Data Warehousing on AWS Training Data Warehousing on AWS: Security and Access Control 3

Question 1

Which IAM policy condition key can restrict Redshift API calls to requests originating from specific IP addresses?

Accepted Answer

aws:SourceIp

Answer

The aws:SourceIp condition key in IAM policies restricts API calls to those originating from specified IP address ranges.

Question 2

What is the security advantage of using IAM authentication with Amazon Redshift compared to database password authentication?

Accepted Answer

IAM credentials are temporary and automatically rotated, reducing the risk of credential compromise

Answer

IAM authentication generates temporary credentials that expire automatically, eliminating long-lived passwords that could be compromised and reducing the attack surface.

Question 3

An AWS Glue job needs to read data from an encrypted Amazon Redshift cluster. What is the recommended way to store the Redshift credentials for the Glue job?

Accepted Answer

Store them in AWS Secrets Manager and reference them in the Glue connection

Answer

AWS Secrets Manager is the recommended service for storing database credentials, and AWS Glue has native integration to retrieve secrets for data connections.

Question 4

Which Redshift cluster parameter controls whether SSL connections are required for all client connections?

Accepted Answer

require_ssl

Answer

The require_ssl cluster parameter, when set to true, forces all client connections to use SSL/TLS, rejecting non-encrypted connections.

Question 5

A data engineer wants to query data in S3 from Redshift Spectrum but must ensure only authorized S3 paths are accessible. Which approach enforces this?

Accepted Answer

Use S3 bucket policies and IAM role permissions attached to the Redshift cluster

Answer

S3 bucket policies combined with IAM role permissions on the Redshift cluster control which S3 paths and objects Spectrum queries can access.

Data Warehousing on AWS Training Practice Test

Data Warehousing on AWS Training Practice Test

Data Warehousing on AWS Training Data Warehousing on AWS: Security and Access Control 3