MCQs on Security and Compliance | AWS Amazon Athena MCQs Questions
Amazon Athena is a powerful, serverless query service that ensures robust security and compliance for data analytics. This set of 30 MCQs focuses on Access Control and Encryption, Role-Based Permissions, and Audit and Compliance Best Practices to help you prepare for certifications and job interviews.
Access Control and Encryption (10 Questions)
- What type of encryption does Amazon Athena support for query results?
a) Server-side encryption with S3 managed keys
b) Client-side encryption
c) Database-level encryption
d) SSL/TLS only - Which service is used to manage encryption keys in Amazon Athena?
a) AWS Key Management Service (KMS)
b) AWS CloudTrail
c) AWS Identity and Access Management (IAM)
d) AWS Glue - What must be enabled in S3 to encrypt Athena query results?
a) Versioning
b) Bucket policies
c) Default encryption
d) Cross-region replication - How does Athena encrypt data in transit?
a) Using SSL/TLS
b) Through IAM policies
c) By enabling S3 encryption
d) It doesn’t encrypt data in transit - Which encryption option in Athena provides customer-managed keys?
a) AES-256
b) KMS Customer Master Key (CMK)
c) Default S3 encryption
d) Transparent Data Encryption - Can Athena query encrypted data stored in S3?
a) No, encrypted data must be decrypted manually
b) Yes, but only if KMS is used
c) Yes, with proper permissions
d) No, Athena does not support encrypted data - Which of the following is required to access encrypted data in Athena?
a) Data transfer acceleration
b) IAM policy with KMS permissions
c) VPC endpoint configuration
d) CloudFormation template - How can you secure Athena query results in S3?
a) Use signed URLs
b) Enable public access
c) Encrypt with KMS keys
d) Use S3 Transfer Acceleration - What is the default encryption method for query results in Athena?
a) None
b) SSE-S3
c) KMS
d) Client-side encryption - To use KMS-encrypted S3 buckets with Athena, what must be added to the KMS key policy?
a) IAM roles for Athena
b) S3 bucket ARN
c) Glue Data Catalog permissions
d) IAM users for all accounts
Role-Based Permissions (10 Questions)
- What service is primarily used for role-based permissions in Athena?
a) Amazon CloudWatch
b) AWS IAM
c) AWS Config
d) AWS Secrets Manager - Which role is required for Athena to read S3 data?
a) Lambda Execution Role
b) S3 ReadOnly Role
c) Athena Execution Role
d) Glue Service Role - What is the purpose of a resource-based policy in Athena?
a) To limit the size of queries
b) To define cross-account access permissions
c) To enable encryption
d) To monitor query performance - How can you restrict Athena queries to specific S3 buckets?
a) Use bucket policies
b) Use IAM roles
c) Configure Glue Data Catalog
d) Use CloudTrail logs - What is the minimum required permission to allow an IAM user to run queries in Athena?
a)athena:RunQuery
b)s3:ListBucket
c)athena:StartQueryExecution
d)s3:GetObject - How can you enforce fine-grained access control in Athena?
a) Using Glue tables with resource tags
b) By limiting query concurrency
c) Using S3 lifecycle policies
d) By monitoring query logs - Which of the following is an optional but recommended role for managing Athena permissions?
a) CloudFormation Execution Role
b) AWS Config Role
c) Service-linked role for Athena
d) AWS X-Ray Role - How do IAM policies control access to Athena resources?
a) By enabling auto-scaling
b) By defining users and groups
c) Through policy conditions and actions
d) By creating multiple data partitions - What is the effect of denying
s3:GetObjectin an IAM policy for Athena queries?
a) Queries will fail
b) Athena will skip missing files
c) Results will be partially fetched
d) S3 bucket encryption is disabled - Can you use temporary security credentials to access Athena?
a) No, only permanent credentials are allowed
b) Yes, with roles assumed through STS
c) Yes, but only for Glue Data Catalog
d) No, Athena requires predefined roles
Audit and Compliance Best Practices (10 Questions)
- Which AWS service can log all Athena query activity for auditing purposes?
a) AWS CloudTrail
b) AWS Config
c) AWS Glue
d) Amazon S3 - What information does CloudTrail provide for Athena queries?
a) Query results
b) Query syntax
c) User activity and timestamps
d) Query optimization suggestions - How can you ensure compliance for Athena data access?
a) Encrypt S3 buckets and use strict IAM policies
b) Enable query acceleration
c) Use CloudWatch Alarms
d) Optimize Glue crawlers - Which feature allows centralized monitoring of Athena activity across accounts?
a) AWS Organizations
b) AWS Security Hub
c) CloudTrail Lake
d) GuardDuty - How can you detect unauthorized query executions in Athena?
a) Set up VPC endpoint restrictions
b) Use Athena error logs
c) Enable CloudTrail event monitoring
d) Restrict Glue crawlers - Which compliance standard is supported by Athena?
a) PCI DSS
b) HIPAA
c) GDPR
d) All of the above - What is the purpose of setting up query logging in Athena?
a) To optimize performance
b) To reduce costs
c) To monitor user activity and ensure compliance
d) To limit query size - How can you track data access violations in Athena?
a) Enable Glue crawlers
b) Use CloudWatch logs and alerts
c) Configure bucket lifecycle rules
d) Apply auto-scaling policies - What should be enabled for auditing cross-account access in Athena?
a) S3 bucket replication
b) Cross-region replication
c) CloudTrail logging
d) Redshift Spectrum - Which is a recommended best practice for maintaining compliance in Athena?
a) Use data encryption, access control, and auditing
b) Store query results unencrypted for faster access
c) Enable multi-region queries
d) Use anonymous IAM roles
Answers
| QNo | Answer (Option with Text) |
|---|---|
| 1 | a) Server-side encryption with S3 managed keys |
| 2 | a) AWS Key Management Service (KMS) |
| 3 | c) Default encryption |
| 4 | a) Using SSL/TLS |
| 5 | b) KMS Customer Master Key (CMK) |
| 6 | c) Yes, with proper permissions |
| 7 | b) IAM policy with KMS permissions |
| 8 | c) Encrypt with KMS keys |
| 9 | b) SSE-S3 |
| 10 | a) IAM roles for Athena |
| 11 | b) AWS IAM |
| 12 | c) Athena Execution Role |
| 13 | b) To define cross-account access permissions |
| 14 | a) Use bucket policies |
| 15 | c) athena:StartQueryExecution |
| 16 | a) Using Glue tables with resource tags |
| 17 | c) Service-linked role for Athena |
| 18 | c) Through policy conditions and actions |
| 19 | a) Queries will fail |
| 20 | b) Yes, with roles assumed through STS |
| 21 | a) AWS CloudTrail |
| 22 | c) User activity and timestamps |
| 23 | a) Encrypt S3 buckets and use strict IAM policies |
| 24 | c) CloudTrail Lake |
| 25 | c) Enable CloudTrail event monitoring |
| 26 | d) All of the above |
| 27 | c) To monitor user activity and ensure compliance |
| 28 | b) Use CloudWatch logs and alerts |
| 29 | c) CloudTrail logging |
| 30 | a) Use data encryption, access control, and auditing |