DEA-C01 Question 471
Select 3You are designing a data pipeline on AWS to process sensitive customer information. The pipeline involves storing data in Amazon S3, processing it with AWS Glue, and storing the results in Amazon Redshift. To comply with company policies and prevent unauthorized access, which combination of methods should you implement?
- A
Enable server-side encryption (SSE) on the S3 bucket and use an AWS Key Management Service (KMS) key.
- B
Grant S3 bucket access to all AWS accounts to simplify data sharing across services.
- C
Configure AWS Glue to use an IAM role with fine-grained permissions for accessing specific S3 buckets and tables.
- D
Enable VPC endpoints for S3 and Redshift to ensure all data traffic remains within the AWS network.
- E
Disable encryption in Amazon Redshift to improve query performance.
Show answer and explanation
Correct answers: A, C, D
Explanation
To protect sensitive data from unauthorized access, it is essential to implement encryption for data at rest (S3 and Redshift), use IAM roles with fine-grained permissions for services like AWS Glue, and ensure secure data transfer by enabling VPC endpoints. Avoid practices that expose data unnecessarily, such as granting excessive permissions or disabling encryption.
- A. Correct.
Enabling server-side encryption (SSE) with an AWS Key Management Service (KMS) key ensures that data at rest in S3 is encrypted, protecting it from unauthorized access.
- B. Incorrect.
Granting S3 bucket access to all AWS accounts exposes the data to unnecessary risks and violates the principle of least privilege.
- C. Correct.
Configuring AWS Glue to use an IAM role with fine-grained permissions ensures that the service has only the access it needs, minimizing the risk of unauthorized access.
- D. Correct.
Enabling VPC endpoints for S3 and Redshift ensures that data traffic does not traverse the public internet, providing an additional layer of security.
- E. Incorrect.
Disabling encryption in Amazon Redshift compromises data security and is not recommended when handling sensitive information.