ExamPark
Course menuDEA-C01

Exams / DEA-C01 / Audit logs, PII and data governance / Question 1

DEA-C01 practice question: Audit logs, PII and data governance

Data Security and Governance A free question from our original DEA-C01 practice exam. Try it, then open the answer to see why each option is right or wrong.

Last verified against current AWS documentation ·How we write our questions

A regulated insurer keeps its data lake in about 200 Amazon S3 buckets in one account. Auditors require a record of every change to each bucket's settings, such as default encryption and public access, with the time of each change.

The security team also wants to be notified when any bucket loses default encryption or allows public reads. It does not want to build custom scanners.

Which TWO actions meet these requirements? (Choose two.)

Choose two answers.

  1. A. Turn on AWS Config recording for S3 buckets, so that every change to a bucket's configuration is kept in its configuration history.
  2. B. Turn on CloudTrail Insights for the account, so that unusual changes to bucket settings are flagged in the CloudTrail console.
  3. C. Add AWS Config managed rules that check bucket encryption and public read access, and send compliance changes to an SNS topic.
  4. D. Create an S3 Inventory report for each bucket, and review the encryption status column in the reports every week.
  5. E. Write a Lambda function that lists every bucket each hour and stores its settings in a DynamoDB table for the auditors.
Show the answer and explanation

Answers: A, C

  • A. Right: Correct. AWS Config records the configuration of the resource types you choose and keeps a history of each change. Auditors can see what a bucket's settings were at any point while recording was on. Learn more: What is AWS Config? (opens in a new tab)
  • B. Wrong: CloudTrail Insights flags unusual API call volumes or error rates, not a bucket's current settings. It neither keeps a configuration history nor checks encryption or public access.
  • C. Right: Correct. Managed rules such as s3-bucket-server-side-encryption-enabled and s3-bucket-public-read-prohibited are evaluated as buckets change. A noncompliant result can notify the security team without any custom scanner. Learn more: List of AWS Config managed rules (opens in a new tab)
  • D. Wrong: S3 Inventory lists objects and their encryption status, not bucket settings such as public access. A weekly manual review also gives no timely alert or change history.
  • E. Wrong: This is the custom scanner the team wants to avoid. An hourly snapshot can also miss changes that are made and reversed between runs.

Explanation

AWS Config answers both needs. Its recorder keeps a configuration history of every bucket, and managed rules evaluate encryption and public access as buckets change, so noncompliance can trigger a notification. CloudTrail Insights, S3 Inventory and a custom scanner miss the history, the bucket settings or the no-custom-code requirement.

Study

Keep practicing

Answer questions with a score at the end, or practice just this topic with the explanation after each one. No sign-up needed.

Take the free DEA-C01 practice examPractice Audit logs, PII and data governanceAll Audit logs, PII and data governance questions

Want more on Audit logs, PII and data governance? The 5 full-length practice sets have 6 more Audit logs, PII and data governance questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets