CloudGuild · Blog · Cheat sheets · Lessons · Certifications
AWS Certified Data Engineer - Associate (DEA-C01) Exam Question Walkthrough
Explore a sample question on data governance and encryption for the AWS DEA-C01 exam. Learn the right answer and why others fail.
In the AWS Certified Data Engineer - Associate exam, questions on data governance can be tricky. Candidates often struggle with determining which services ensure data is encrypted both at rest and in transit. Understanding the requirements is crucial to avoid common pitfalls.
The question
Your organization is implementing a data governance framework on AWS. You need to ensure that all data classified as sensitive is encrypted both at rest and in transit. Which of the following services and features should you utilize?
A. AWS Identity and Access Management (IAM) policies and Amazon RDS encryption
B. AWS Key Management Service (KMS) and SSL/TLS for data in transit
C. Amazon S3 Object Lock and AWS CloudTrail
D. Amazon Redshift encryption and Amazon EC2 instance security groups
Think before you scroll
Before choosing an answer, consider what encryption methods are necessary for data both at rest and in transit. Each option uses different AWS services, and it’s important to identify which ones cover both requirements effectively.
The answer
The correct option is B: AWS Key Management Service (KMS) and SSL/TLS for data in transit. KMS manages encryption keys for data at rest, while SSL/TLS secures data as it travels over the network. This combination comprehensively addresses the question's requirements.
Why the other options lose
- A. AWS Identity and Access Management (IAM) policies and Amazon RDS encryption: While IAM policies are important for access control, they do not directly address data encryption in transit. Amazon RDS encryption protects data at rest only.
- C. Amazon S3 Object Lock and AWS CloudTrail: These services focus on data retention and monitoring. They do not provide encryption for sensitive data at rest or in transit, missing the mark on the question's requirements.
- D. Amazon Redshift encryption and Amazon EC2 instance security groups: Redshift encryption secures data at rest, but EC2 security groups manage network access and do not encrypt data in transit. This option is incomplete for the question's needs.
The concept behind it
Data governance frameworks require a comprehensive approach to security. When dealing with sensitive data, ensure you implement encryption both at rest and in transit. AWS KMS is essential for managing encryption keys, while SSL/TLS is standard for secure data transfer.
Exam trap to remember
Remember the two-question rule: Always check if the option addresses both at rest and in transit encryption. This will help you avoid incomplete answers in the exam.