DEA-C01 Question #273: Real Exam Question with Answer & Explanation

Question

A company that operates globally must follow regulations that require data from an AWS Region to be accessible only within that Region. A data engineer is creating a data pipeline that will create resources in the Region where the data engineer works. The data pipeline should have access to data only from the Region where the data engineer works. The pipeline uses Active Directory as an identity and authentication system. The pipeline uses a custom identity broker application to verify that employees are signed in to Active Directory and to obtain temporary credentials by using the AssumeRole API operation. Which solution will meet the locality requirements with the LEAST administrative effort?

Options

• ACreate an IAM role that has permissions to create resources. Create a policy for each Region that
• BCreate an IAM role for data engineers in each Region separately. Instruct each data engineer to
• CCreate an IAM group for each Region. Include the required IAM policies for each IAM group. Add
• DCreate individual IAM policies that allow users to create resources in a specific Region. Assign