Record it in the dataset's file names.