DEA-C01 Practice Test 10 — 10 Questions

Question 1

An application uses the 'orders' DynamoDB table with the schema and provisioned throughput shown in the exhibit. The application frequently queries by customer_id (range key) without specifying the order_id (partition key). What is the most likely impact on performance?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Queries will require a full table scan, consuming significant read capacity.. The application queries by customer_id (the sort key) without specifying order_id (the partition key). In DynamoDB, a Query operation requires the partition key to be specified; without it, the only way to retrieve items is a full table Scan, which reads every item in the table. This consumes read capacity proportional to the entire table size, leading to high latency and cost.

Answer

Queries will be throttled because the table does not have a global secondary index.

Answer

Queries will be fast because the sort key is indexed.

Answer

Queries will cause hot partitions on the table.

Question 2

A company is ingesting Apache logs from multiple web servers into AWS. The logs are sent via Amazon CloudWatch Logs to a subscription filter that delivers to a Lambda function. The Lambda function parses the logs and writes to Amazon S3. However, there is a significant backlog. Which THREE actions can reduce the backlog?

Accepted Answer

Increase the Lambda function memory allocation. Increasing the Lambda function's memory allocation also increases its CPU allocation, allowing the function to process each log event faster. This reduces the per-invocation processing time, enabling the function to handle more log data per unit time and thus reduce the backlog.

Answer

Route the CloudWatch Logs subscription to an Amazon SQS queue first

Answer

Change the Lambda function runtime from Python to Node.js

Question 3

Refer to the exhibit. A data engineer is troubleshooting an AWS Glue ETL job that fails with an access denied error when writing to S3. The IAM role attached to the Glue job has the policy shown. What is the most likely cause of the error?

Accepted Answer

The Glue job is writing to an S3 bucket that is not included in the Resource ARN. The IAM policy shown in the exhibit explicitly restricts the `s3:PutObject` action to a specific ARN pattern (e.g., `arn:aws:s3:::example-bucket/*`). If the Glue job attempts to write to a different S3 bucket—one not matching that ARN—the request will be denied with an access denied error. AWS Glue ETL jobs use the attached IAM role's permissions, and a mismatch between the target bucket and the resource ARN in the policy is the most common cause of such failures.

Answer

The Glue job is missing the s3:ListBucket permission on the bucket

Answer

The S3 bucket is encrypted with AWS KMS and the policy does not include kms:Decrypt permissions

Answer

The Glue job does not have permission to call glue:StartJobRun

Question 4

A data engineer applies the bucket policy shown in the exhibit to an S3 bucket. The bucket contains sensitive data that must be encrypted at rest and accessed only over HTTPS. Which of the following statements is true?

Accepted Answer

The policy enforces that all PutObject requests must include the x-amz-server-side-encryption header with value AES256.. The bucket policy includes a condition that denies PutObject requests unless the `s3:x-amz-server-side-encryption` header is present and set to `AES256`. This enforces server-side encryption with S3-managed keys (SSE-S3) for all uploads, ensuring data at rest is encrypted.

Answer

The policy allows both HTTP and HTTPS access.

Answer

The policy allows anonymous access to list objects in the bucket.

Answer

The policy requires the use of AWS KMS for server-side encryption.

Question 5

A company is migrating an on-premises MySQL database to Amazon RDS for MySQL. The database is 500 GB and has a 24/7 uptime requirement. The migration must minimize downtime. Which approach should be used?

Accepted Answer

Use AWS Database Migration Service (DMS) with ongoing replication to migrate the data.. AWS DMS with ongoing replication (change data capture) allows you to perform a full load of the 500 GB database and then continuously replicate changes from the on-premises MySQL source to the Amazon RDS target. This minimizes downtime because you can cut over to RDS in seconds after the target is synchronized, rather than taking the source offline for an extended period.

Answer

Take a snapshot of the on-premises database, convert it to a volume, and restore to RDS.

Answer

Export the database using mysqldump and import it into RDS using mysql command.

Answer

Create an RDS MySQL read replica from the on-premises database using native replication.

