DEA-C01 Exam Questions and Answers

AWS IoT Core

AWS IoT Core ingests high-volume, small-payload device telemetry and can route it directly to Amazon S3 via rules, meeting the 5 GB per hour near-real-time requirement. Its native MQTT support suits sub-1 KB events from a fleet, unlike services designed for batch or large-object transfer.

Increase the number of DPUs allocated to the Glue job.

Glue allocates memory per executor, so raising the DPU count adds workers and distributes the tenfold-larger dataset across more memory, resolving the out-of-memory failures. It requires only a job configuration change, meeting the minimal-code-change constraint.

The consumer application is crashing and restarting, causing re-processing of records.

Frequent crashes force the KCL to resume from the last DynamoDB checkpoint, replaying every record consumed after it — at-least-once delivery guarantees duplicates on restart. With five shards at 500 records per second, each restart re-processes a substantial backlog, matching the observed duplicate processing.

AWS Glue Crawler

AWS Glue Crawler scans the S3 data, infers the CSV schema, and registers partition structure in the Glue Data Catalog. Scheduled hourly, it keeps metadata current as new date partitions arrive, enabling the ETL job to read and convert files to Parquet.

Use AWS Glue ETL job to convert to Parquet and load into Redshift.

AWS Glue ETL jobs convert JSON to Parquet on serverless Spark infrastructure, eliminating cluster provisioning and satisfying the minimal-operational-overhead constraint. Parquet's columnar layout and compression reduce Redshift storage and scan costs, meeting the cost-effectiveness requirement for the nightly 10 MB file transformations.

Increase the DMS replication instance size.

DMS memory exhaustion during large-table replication is resolved by scaling the replication instance, adding RAM and CPU. This satisfies the 2 TB source constraint while preserving the existing task, endpoints and Parquet target architecture unchanged.

Increase the number of shards in the Kinesis stream

A Kinesis stream's throughput ceiling is set by shard count: each shard provides 1 MB/s or 1,000 records/s ingest and 2 MB/s egress. Adding shards raises parallel capacity so the consumer can drain the backlog faster, directly reducing processing lag.

Use the S3 staging option in the Glue connection to unload data from Redshift to S3 first

The JDBC connector reads Redshift row-by-row through the driver, which is slow at this scale. Using the S3 staging option runs a Redshift UNLOAD to S3 in parallel, then Glue reads S3 directly, removing the JDBC bottleneck and cutting job duration.

Convert the data to a columnar format like Parquet or ORC if not already

Columnar formats such as Parquet or ORC store data by column, so Athena reads only the columns referenced in a query instead of every field. This directly cuts bytes scanned, which is the billed metric, lowering both query latency and cost for the existing Glue-produced data.

Compress the data using a splittable compression format like Snappy

Snappy is splittable, so Athena and Glue can parallelise reads across a single compressed file rather than one worker per file. Combined with reduced bytes on disk, this lowers scan volume and cost while preserving parallelism, unlike non-splittable gzip.

Partition the data by commonly filtered columns such as date or region

Partitioning by frequently filtered columns such as date or region lets Athena prune partitions via the metastore, reading only matching S3 prefixes. This directly reduces bytes scanned, the cost driver, and speeds queries that filter on those columns.

The IAM role does not have s3:ListBucket permission on the bucket.

Spark's S3A filesystem lists the bucket or prefix before reading and writing objects, and that listing call requires s3:ListBucket on the bucket resource. GetObject and PutObject alone are insufficient, so the missing ListBucket permission causes the S3AccessDenied failure.

Configure DMS with ongoing replication using change data capture (CDC).

Ongoing replication with CDC lets AWS DMS continuously apply source Oracle changes to Redshift, satisfying the requirement to keep Redshift synchronised with minimal latency after the initial full load. Without CDC, only a one-time migration occurs, so later source changes never propagate.

The IAM role for Firehose lacks s3:PutObject permission.

S3.BucketExists being 1 confirms the bucket is reachable, so the failure lies in authorisation. Firehose requires s3:PutObject in its IAM role to write objects; without it, every delivery attempt is denied and DeliveryToS3.Success stays at 0.

Use an S3 bucket policy that denies requests not using HTTPS.

