Task 4.1: Apply Authentication Mechanisms DEA-C01 Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   A data engineering team wants to grant a set of data analysts the same set of permissions to access an S3 bucket. The team wants to manage these permissions centrally so that when a new analyst joins, they automatically receive the same permissions. Which IAM feature should the team use?

   • AAttach the same permissions policy directly to each analyst's IAM user.
   • BCreate an IAM group and add the analysts to the group, then attach a permissions policy to the group.
   • CCreate an IAM policy and apply it to the S3 bucket using a bucket policy.
   • DCreate an IAM role and have each analyst assume the role when they need access.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   A data engineer needs to store a database password securely and automatically rotate it every 30 days. Which AWS service should the engineer use?

   • AAWS Systems Manager Parameter Store
   • BAWS Secrets Manager
   • CAWS Identity and Access Management (IAM)
   • DAWS Key Management Service (KMS)
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A data engineering team uses AWS CloudFormation to deploy a stack that includes an Amazon Redshift cluster and an AWS Lambda function. The Lambda function needs to query the Redshift cluster. The team wants to follow the principle of least privilege and avoid embedding credentials in the Lambda code. What should the team do?

   • AUse the CloudFormation stack's service role to grant Lambda permissions to Redshift.
   • BCreate an IAM user with Redshift access and store the access key in the Lambda environment variable.
   • CAttach the AmazonRedshiftFullAccess managed policy to the Lambda execution role.
   • DCreate an IAM role for Lambda with a policy that allows redshift-data API actions, and reference the role in the Lambda function's execution role. Use Secrets Manager to store the Redshift credentials and have Lambda retrieve them.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A data science team uses SageMaker Unified Studio to collaborate on machine learning projects. The team has three groups: data engineers, data scientists, and business analysts. Each group needs different levels of access to projects and data. The team wants to manage access at a granular level without creating separate AWS accounts. What should they use?

   • AUse S3 bucket policies to control access to data, but not to SageMaker projects.
   • BCreate IAM roles for each group and attach policies that grant permissions to specific SageMaker projects and resources.
   • CCreate separate AWS accounts for each group.
   • DUse SageMaker Studio's default execution role for all users.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A company runs a critical application on Amazon ECS that connects to an Amazon RDS for MySQL database. The application uses a database user with a password stored in AWS Secrets Manager. The company wants to automate password rotation every 30 days. The DBA has configured the secret for rotation, but the application started failing after the first rotation. The application logs show that it is using the old password. What is the most likely cause?

   • AThe rotation Lambda function is not updating the database password.
   • BThe IAM role used by the ECS task does not have permission to call GetSecretValue.
   • CThe secret's rotation configuration is set to rotate every 30 days, but the application is not configured to use the new ARN.
   • DThe application caches the secret and does not retrieve the new version after rotation.
   Reveal Solution Discussion Select an answer first