Data Warehousing on AWS Training Data Warehousing on AWS: Security and Access Control 2 — Questions and Answers
Question 1: Which AWS service allows you to centrally manage fine-grained access control for Amazon Redshift tables and columns?
- AWS Lake Formation (Correct answer)
- AWS IAM
- Amazon Macie
- AWS Glue
Correct answer: AWS Lake Formation
AWS Lake Formation provides centralized, fine-grained access control at the table and column level for data stored in data lakes, including Redshift Spectrum.
Question 2: An organization wants to prevent Redshift users from accessing certain columns containing PII data. What is the most appropriate approach?
- Delete the PII columns before loading data
- Use Redshift column-level access control with GRANT/REVOKE statements (Correct answer)
- Enable S3 server-side encryption
- Use AWS Shield to block user queries
Correct answer: Use Redshift column-level access control with GRANT/REVOKE statements
Redshift supports column-level access control using GRANT and REVOKE SQL statements to restrict access to specific columns for individual users or groups.
Question 3: What is the purpose of enabling 'Enhanced VPC Routing' in Amazon Redshift?
- To increase query performance by routing traffic through faster nodes
- To force all COPY and UNLOAD traffic through the VPC instead of the public internet (Correct answer)
- To enable multi-AZ deployments for Redshift clusters
- To encrypt data at rest using VPC-managed keys
Correct answer: To force all COPY and UNLOAD traffic through the VPC instead of the public internet
Enhanced VPC Routing forces all COPY and UNLOAD traffic between the cluster and data repositories through your VPC, enabling VPC security features like security groups and NACLs.
Question 4: A security audit reveals that an Amazon Redshift cluster's audit logs are not being captured. Where should audit logging be configured to send logs?
- Amazon CloudWatch Logs or Amazon S3 (Correct answer)
- AWS CloudTrail only
- Amazon DynamoDB
- AWS Config
Correct answer: Amazon CloudWatch Logs or Amazon S3
Redshift audit logging can be configured to send connection logs, user logs, and user activity logs to either Amazon S3 or Amazon CloudWatch Logs.
Question 5: Which Redshift feature allows you to define row-level security policies so different users see different subsets of data in the same table?
- Redshift Workload Management (WLM)
- Redshift Row-Level Security (RLS) (Correct answer)
- Redshift Spectrum filters
- Redshift data sharing
Correct answer: Redshift Row-Level Security (RLS)
Amazon Redshift Row-Level Security (RLS) allows administrators to create policies that restrict which rows a user can access in a table based on defined predicates.
Question 6: When using AWS KMS with Amazon Redshift, what happens to data during a cluster restore from a snapshot if the KMS key has been deleted?
- Redshift automatically generates a new key
- The restore will fail because the data cannot be decrypted (Correct answer)
- The data is restored in unencrypted form
- AWS Support can recover the key automatically
Correct answer: The restore will fail because the data cannot be decrypted
If the KMS key used to encrypt a Redshift cluster is deleted, snapshots encrypted with that key cannot be restored because the decryption key is no longer available.
Question 7: A company requires that database administrators cannot view sensitive salary data in Redshift. Which combination of features best achieves this?
- S3 bucket policies and IAM roles
- Column-level access control combined with dynamic data masking (Correct answer)
- VPC security groups and NACLs
- Redshift workload management and query monitoring rules
Correct answer: Column-level access control combined with dynamic data masking
Combining column-level access control with dynamic data masking allows you to restrict or obfuscate sensitive columns even from privileged users like DBAs.
Data Warehousing on AWS Training Data Warehousing on AWS: Security and Access Control 2
Which AWS service allows you to centrally manage fine-grained access control for Amazon Redshift tables and columns?