Crucial Exams

AWS Certified Data Engineer Associate DEA-C01 Practice Question

Your company stores transaction data in the S3 bucket finance-data.

  • AWS Glue ETL jobs must write files only to the raw/ and cleaned/ prefixes.
  • Business analysts run queries with Amazon Athena and must read objects only from cleaned/. You must implement least-privilege, role-based access without granting bucket-wide permissions. Which approach meets these requirements?

  • Enable Amazon S3 Access Analyzer on the bucket, then assign a single IAM role with s3:* permissions on finance-data to all users and jobs, relying on Access Analyzer findings to verify least privilege.

  • Create two IAM roles. Attach a policy to GlueRole that allows s3:PutObject and s3:DeleteObject on finance-data/raw/* and finance-data/cleaned/, and to AnalystRole that allows s3:GetObject and s3:ListBucket with a prefix condition for finance-data/cleaned/. Configure the Glue job and analyst sessions to assume the appropriate role.

  • Add a bucket policy that grants the entire development AWS account full access to finance-data and manage access for Glue and analysts only with identity-based policies inside that account.

  • Attach the AWS managed policy AmazonS3FullAccess to the Glue job's role and AWS managed policy ReadOnlyAccess to all analyst IAM users.

AWS Certified Data Engineer Associate DEA-C01
Data Security and Governance
Your Score:
Settings & Objectives
Random Mixed
Questions are selected randomly from all chosen topics, with a preference for those you haven’t seen before. You may see several questions from the same objective or domain in a row.
Rotate by Objective
Questions cycle through each objective or domain in turn, helping you avoid long streaks of questions from the same area. You may see some repeat questions, but the distribution will be more balanced across topics.

Check or uncheck an objective to set which questions you will receive.

Wipe Score
Bash, the Crucial Exams Chat Bot
AI Bot