Play free

Data World 4 · Lake Guardians · Stage 5

Lock the Data

One new key, three broken jobs: find who actually calls KMS.

  • SSE-KMS
  • Key policies
  • Service roles
  • S3 Bucket Keys
  • TLS
Domain
Data engineering
World
Data World 4: Lake Guardians (Associate)
Game type
Lake access: Grant a governed lake's tables; the matrix shows each principal's cells.
Time
About 25 minutes on a first attempt (estimated)
Exam guides
  • SAA-C03Task 1.3: Determine appropriate data security controls
  • DEA-C01Skill 4.3.2: Use encryption keys to encrypt or decrypt data (for example, AWS KMS); Skill 4.3.4: Enable encryption in transit or before transit for data; Skill 4.1.4: Set up IAM roles for access (for example, AWS Lambda, Amazon API Gateway, AWS CLI, AWS CloudFormation); Skill 4.2.1: Create custom IAM policies when a managed policy does not meet the needs
  • SCS-C03Skill 5.2.1: Design, implement, and configure data encryption at rest based on specific requirements (for example, by selecting the appropriate encryption key service such as AWS CloudHSM or AWS KMS or by selecting the appropriate encryption type such as client-side encryption or server-side encryption); Skill 5.1.1: Design and configure mechanisms to require encryption when connecting to connect to resources (for example, by configuring Elastic Load Balancing [ELB] security policies, by enforcing TLS configurations)