DEA-C01 practice question: Encryption and masking (1 of 2)
Data Security and Governance A free question from our original DEA-C01 practice exam. Try it, then open the answer to see why each option is right or wrong.
A bank's central data account stores encrypted loan files in an Amazon S3 bucket, using a customer managed KMS key that the central account owns. A reporting account runs an AWS Glue job that must read those files. The reporting account's Glue role has full S3 read access to the bucket, but the job fails with access denied when it tries to decrypt the files.
The central team wants to keep the key in its own account and to grant access to only the reporting account's Glue role.
Which change meets these requirements?
Choose one answer.
AA. Turn off the key's encryption for the bucket and use S3 managed keys, so the reporting account needs no KMS key.
BB. Give the reporting account's Glue role a copy of the central account's administrator role, so that it can use every KMS key there.
CC. Copy the encrypted files to the reporting account, and re-encrypt them there with a key that the reporting account owns.
DD. Grant the reporting account's Glue role kms:Decrypt in the key policy, and the same action in its own IAM policy.
Show the answer and explanation
Answer: D
A. Wrong: Turning off KMS removes the customer managed key the bank requires, and it changes the protection of the data. The option breaks the stated encryption requirement.
B. Wrong: Sharing the administrator role gives the reporting account control over every key and resource in the central account. The option grants far more than the single decrypt the job needs.
C. Wrong: Copying the data duplicates the loan files outside the central account and gives the central team no control over them. The option also needs a re-encryption job the team does not want.
D. Right: Correct. Cross-account KMS use needs permission in both places: the key policy in the owning account and an IAM policy on the principal in its own account. Granting only one of them leaves the decrypt call denied, and this design grants both to the one role. Learn more: Allowing users in other accounts to use a KMS key (opens in a new tab)
Explanation
Using a KMS key from another account needs two grants that point at each other: the owning account's key policy must allow the external principal, and that principal's own IAM policy must allow the KMS action. Granting only the key policy or only the IAM policy is not enough. Turning encryption off, sharing an admin role or copying the files each break a stated requirement.
Want more on Encryption and masking? The 5 full-length practice sets have 7 more Encryption and masking questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →