CloudGuild · Blog · Cheat sheets · Lessons · Certifications
Decoding AWS DEA-C01: Access Control and Logging
Learn how to tackle AWS DEA-C01 questions on data security, focusing on the correct features for access control and logging.
Sensitive data management is crucial. Many candidates struggle with questions on data access and logging. Understanding the right AWS features can make all the difference.
The question
An organization needs to ensure that sensitive data stored in AWS services is only accessible by specific users and that all access is logged for auditing purposes. What combination of AWS features should be employed to meet these requirements?
- A. AWS Identity and Access Management (IAM) and AWS CloudTrail
- B. Amazon S3 bucket policies and AWS Lambda
- C. Amazon RDS encryption and Amazon EC2 instance profiles
- D. AWS Shield and AWS WAF
Think before you scroll
Consider the requirements for access control and logging. Identify which AWS features can provide comprehensive access management while ensuring that all actions are recorded for auditing purposes.
The answer
The correct option is A. AWS Identity and Access Management (IAM) and AWS CloudTrail. IAM allows for detailed control of user permissions, ensuring that only designated users can access sensitive data. CloudTrail complements this by logging all API calls, providing a full audit trail of access events.
Why the other options lose
- B. Amazon S3 bucket policies and AWS Lambda: While S3 bucket policies control access to objects in S3, they do not provide logging capabilities. AWS Lambda does not directly address the auditing or access control requirements in this context.
- C. Amazon RDS encryption and Amazon EC2 instance profiles: RDS encryption protects data at rest but does not manage access or logging for sensitive data access. EC2 instance profiles allow EC2 instances to interact with AWS services but do not provide user-specific access control or logging.
- D. AWS Shield and AWS WAF: These services protect against DDoS attacks and filter web traffic, respectively. They do not provide the necessary access control or logging for sensitive data management.
The concept behind it
Access control and logging are foundational elements of data governance in AWS. IAM is essential for managing user permissions, while CloudTrail offers a complete audit of all API usage. This combination ensures both security and accountability in data access.
Exam trap to remember
Always pair access control with logging. If a question involves data security, look for options that provide both user permissions and audit trails.