AWS DEA-C01 security guide covering authentication, authorization, masking, encryption, and governance decisions.
DEA-C01 treats security and governance as part of the platform, not as a final patch layer. Strong answers control access, protect data in motion and at rest, prepare logs for audits, and respect privacy and regional governance constraints.
AWS currently weights Data Security and Governance at 18% of scored content.
flowchart LR
A["Authenticate workload or user"] --> B["Authorize exact data action"]
B --> C["Protect data with encryption, masking, and network controls"]
C --> D["Record audit evidence"]
D --> E["Apply privacy, sovereignty, sharing, and governance rules"]
Security questions usually fail when an answer treats one control as if it solves every layer. IAM does not replace Lake Formation. KMS does not replace authorization. CloudTrail does not prevent access by itself. Strong answers stack the right control at the right boundary.
| Lesson | Focus |
|---|---|
| 4.1 Authentication, Secrets & Network Access | Learn IAM roles, credentials, endpoints, security groups, and network access patterns for data systems. |
| 4.2 Authorization, Least Privilege & Lake Formation | Learn custom policies, permission models, Lake Formation, and least-privilege decisions. |
| 4.3 Encryption, Masking & Cross-Account Protection | Learn KMS, masking, anonymization, in-transit protection, and cross-account encryption access. |
| 4.4 Logging, Privacy, Sovereignty & Governance | Learn CloudTrail, CloudWatch Logs, CloudTrail Lake, privacy controls, data sovereignty, and governance frameworks. |
| Scenario clue | Strong first instinct | Weak answer pattern |
|---|---|---|
| Workload needs AWS access without long-lived keys | IAM role, scoped policy, and private endpoint where required | Hard-coded credentials or broad user keys |
| Lake data needs table/column-level governance | Lake Formation plus Glue Catalog and least-privilege IAM | Bucket policy only for every analytics permission |
| Secret or database credential must rotate | Secrets Manager or approved parameter/secret pattern | Store the password in code, logs, or job arguments |
| Sensitive data must be protected but still analyzed | masking, anonymization, KMS, TLS, and access control based on risk | Encryption only while exposing raw values to every consumer |
| Audit or sovereignty evidence is required | CloudTrail, CloudWatch Logs, CloudTrail Lake, AWS Config, Macie, Region controls | Informal notes, screenshots, or unbounded cross-Region replication |
Read the security layer before choosing the service. Authentication proves identity, authorization grants action, encryption protects confidentiality, masking reduces exposure, and governance proves the platform follows policy.