Task 4.5: Understand Data Privacy and Governance DEA-C01 Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A data platform team uses AWS Lake Formation to manage access to a data lake. They need to ensure that data analysts can only query rows where the 'department' column matches their own department. Which approach should they use?

   • AEnable S3 bucket policies that restrict access to objects with a specific prefix for each department.
   • BCreate a separate IAM role for each department and attach a resource-based policy to the data lake that filters rows by department.
   • CUse Lake Formation row-level security with a partition or filter expression based on the 'department' column.
   • DCreate separate databases in the data lake for each department and grant analysts access only to their department's database.
   Reveal Solution Discussion Select an answer first
2. 27foundation · medium

   Which practice is essential for ensuring fairness in machine learning models?

   • AStoring data in multiple regions
   • BRegularly auditing training data for bias
   • CEncrypting all training data
   • DUsing only the most recent data
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A large enterprise is establishing a data governance framework. They have defined data classification levels and are now assigning responsibilities for data quality, access approvals, and compliance. Which component of the governance framework should they formalize?

   • AImplement data encryption at rest and in transit for all data stores.
   • BDefine roles and responsibilities, such as data owners, data stewards, and data custodians.
   • CSet up AWS Organizations to manage multiple accounts and apply service control policies.
   • DCreate a data dictionary that defines all data elements and their meanings.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A European e-commerce company receives a request from a customer to delete all personal data the company holds about them, as permitted by GDPR. The data is stored in an Amazon S3 data lake and an Amazon RDS database. Which process should the data engineer implement to fulfill this request?

   • AAnonymize the customer's records by replacing their name and email with random values in both S3 and RDS.
   • BIdentify all data related to the customer using a data catalog, then delete the records from both S3 and RDS, and verify deletion.
   • CExport the customer's data to a CSV file and provide it to the customer, then delete the original data.
   • DDisable access to the customer's data by updating IAM policies to deny access to that specific customer's records.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A company needs to demonstrate to auditors that only authorized users have accessed a specific S3 bucket containing PII. They also need to be alerted if an IAM user attempts to access the bucket without permission. Which combination of AWS services should they use?

   • AEnable Amazon GuardDuty and rely on its anomaly detection to identify unauthorized access.
   • BEnable AWS CloudTrail for the bucket and create a CloudWatch alarm on the 'Denied' event.
   • CUse AWS Config to record S3 bucket resource changes and trigger an SNS notification on any change.
   • DEnable S3 server access logs and store them in a separate bucket, then use Athena to query them.
   Reveal Solution Discussion Select an answer first