Task 4.4: Prepare Logs for Audit DEA-C01 Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   A data engineer needs to ensure that only authorized security analysts can access the Amazon S3 bucket that stores audit logs. Which AWS service should be used to define and enforce these access permissions?

   • AAWS Config
   • BAWS CloudTrail
   • CAmazon S3 server access logs
   • DAWS Identity and Access Management (IAM)
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   A data engineer needs to run SQL queries against audit logs stored in Amazon S3 to generate a compliance report. Which AWS service is designed for querying data directly from S3 using standard SQL?

   • AAmazon CloudWatch Logs Insights
   • BAmazon Athena
   • CAWS Glue
   • DAWS CloudTrail Insights
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A data platform team must centralize audit logs from multiple AWS accounts into a single S3 bucket for compliance review. They need to ensure that only the compliance team can read the logs and that no other team can modify or delete them. What is the most effective approach?

   • AUse AWS Organizations to aggregate CloudTrail logs from all accounts into a single S3 bucket, and attach a bucket policy that grants read-only access to the compliance team and denies write/delete to all others.
   • BConfigure AWS CloudWatch Logs in each account and export to a central S3 bucket using a Lambda function.
   • CEnable S3 Object Lock on the central bucket and grant the compliance team full access.
   • DCreate an S3 bucket in each account and replicate logs to a central bucket using S3 Cross-Region Replication.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   A data engineering team stores audit logs in an Amazon S3 bucket. To follow the principle of least privilege, which IAM policy should be applied to users who need to read the logs?

   • AAllow s3:GetObject on the audit log bucket only
   • BAllow s3:* on the audit log bucket
   • CAllow s3:DeleteObject on the audit log bucket only
   • DAllow s3:PutObject on the audit log bucket only
   Reveal Solution Discussion Select an answer first
6. 25expert · medium

   A company stores audit logs in an S3 bucket. The compliance team needs to read the logs, but the data engineering team should only be able to write logs to the bucket. The security team needs full access to manage the bucket. Which IAM policy strategy should they use?

   • AUse S3 bucket policies to grant access based on the requester's IP address.
   • BCreate separate IAM policies for each team: read-only for compliance, write-only for data engineering, and full access for security.
   • CMake the bucket public and rely on S3 Object Lock to protect the logs.
   • DCreate a single IAM policy that grants full access to all teams.
   Reveal Solution Discussion Select an answer first