Data Warehousing on AWS Training Data Warehousing on AWS: Security and Access Control 4 — Questions and Answers
Question 1: A Redshift cluster uses hardware security module (HSM) encryption. What must be done before migrating the cluster to a new region?
- Disable HSM encryption before migration
- Set up an HSM in the target region and configure a trusted connection before restoring the snapshot (Correct answer)
- Convert to KMS encryption then migrate and convert back to HSM
- HSM-encrypted clusters cannot be migrated between regions
Correct answer: Set up an HSM in the target region and configure a trusted connection before restoring the snapshot
To restore an HSM-encrypted Redshift snapshot in another region, you must first establish a trusted HSM connection in the target region before attempting the restore.
Question 2: Which Redshift feature allows different business units to securely share live data without copying it to separate clusters?
- Redshift Spectrum
- Redshift data sharing (Correct answer)
- Redshift federated query
- Redshift COPY command with IAM roles
Correct answer: Redshift data sharing
Redshift data sharing allows producer clusters to share live, transactionally consistent data with consumer clusters without data movement or copying.
Question 3: When configuring Redshift data sharing between accounts, what IAM action must be explicitly granted to the consumer account?
- redshift:AuthorizeDataShare
- redshift:AssociateDataShareConsumer (Correct answer)
- redshift:CreateDataShare
- redshift:AcceptDataShare
Correct answer: redshift:AssociateDataShareConsumer
The redshift:AssociateDataShareConsumer action must be granted to allow a consumer account to associate itself with a data share from a producer cluster.
Question 4: An administrator needs to rotate the encryption key for an existing Amazon Redshift cluster without downtime. What is the correct procedure?
- Delete and recreate the cluster with a new key
- Use the AWS console or CLI to rotate the encryption key; Redshift handles the process with minimal disruption (Correct answer)
- Restore from the latest snapshot with a new key
- Change the KMS key alias to point to a new key
Correct answer: Use the AWS console or CLI to rotate the encryption key; Redshift handles the process with minimal disruption
Amazon Redshift supports in-place encryption key rotation through the console or CLI, which re-encrypts the cluster with a new key while keeping the cluster available.
Question 5: A security policy requires all Redshift connections to use FIPS 140-2 compliant endpoints. How should this be configured?
- Enable the require_ssl cluster parameter
- Use the FIPS-compliant Redshift endpoint (redshift-fips.amazonaws.com) in connection strings (Correct answer)
- Enable Enhanced VPC Routing and use private endpoints
- Configure SSL certificates from an approved CA
Correct answer: Use the FIPS-compliant Redshift endpoint (redshift-fips.amazonaws.com) in connection strings
AWS provides FIPS 140-2 compliant endpoints for Redshift in select regions, accessible via the redshift-fips.amazonaws.com endpoint prefix.
Question 6: Which Redshift object type should be used to give a group of users read-only access to multiple schemas without granting individual table permissions?
- Redshift views
- Redshift stored procedures
- Redshift roles with schema-level USAGE and table-level SELECT privileges (Correct answer)
- Redshift workload management queues
Correct answer: Redshift roles with schema-level USAGE and table-level SELECT privileges
Creating Redshift roles and granting USAGE on schemas plus SELECT on tables provides a manageable, reusable way to assign read-only access to multiple users via role assignment.
Question 7: What is the security implication of using the Redshift superuser account (the initial admin user) for routine ETL operations?
- Superusers cannot run COPY commands, making ETL impossible
- Using superusers violates least privilege and any compromise gives full database access (Correct answer)
- Superuser sessions consume more WLM queue slots
- Superusers are automatically logged out after 30 minutes
Correct answer: Using superusers violates least privilege and any compromise gives full database access
Using superuser accounts for ETL violates the principle of least privilege; a compromise of these credentials grants unrestricted access to all data and schema modifications.
Data Warehousing on AWS Training Data Warehousing on AWS: Security and Access Control 4
A Redshift cluster uses hardware security module (HSM) encryption.
What must be done before migrating the cluster to a new region?