Task 4.3: Ensure Data Encryption and Masking DEA-C01 Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard · select all that apply

   A data engineer needs to create a de-identified version of a dataset for external researchers. The dataset contains names, email addresses, and purchase history. The researchers need to be able to analyze purchasing patterns but must not be able to identify individual customers. Which techniques should be used? (Select all that apply.)

   • AEncrypt the names using a CMK.
   • BRemove email addresses entirely.
   • CUse tokenization to replace email addresses with tokens.
   • DAggregate purchase history by customer segment.
   • EReplace names with random pseudonyms.
   Check answers Discussion Select an answer first
2. 7foundation · easy

   Which compliance standard specifically includes requirements for protecting cardholder data, which often involves encryption and tokenization?

   • AGDPR
   • BHIPAA
   • CSOC 2
   • DPCI DSS
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A company exposes a REST API using Amazon API Gateway. The API is backed by AWS Lambda. They need to ensure that all client-to-API traffic is encrypted in transit. What should they do?

   • AEnable API caching and require clients to use the cache key.
   • BUse a custom domain name with an SSL/TLS certificate and configure the API Gateway endpoint to use HTTPS.
   • CUse AWS WAF to enforce HTTPS on the API.
   • DEnable Lambda's VPC integration and use a VPC endpoint for API Gateway.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A company uses AWS KMS to encrypt data in multiple AWS services. They need to ensure that only specific IAM roles can use a particular CMK for encryption and decryption. They also need to prevent the key from being used by any other principal. What should they do?

   • AUse IAM policies to allow the specific roles and rely on the default key policy to deny others.
   • BUse AWS Organizations to restrict access to the key.
   • CUse a key policy that grants kms:Encrypt and kms:Decrypt permissions to the specific IAM roles, and use IAM policies to deny all other principals.
   • DUse S3 bucket policies to control access to the key.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Which protocol is commonly used to encrypt data in transit between a client and an AWS service such as Application Load Balancer or CloudFront?

   • ASSH
   • BTLS/SSL
   • CIPsec
   • DAES-256
   Reveal Solution Discussion Select an answer first