An S3 bucket policy denying requests where aws:SecureTransport is false enforces TLS on every request, so Glue-to-S3 traffic cannot fall back to plain HTTP. This satisfies the in-transit encryption requirement at the bucket level, covering all clients including AWS Glue.

Enable Amazon Redshift audit logging to an S3 bucket.

Audit logging captures connection, user, and query activity, then delivers it to Amazon S3 for durable retention. This directly satisfies the security team's requirement that all queries are logged for auditing, since S3 provides the persistent, reviewable store auditors need.

The IAM role does not have a condition that matches the required tag.

The bucket policy requires a tag, and the role must have a matching condition.

In Lake Formation, create an LF-tag 'access_level' with values 'analyst' and 'admin'. Grant 'SELECT' permission on the 'customer' table to the tag value 'analyst'. Associate the LF-tag with the 'customer' table.

This uses Lake Formation TBAC to restrict access based on the user's tag.

{"Effect":"Allow","Action":["kms:Decrypt","kms:GenerateDataKey"],"Resource":"*"}

SSE-KMS requires both kms:Decrypt to read encrypted objects and kms:GenerateDataKey to obtain a data key for writing. Granting these two actions on the key resource satisfies the stem's read-and-write requirement, since Glue cannot access KMS-encrypted S3 data with either permission missing.

Configure the S3 bucket to use server-side encryption with AWS KMS (SSE-KMS) using a customer managed key.

SSE-KMS with a customer managed key encrypts objects at rest while the company retains control over key rotation and access policy, satisfying the requirement that keys not be AWS-managed. It also complements TLS for the in-transit requirement.

Enable SSL/TLS encryption on the DMS source and target endpoints.

Enabling SSL/TLS on the DMS source and target endpoints encrypts replication traffic in transit, satisfying the in-transit requirement. This is separate from the at-rest requirement, which needs customer-managed keys via SSE-KMS or SSE-C on the S3 target.

Manually promote the read replica to a standalone DB instance.

Promoting a read replica manually converts it into a standalone DB instance, which is the only supported route when the primary fails without Multi-AZ. The stem specifies RDS for MySQL with read replicas, so no automatic failover exists; you must trigger promotion yourself to restore write capability.

Time to Live (TTL)

Time to Live (TTL) lets you define an attribute holding an expiry timestamp; DynamoDB then deletes each item automatically once that timestamp passes, with no write capacity consumed. This directly satisfies the 24-hour automatic expiry requirement for player session data, eliminating manual cleanup jobs.

Write-through caching

Write-through caching updates the Redis cache synchronously on every database write, so cached product data never goes stale. This directly satisfies the freshness constraint that lazy loading cannot guarantee, since lazy loading only populates entries on a miss and leaves existing values stale until eviction or expiry.

It allows the DataLakeRole to read and write objects, but only over HTTPS.

The policy grants DataLakeRole s3:GetObject and s3:PutObject permissions, but the condition restricts access to requests made over TLS. Plain HTTP requests are denied, so the role can read and write objects only when the connection is encrypted via HTTPS.

The partitions have not been added to the Glue Data Catalog.

Athena reads partition locations from the AWS Glue Data Catalog. If year and month partitions were never registered, the table metadata exposes no partition paths, so queries against those partitions scan nothing and return zero rows despite the CSV objects existing in S3.

S3 One Zone-IA

S3 One Zone-IA stores data in a single Availability Zone, delivering millisecond retrieval while suiting infrequently accessed data. It satisfies the stem's latency constraint because retrieval remains immediate, unlike Glacier tiers requiring minutes to hours. Lower durability than Standard-IA is the trade-off, but the millisecond requirement is met.

S3 Intelligent-Tiering

S3 Intelligent-Tiering automatically moves objects between frequent and infrequent access tiers based on changing access patterns, while always delivering millisecond retrieval. This satisfies the stem's requirement for infrequently accessed data with millisecond latency, since its infrequent access tier retains the same low-latency performance as S3 Standard.

S3 Standard-IA

S3 Standard-IA suits infrequent access while preserving millisecond latency, satisfying the stem's retrieval-speed constraint. Unlike Glacier classes, which incur minutes-to-hours restore delays, Standard-IA retrieves objects immediately from the same replicated infrastructure as S3 Standard, merely charging a lower storage rate with a retrieval fee and 30-day minimum duration.