Audit logs, PII and data governance: DEA-C01 study notes and practice questions
What to know about Audit logs, PII and data governance for the DEA-C01 exam, from the Data Security and Governance domain (18% of the exam guide), then 1 free question to test it. Part of the DEA-C01 study guide.
Audit and governance questions describe a compliance ask and ask which managed service gives the evidence or control with least effort.
Logging access
CloudTrail management events record control-plane calls (create table, change policy) and are on by default for 90 days in event history.
CloudTrail data events record object-level S3 reads and writes, Lambda invokes and DynamoDB item calls. They’re off by default and cost extra; turn them on for sensitive buckets.
A trail delivers logs to S3 for long retention; an organization trail covers every account. Turn on log file validation.
CloudTrail Lake stores events and lets you query them with SQL.
S3 server access logs give request-level detail for buckets.
Service logs: Redshift audit logging, Lake Formation access in CloudTrail, Athena query history.
Analyze logs with Athena, CloudWatch Logs Insights or OpenSearch.
Finding and classifying data
Amazon Macie discovers PII and other sensitive data in S3 with managed and custom data identifiers, and sends findings to EventBridge and Security Hub CSPM.
Glue sensitive data detection and DataBrew PII detection mask data in pipelines.
SageMaker Catalog (Amazon DataZone) adds business metadata, data ownership and governed subscription to data products.
Enforcing rules
AWS Config rules detect non-compliant resources (unencrypted buckets, public access) and can auto-remediate; conformance packs group rules.
Organizations SCPs block actions across accounts, such as leaving allowed Regions or disabling CloudTrail.
S3 Block Public Access at account level.
Lake Formation and Redshift fine-grained permissions.
Data residency: keep data in approved Regions with SCPs and replication settings.
Common traps
Expecting management events to show who read an object. That needs data events.
Writing scripts to scan S3 for PII. Use Macie.
Config for access logging. Config tracks resource settings; CloudTrail records actions.
A regulated insurer keeps its data lake in about 200 Amazon S3 buckets in one account. Auditors require a record of every change to each bucket's settings, such as default encryption and public access, with the time of each change.
The security team also wants to be notified when any bucket loses default encryption or allows public reads. It does not want to build custom scanners.
Which TWO actions meet these requirements? (Choose two.)
Choose two answers.
AA. Turn on AWS Config recording for S3 buckets, so that every change to a bucket's configuration is kept in its configuration history.
BB. Turn on CloudTrail Insights for the account, so that unusual changes to bucket settings are flagged in the CloudTrail console.
CC. Add AWS Config managed rules that check bucket encryption and public read access, and send compliance changes to an SNS topic.
DD. Create an S3 Inventory report for each bucket, and review the encryption status column in the reports every week.
EE. Write a Lambda function that lists every bucket each hour and stores its settings in a DynamoDB table for the auditors.
Show the answer and explanation
Answers: A, C
A. Right: Correct. AWS Config records the configuration of the resource types you choose and keeps a history of each change. Auditors can see what a bucket's settings were at any point while recording was on. Learn more: What is AWS Config? (opens in a new tab)
B. Wrong: CloudTrail Insights flags unusual API call volumes or error rates, not a bucket's current settings. It neither keeps a configuration history nor checks encryption or public access.
C. Right: Correct. Managed rules such as s3-bucket-server-side-encryption-enabled and s3-bucket-public-read-prohibited are evaluated as buckets change. A noncompliant result can notify the security team without any custom scanner. Learn more: List of AWS Config managed rules (opens in a new tab)
D. Wrong: S3 Inventory lists objects and their encryption status, not bucket settings such as public access. A weekly manual review also gives no timely alert or change history.
E. Wrong: This is the custom scanner the team wants to avoid. An hourly snapshot can also miss changes that are made and reversed between runs.
Explanation
AWS Config answers both needs. Its recorder keeps a configuration history of every bucket, and managed rules evaluate encryption and public access as buckets change, so noncompliance can trigger a notification. CloudTrail Insights, S3 Inventory and a custom scanner miss the history, the bucket settings or the no-custom-code requirement.
Want more on Audit logs, PII and data governance? The 5 full-length practice sets have 6 more Audit logs, PII and data governance questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →