Task 4.1: Apply Authentication Mechanisms DEA-C01 Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   A data engineer wants to enforce access control for an S3 bucket using an S3 Access Point. Which type of policy should be attached to the Access Point to control which IAM principals can access the bucket through it?

   • AAn access point policy that specifies which IAM principals are allowed.
   • BA VPC endpoint policy attached to the Access Point.
   • CAn IAM policy attached to the Access Point.
   • DA bucket policy attached to the Access Point.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   A data engineer wants to retrieve a database password stored in AWS Secrets Manager from a Lambda function. What is the recommended way to grant the Lambda function permission to retrieve the secret?

   • AAttach an IAM policy to the Lambda function's execution role that allows secretsmanager:GetSecretValue for the specific secret.
   • BCreate an IAM user with access to the secret and store the user's credentials in the Lambda environment variables.
   • CUse the VPC endpoint policy to allow the Lambda function to access the secret.
   • DEmbed the secret directly in the Lambda function code.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A company uses SageMaker Unified Studio to manage multiple data science projects. Each project has its own data sources and users. The company wants to ensure that users can only access data and resources within their assigned projects. What should the company use?

   • ACreate a domain unit for each project and assign users to the appropriate domain unit.
   • BUse SageMaker Studio's default execution role for all users.
   • CCreate a separate AWS account for each project.
   • DUse a single IAM role for all users and rely on S3 bucket policies to restrict data access.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   A data engineer is using the AWS CLI to manage resources. What is the recommended way to authenticate the CLI to AWS?

   • ASet the AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables to the account's access keys.
   • BUse an IAM role with temporary credentials, such as through AWS Single Sign-On or an EC2 instance role.
   • CCreate an IAM user and store the access key and secret key in the CLI configuration file.
   • DUse the root user credentials for the AWS account.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   A data engineer is creating an AWS Lambda function that needs to read data from an Amazon S3 bucket. How should the engineer grant the Lambda function the necessary permissions?

   • ACreate an IAM group and add the Lambda function to the group.
   • BAttach an IAM role to the Lambda function that includes a policy allowing the required S3 actions.
   • CStore AWS access keys in the Lambda function's environment variables.
   • DUse the S3 bucket policy to grant public read access to the bucket.
   Reveal Solution Discussion Select an answer first