Data Warehousing on AWS Training Data Warehousing on AWS: Security and Access Control 4

Question 1

A Redshift cluster uses hardware security module (HSM) encryption. What must be done before migrating the cluster to a new region?

Accepted Answer

Set up an HSM in the target region and configure a trusted connection before restoring the snapshot

Answer

To restore an HSM-encrypted Redshift snapshot in another region, you must first establish a trusted HSM connection in the target region before attempting the restore.

Question 2

Which Redshift feature allows different business units to securely share live data without copying it to separate clusters?

Accepted Answer

Redshift data sharing

Answer

Redshift data sharing allows producer clusters to share live, transactionally consistent data with consumer clusters without data movement or copying.

Question 3

When configuring Redshift data sharing between accounts, what IAM action must be explicitly granted to the consumer account?

Accepted Answer

redshift:AssociateDataShareConsumer

Answer

The redshift:AssociateDataShareConsumer action must be granted to allow a consumer account to associate itself with a data share from a producer cluster.

Question 4

An administrator needs to rotate the encryption key for an existing Amazon Redshift cluster without downtime. What is the correct procedure?

Accepted Answer

Use the AWS console or CLI to rotate the encryption key; Redshift handles the process with minimal disruption

Answer

Amazon Redshift supports in-place encryption key rotation through the console or CLI, which re-encrypts the cluster with a new key while keeping the cluster available.

Question 5

A security policy requires all Redshift connections to use FIPS 140-2 compliant endpoints. How should this be configured?

Accepted Answer

Use the FIPS-compliant Redshift endpoint (redshift-fips.amazonaws.com) in connection strings

Answer

AWS provides FIPS 140-2 compliant endpoints for Redshift in select regions, accessible via the redshift-fips.amazonaws.com endpoint prefix.

Data Warehousing on AWS Training Practice Test

Data Warehousing on AWS Training Practice Test

Data Warehousing on AWS Training Data Warehousing on AWS: Security and Access Control 4