Task 4.4: Prepare Logs for Audit DEA-C01 Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   A data engineering team must demonstrate to auditors that only authorized users have accessed a dataset containing personally identifiable information (PII). Which statement best describes the primary purpose of audit logs in this scenario?

   • ATo provide a chronological record of who accessed data, when, and from where, supporting compliance and security investigations
   • BTo improve query performance by caching frequently accessed data
   • CTo automatically encrypt data at rest using AWS Key Management Service (AWS KMS)
   • DTo replicate data to another AWS Region for disaster recovery
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   A data engineer needs to monitor audit logs for patterns that might indicate unauthorized access, such as multiple failed login attempts. Which AWS service can be used to analyze CloudTrail logs in real time and trigger alerts?

   • AAWS Config
   • BAmazon Athena
   • CAWS CloudTrail Insights
   • DAmazon CloudWatch Logs Insights
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   A data engineer must ensure that audit logs stored in Amazon S3 cannot be modified or deleted by anyone, including AWS administrators, for a specified retention period. Which AWS feature should be used to achieve this?

   • AAWS KMS encryption
   • BS3 Lifecycle policy
   • CS3 Object Lock
   • DAWS CloudTrail log file integrity validation
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A company uses Amazon S3 as its data lake. The security team needs to capture all API calls that read or write objects in the data lake, including the caller identity, source IP, and request details. They want these records delivered to a central S3 bucket for analysis. Which configuration should they implement?

   • AEnable AWS CloudWatch Logs for the S3 bucket and stream to a central S3 bucket.
   • BEnable S3 server access logs on the data lake bucket, delivering to a central logging bucket.
   • CEnable S3 Object Lock on the data lake bucket and copy logs to a central S3 bucket.
   • DEnable AWS CloudTrail with data events for the S3 bucket, delivering to a central S3 bucket.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A company is required to prove that its audit logs have not been altered since they were created. They store CloudTrail logs in an S3 bucket. Which feature should they enable to provide cryptographic proof of log integrity?

   • AEnable S3 Versioning on the bucket.
   • BEnable CloudTrail log file integrity validation.
   • CEnable S3 Object Lock in compliance mode on the bucket.
   • DEnable S3 Server-Side Encryption with AWS KMS.
   Reveal Solution Discussion Select an answer first