Chapter 4 of 4 · AWS DEA-C01
Data Security and Governance
Authentication, authorization, encryption, masking, audit logs, privacy and governance.
- 7topics
- 35 minfast track
- 3diagrams and exhibits
- 18%of the exam
Topics in this chapter
Take them in order, or jump to the one you need.
- 1Authentication MechanismsApply authentication for AWS data services with IAM roles, temporary credentials, Secrets Manager, Parameter Store, database sign…Diagram5 min
- 2IAM Authorization and Access ControlApply authorization with IAM identity and resource policies, least privilege, tags, bucket policies, access points, Redshift…5 min
- 3Lake Formation PermissionsControl data lake access with AWS Lake Formation: registered locations, column, row and cell permissions, LF tags, cross account…Diagram5 min
- 4Encryption with KMSEncrypt data at rest and in transit on AWS with KMS keys, S3 server side encryption options, key policies, rotation, bucket keys…Diagram5 min
- 5Data Masking and AnonymizationProtect sensitive fields with masking, hashing, tokenization and anonymization using Redshift masking, Glue and DataBrew PII…5 min
- 6Audit Logging on AWSPrepare logs for audit with CloudTrail and CloudTrail Lake, CloudWatch Logs, S3 and Redshift audit logs, retention, integrity…5 min
- 7Data Privacy and GovernanceApply data privacy and governance on AWS with Macie, classification, Region controls, SCPs, AWS Config, erasure requests and…5 min
About this chapter
What this chapter covers
This chapter covers how to protect data and prove that it is protected. It moves from who you are, to what you may do, to how data is hidden, recorded and governed.
It has five outline topics: authentication, authorization, encryption and masking, audit logs, and privacy and governance. Authorization and encryption and masking each need two pages, so seven pages cover the five topics.
The chapter follows the fourth domain of the AWS Certified Data Engineer Associate DEA-C01 exam guide.
How the topics fit together
Security questions usually combine several layers, so the pages follow the path of a request.
- Authentication proves identity with roles, temporary credentials, secrets and private networks.
- Authorization decides access with IAM policies and Lake Formation grants.
- Encryption protects data at rest and in transit, and masking hides sensitive fields.
- Audit logging records activity with CloudTrail, CloudWatch Logs and service logs.
- Privacy and governance adds classification, Region control, compliance checks and safe sharing.
Security answers on this exam usually prefer managed, least privilege and automated options over manual or broad ones.
How to use these pages
Each topic page has the same shape, so you can skim for what you need.
- What it is: the idea in plain words.
- How it works: the mechanism, with diagrams and examples.
- What to remember for the exam: the facts to memorise.
- Common mistakes: the classic traps.
- Check yourself: three questions to test your understanding.
Read the policy examples slowly. Many questions turn on one detail, such as a bucket ARN compared with an object ARN, or a key policy that is missing.
Ready for more practice?
The full AWS DEA-C01 question bank has 845 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by AWS. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.