CloudGuild · Blog · Cheat sheets · Lessons · Certifications
Navigating Data Security in AWS: A DEA-C01 Exam Question Walkthrough
Learn how to tackle a challenging AWS Certified Data Engineer question on data security and compliance effectively.
A common challenge for candidates is ensuring they understand the specific requirements for data access and logging in AWS. This question tests your knowledge of securing sensitive data in Amazon S3 and the best practices for compliance.
The question
A company is using Amazon S3 to store sensitive customer data. They want to ensure that only authorized users can access this data and that all access is logged for compliance reasons. Which combination of features should the company implement to achieve this?
- A. Amazon S3 bucket policy and Amazon CloudWatch Logs
- B. IAM roles and Amazon S3 Server Access Logging
- C. AWS Lambda and Amazon S3 Object Locking
- D. Amazon S3 Versioning and AWS Config
Think before you scroll
Take a moment to consider the requirements: access control and logging. Certain options may focus on one aspect but not both. Prioritize features that provide comprehensive access management and compliance tracking.
The answer
B. IAM roles and Amazon S3 Server Access Logging is the correct option. IAM roles offer precise control over who can access the data stored in S3. Enabling Server Access Logging ensures that all access requests to the S3 bucket are logged, fulfilling compliance requirements.
Why the other options lose
- A. Amazon S3 bucket policy and Amazon CloudWatch Logs: While bucket policies can control access, CloudWatch Logs do not provide the specific access logging needed for S3. Therefore, this option lacks comprehensive logging.
- C. AWS Lambda and Amazon S3 Object Locking: This combination does not address access control or logging directly. Lambda is for event-driven functions, and Object Locking is for retention, not access management.
- D. Amazon S3 Versioning and AWS Config: Versioning helps with data recovery but does not control access or log access events. AWS Config tracks resource configurations but does not log individual access requests.
The concept behind it
Understanding data governance is crucial. Secure data access requires both control and logging. IAM roles allow you to define who can do what with your data, while Server Access Logging provides the audit trail needed for compliance. This principle applies across AWS services where data security is a concern.
Exam trap to remember
Always remember: access control without logging does not meet compliance needs. Ensure both aspects are covered in your answers.