Task 4.3: Ensure Data Encryption and Masking DEA-C01 Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A data engineer needs to encrypt an Amazon RDS for PostgreSQL database using a customer-managed key (CMK) in AWS KMS. The database is already running. What is the most efficient way to achieve this?

   • AModify the DB instance and set the encryption option to use the CMK.
   • BUse AWS Glue to copy the data to a new encrypted database.
   • CCreate a snapshot of the database, copy it with encryption using the CMK, and restore a new instance from the encrypted snapshot.
   • DEnable encryption on the underlying EBS volumes attached to the DB instance.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   What is the primary characteristic of a token used in tokenization?

   • AIt has no exploitable value and cannot be reversed without access to the tokenization system
   • BIt is derived from the original data using a one-way hash
   • CIt is the same length as the original data
   • DIt is encrypted with a key that is stored with the token
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A financial services company processes credit card numbers in a production application. To reduce PCI DSS scope, they want to replace the card numbers with unique identifiers that can be used for transactions but have no exploitable value if the database is compromised. The original card numbers must be retrievable for dispute resolution. Which approach should they use?

   • AUse tokenization with a token vault that maps tokens to original card numbers.
   • BUse hashing with a salt to store the card numbers.
   • CUse deterministic encryption with a CMK to encrypt the card numbers.
   • DUse masking to replace the card numbers with random values.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   A data engineer wants to ensure that data is encrypted in transit between users and a web application fronted by an Application Load Balancer. What should be configured on the load balancer?

   • AA security group rule
   • BA KMS key
   • CAn SSL/TLS certificate
   • DAn IAM role
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   A payment processing system stores credit card numbers as tokens. Which statement best describes how tokenization protects the credit card numbers?

   • AThe tokens are the credit card numbers with some digits masked
   • BThe tokens are encrypted versions of the credit card numbers
   • CThe tokens are derived from the credit card numbers using a hash function
   • DThe tokens are random values that replace the credit card numbers, and the original numbers are stored securely in a token vault
   Reveal Solution Discussion Select an answer first