Task 4.2: Apply Authorization Mechanisms DEA-C01 Practice Questions (Page 1)

Questions 1–5

1. 1foundation · medium

   A data engineering team maintains an IAM policy that grants access to an Amazon S3 bucket used by multiple applications. The policy has grown over time with overlapping statements. Which statement accurately describes how IAM evaluates the policy and reflects a best practice for maintaining least privilege?

   • AIAM defaults to deny, so the team must add an explicit allow for every possible action the applications might need, even if those actions are not currently used.
   • BIAM grants access only if all statements allow the action; therefore, the team should consolidate all permissions into a single statement to avoid unintended denials.
   • CIAM evaluates statements in order and stops at the first matching statement; therefore, the team should order statements from most specific to least specific to enforce least privilege.
   • DIAM evaluates all statements and denies access if any statement denies, but allows access if any statement allows; therefore, the team should remove unused statements and use conditions to narrow permissions.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   A data engineer needs to grant a data analyst access to a specific table in a data lake managed by AWS Lake Formation. Which Lake Formation permission should the engineer grant?

   • AALTER on the table
   • BDESCRIBE on the table
   • CSELECT on the table
   • DINSERT on the table
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   A data engineer wants to allow a Lambda function to read a SecureString parameter from AWS Systems Manager Parameter Store. Which IAM action must be allowed in the Lambda function's execution role?

   • Asecretsmanager:GetSecretValue
   • Bssm:DescribeParameters
   • Ckms:Decrypt
   • Dssm:GetParameter
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   A data engineer needs to store a database password for an application. The password must be automatically rotated every 30 days. Which AWS service is designed for this purpose?

   • AAWS Key Management Service (KMS)
   • BAWS Systems Manager Parameter Store (standard parameter)
   • CAWS Identity and Access Management (IAM)
   • DAWS Secrets Manager
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   A data engineer needs to create a database user in Amazon Redshift that will be used by an ETL job. Which SQL command should the engineer use?

   • ACREATE ROLE
   • BCREATE LOGIN
   • CCREATE USER
   • DCREATE IDENTITY
   Reveal Solution Discussion Select an answer first