Data Warehousing on AWS Training Data Warehousing on AWS: Security and Access Control 5

Question 1

A compliance team requires proof that no unauthorized access to Redshift occurred in the last 90 days. Which combination of services provides this evidence?

Accepted Answer

Redshift audit logs in S3 and AWS CloudTrail API activity logs

Answer

Redshift audit logs capture database-level activity (connections, queries) while CloudTrail records API-level actions, together providing comprehensive access audit trails.

Question 2

Which Redshift dynamic data masking policy type would replace a credit card number like '4111-1111-1111-1111' with '****-****-****-1111' for non-privileged users?

Accepted Answer

Partial masking

Answer

Partial masking in Redshift dynamic data masking reveals only a portion of the data (e.g., last 4 digits) while obscuring the rest, useful for showing partial identifiers.

Question 3

An organization uses Redshift Serverless. How does VPC configuration differ from provisioned Redshift clusters with respect to security?

Accepted Answer

Redshift Serverless is deployed within a VPC and uses security groups similarly to provisioned clusters

Answer

Redshift Serverless workgroups are deployed within a customer VPC and use security groups and subnets to control network access, similar to provisioned clusters.

Question 4

A developer accidentally granted SELECT on a sensitive table to the PUBLIC group in Redshift. What is the fastest way to remediate this?

Accepted Answer

Execute REVOKE SELECT ON TABLE sensitive_table FROM PUBLIC

Answer

The REVOKE SQL statement removes previously granted privileges; revoking SELECT from PUBLIC immediately removes the inadvertent broad access.

Question 5

Which AWS service provides automated security assessments of Amazon Redshift cluster configurations against AWS best practices?

Accepted Answer

AWS Security Hub with Redshift controls

Answer

AWS Security Hub includes built-in security controls for Amazon Redshift that automatically assess configurations against AWS Foundational Security Best Practices.

Data Warehousing on AWS Training Practice Test

Data Warehousing on AWS Training Practice Test

Data Warehousing on AWS Training Data Warehousing on AWS: Security and Access Control 5