Question 6

A company is using Amazon DynamoDB with auto scaling enabled. During a marketing campaign, write traffic spikes, and some write requests fail with ProvisionedThroughputExceededException. The auto scaling policy has a target utilization of 70% and a maximum capacity that is high enough. What is the most likely cause of the throttling?

Accepted Answer

Auto scaling cannot react quickly enough to sudden traffic spikes.. Auto scaling in DynamoDB adjusts capacity based on the average utilization over a period (typically 5-10 minutes). When a sudden traffic spike occurs, the write requests can exceed the current provisioned capacity before the auto scaling policy has time to react and increase the capacity. This delay causes ProvisionedThroughputExceededException errors, even though the maximum capacity is set high enough.

Answer

The table has a global secondary index that is throttling.

Answer

The table does not have enough maximum capacity.

Answer

The auto scaling policy is not configured correctly.

Question 7

A company is designing a data lake on Amazon S3. The data includes personal identifiable information (PII). The data engineer must ensure that only authorized users can access the data, and that access is logged for auditing. Which combination of services should the data engineer use?

Accepted Answer

S3 bucket policies with IAM policies and AWS CloudTrail with data events. S3 bucket policies combined with IAM policies provide fine-grained access control to restrict who can access the data, while AWS CloudTrail with data events logs every S3 object-level operation (e.g., GetObject, PutObject) for auditing. This combination directly meets the requirements of authorized access and logging for PII data.

Answer

Amazon S3 access points and VPC endpoints

Answer

Amazon Macie to discover PII and S3 Object Lock to prevent deletion

Answer

AWS KMS to encrypt data and AWS CloudTrail to log access

Question 8

A company stores sensitive data in Amazon S3 and uses AWS Lake Formation to manage fine-grained access control. A data engineer notices that users are able to access data in S3 directly via the AWS Management Console, bypassing Lake Formation permissions. What should the engineer do to enforce Lake Formation access controls for all access methods?

Accepted Answer

Register the S3 location in Lake Formation and disable IAM access control for the registered location.. Registering the S3 location in Lake Formation and disabling IAM access control for that registered location enforces Lake Formation permissions for all access methods, including direct S3 access via the console. This ensures that Lake Formation acts as the single source of truth for fine-grained access control.

Answer

Add a bucket policy that denies all access except from Lake Formation.

Answer

Disable AWS CloudTrail logging for S3 access.

Answer

Enable S3 Block Public Access on the bucket.

Question 9

A company is building a data lake on Amazon S3 and needs to ingest data from various on-premises sources. Which TWO AWS services can be used to transfer data securely over the internet?

Accepted Answer

AWS DataSync. AWS DataSync (B) is correct because it is a purpose-built data transfer service that moves data between on-premises storage and Amazon S3 over the internet using TLS encryption, and it supports scheduled, incremental, and bandwidth-limited transfers. AWS CLI (E) is correct because commands such as aws s3 cp or aws s3 sync transfer data from on-premises systems to S3 over the public internet using HTTPS, making it a valid secure internet-based ingestion method. AWS Snowcone (A) is not correct here because it is an edge computing and offline/physical data transfer device, not an internet-based transfer service. Amazon Kinesis Data Firehose (C) is not correct because it delivers streaming data to destinations like S3 but is not designed to pull files from on-premises sources over the internet. AWS Direct Connect (D) is not correct because it uses a dedicated private network connection rather than the public internet.

Answer

AWS Snowcone

Answer

Amazon Kinesis Data Firehose

Answer

AWS Direct Connect

Question 10

A data engineer needs to set up a new Amazon RDS for PostgreSQL database for a production workload. The database must be highly available and resilient to a single Availability Zone failure. Which configuration should the engineer choose?

Accepted Answer

Multi-AZ deployment with one standby in a different AZ. A Multi-AZ deployment for Amazon RDS PostgreSQL automatically provisions and maintains a synchronous standby replica in a different Availability Zone. This configuration provides automatic failover in the event of an AZ failure, ensuring high availability and resilience without manual intervention. The synchronous replication ensures zero data loss during failover, which is critical for production workloads.

Answer

Single-AZ with automated backups

Answer

Multi-AZ with two readable standbys

Answer

Single-AZ with a read replica