Data Warehousing on AWS Training Data Warehousing on AWS: Security and Access Control 5 — Questions and Answers
Question 1: A compliance team requires proof that no unauthorized access to Redshift occurred in the last 90 days. Which combination of services provides this evidence?
- Amazon CloudWatch metrics and AWS Trusted Advisor
- Redshift audit logs in S3 and AWS CloudTrail API activity logs (Correct answer)
- Amazon Inspector reports and VPC Flow Logs
- AWS Config snapshots and Amazon Macie findings
Correct answer: Redshift audit logs in S3 and AWS CloudTrail API activity logs
Redshift audit logs capture database-level activity (connections, queries) while CloudTrail records API-level actions, together providing comprehensive access audit trails.
Question 2: Which Redshift dynamic data masking policy type would replace a credit card number like '4111-1111-1111-1111' with '****-****-****-1111' for non-privileged users?
- Full masking
- Partial masking (Correct answer)
- Hash masking
- Nullify masking
Correct answer: Partial masking
Partial masking in Redshift dynamic data masking reveals only a portion of the data (e.g., last 4 digits) while obscuring the rest, useful for showing partial identifiers.
Question 3: An organization uses Redshift Serverless. How does VPC configuration differ from provisioned Redshift clusters with respect to security?
- Redshift Serverless does not support VPC deployment
- Redshift Serverless is deployed within a VPC and uses security groups similarly to provisioned clusters (Correct answer)
- Redshift Serverless automatically creates a new VPC for each workgroup
- VPC security groups do not apply to Redshift Serverless endpoints
Correct answer: Redshift Serverless is deployed within a VPC and uses security groups similarly to provisioned clusters
Redshift Serverless workgroups are deployed within a customer VPC and use security groups and subnets to control network access, similar to provisioned clusters.
Question 4: A developer accidentally granted SELECT on a sensitive table to the PUBLIC group in Redshift. What is the fastest way to remediate this?
- Drop and recreate the table
- Execute REVOKE SELECT ON TABLE sensitive_table FROM PUBLIC (Correct answer)
- Disable the PUBLIC group via a cluster parameter
- Rename the table to remove it from PUBLIC visibility
Correct answer: Execute REVOKE SELECT ON TABLE sensitive_table FROM PUBLIC
The REVOKE SQL statement removes previously granted privileges; revoking SELECT from PUBLIC immediately removes the inadvertent broad access.
Question 5: Which AWS service provides automated security assessments of Amazon Redshift cluster configurations against AWS best practices?
- Amazon Detective
- AWS Trusted Advisor
- Amazon Inspector
- AWS Security Hub with Redshift controls (Correct answer)
Correct answer: AWS Security Hub with Redshift controls
AWS Security Hub includes built-in security controls for Amazon Redshift that automatically assess configurations against AWS Foundational Security Best Practices.
Question 6: What is the recommended approach to prevent Redshift query results from being written to S3 paths outside an approved prefix using the UNLOAD command?
- Disable the UNLOAD command via a cluster parameter
- Use IAM role policies on the cluster's attached role to restrict S3 PutObject to approved prefixes only (Correct answer)
- Enable Enhanced VPC Routing to block S3 access
- Use S3 Object Lock on all buckets
Correct answer: Use IAM role policies on the cluster's attached role to restrict S3 PutObject to approved prefixes only
By scoping the cluster's IAM role permissions with S3 resource ARN conditions limited to approved bucket prefixes, you prevent UNLOAD from writing to unauthorized locations.
Question 7: A Redshift cluster must meet a compliance requirement that all data at rest be encrypted, including temporary files and system tables. Which encryption option satisfies this requirement?
- SSL/TLS in transit encryption only
- Redshift cluster encryption at rest using KMS, which encrypts all data including temporary files and system tables (Correct answer)
- S3-SSE on the associated S3 bucket
- Client-side encryption before loading data
Correct answer: Redshift cluster encryption at rest using KMS, which encrypts all data including temporary files and system tables
Enabling Redshift cluster-level encryption at rest using KMS encrypts all data including user data, system tables, snapshots, and temporary files written to disk.
Data Warehousing on AWS Training Data Warehousing on AWS: Security and Access Control 5
A compliance team requires proof that no unauthorized access to Redshift occurred in the last 90 days.
Which combination of services provides this evidence?