DEA-C01 Practice Test 10 — 10 Questions

Question 1

A company uses AWS Glue to process streaming data from Amazon Kinesis Data Streams. The data is JSON formatted and includes a timestamp field. The company wants to partition the output in Amazon S3 by date and hour, and ensure exactly-once processing semantics. Which combination of configurations should be used?

Accepted Answer

Enable checkpointing in the AWS Glue streaming job and specify an S3 location for checkpoint data.. Option B is correct because AWS Glue streaming jobs require checkpointing to track the progress of data consumption from Kinesis Data Streams and to ensure exactly-once processing semantics. By enabling checkpointing and specifying an S3 location, Glue periodically saves the state of processed records, allowing it to resume from the last committed offset in case of failures, thus preventing duplicates or data loss.

Answer

Disable checkpointing and use the 'exactly_once' delivery option in Kinesis Data Streams.

Answer

Use Amazon DynamoDB as a checkpoint store by configuring the Glue job with a DynamoDB connection.

Answer

Use Kinesis Client Library (KCL) checkpointing with a DynamoDB table.

Question 2

Refer to the exhibit. A data engineer applies this bucket policy to an S3 bucket named my-data-bucket. The bucket contains sensitive data. The company's security team reports that data was accessed from an IP address outside the allowed range. What is the MOST likely reason that the policy failed to block the unauthorized access?

Accepted Answer

The Deny statement does not restrict access based on IP address; it only denies non-HTTPS requests.. Option C is correct because the Deny statement in the policy only denies requests that are not using HTTPS (SecureTransport: false). It does not include any condition to restrict access based on IP address. Therefore, a request made from an IP outside the allowed range but using HTTPS would not be denied by this policy, allowing unauthorized access to the sensitive data.

Answer

The Deny statement's condition on SecureTransport overrides the IP condition.

Answer

The policy has a syntax error in the Condition element.

Answer

The bucket policy does not apply to requests made from within the same AWS account.

Question 3

A data engineering team is designing a data lake on Amazon S3 with a folder structure that separates raw, transformed, and curated data. The team needs to implement lifecycle policies to minimize storage costs while ensuring that data in the 'raw' zone is retained for 90 days before being moved to Amazon S3 Glacier Deep Archive. Additionally, data in the 'curated' zone should be deleted after 365 days. What is the MOST cost-effective way to achieve these requirements?

Accepted Answer

Create a single lifecycle policy with two rules: one to transition raw zone objects to S3 Glacier Deep Archive after 90 days, and another to delete curated zone objects after 365 days.. Option D is correct because a single S3 lifecycle policy can contain multiple rules, each applying to different prefixes. This allows you to transition raw zone objects to S3 Glacier Deep Archive after 90 days and delete curated zone objects after 365 days, minimizing storage costs without needing separate policies. S3 lifecycle policies are evaluated per object based on creation date, and using one policy reduces management overhead.

Answer

Configure S3 Intelligent-Tiering on both prefixes with automatic archiving to Glacier Deep Archive after 90 days in raw and deletion after 365 days in curated.

Answer

Create separate lifecycle policies for each prefix: one to transition raw to S3 Glacier Deep Archive after 90 days, another to delete curated after 365 days.

Answer

Create a lifecycle policy that transitions raw zone data to S3 Standard-IA after 90 days and deletes curated zone data after 365 days.

Question 4

A data engineer is configuring a data lake on Amazon S3 that contains sensitive customer information. The company requires that all access to this data be logged and monitored, and that any data shared with external partners must be anonymized before leaving the S3 bucket. Which combination of AWS services should the engineer use to meet these requirements? (Choose THREE.)

Accepted Answer

AWS Lake Formation. AWS Lake Formation (B) is correct because it provides fine-grained access control and data anonymization capabilities for data lakes on Amazon S3. It allows you to define column-level and row-level security policies, and can automatically anonymize sensitive data (e.g., via masking or tokenization) before it is shared with external partners, ensuring compliance with data governance requirements.

Answer

AWS WAF

Answer

AWS Direct Connect

Question 5

A data engineer applies the above S3 bucket policy to an S3 bucket used by a Glue ETL job. The Glue job writes objects to the bucket. Which of the following is true about the behavior of the policy?

Accepted Answer

The policy denies all PutObject requests because the Allow and Deny statements are contradictory.. The correct answer is C because in AWS IAM policy evaluation, an explicit Deny always overrides any Allow. The policy has an Allow statement granting s3:PutObject for all principals, but a separate Deny statement explicitly denies s3:PutObject when the encryption condition is not aws:kms. Since the Deny applies to all PutObject requests (including those with no encryption or AES256), and the Allow does not include a condition to match only aws:kms, the Deny takes precedence and blocks all PutObject requests, making the policy effectively deny all PutObject operations.

Answer

The policy allows PutObject with aws:kms encryption because the Allow statement is broader.

Answer

The policy allows PutObject with no encryption because the Deny only applies to PutObject.

Answer

The policy allows PutObject with AES256 encryption and denies PutObject with aws:kms encryption.

Question 6

Match each AWS data analytics service to its primary function.

Question 7

Match each AWS networking concept to its definition.

Question 8

A company is designing a data lake on Amazon S3. The security policy requires that all data be encrypted at rest using AWS KMS with automatic key rotation. Which encryption option meets these requirements? (Select THREE.)

Accepted Answer

Enable automatic key rotation on the KMS key.. Option A is correct because AWS KMS customer-managed keys (CMKs) support automatic key rotation, which can be enabled to rotate the key material annually. This satisfies the security policy requirement for automatic key rotation. SSE-KMS with a CMK (Option D) is also required because AWS managed keys (Option B) do not support automatic key rotation, and SSE-C (Option E) does not use KMS at all. Setting default encryption on the S3 bucket to SSE-KMS with the CMK (Option C) ensures all objects are encrypted with that key, meeting the encryption-at-rest requirement.

Answer

Use SSE-KMS with an AWS managed key.

Answer

Use SSE-C with a customer-provided key.

Question 9

A company uses AWS Kinesis Data Streams to ingest real-time data. The data engineer notices that the stream's 'WriteProvisionedThroughputExceeded' error occurs frequently during peaks. Which action should be taken to resolve this issue?

Accepted Answer

Increase the number of shards in the stream.. Increasing the number of shards increases the write capacity, directly addressing the throughput exceeded error. Option B is wrong because the error is not from the producer side. Option C is wrong because the error is about write throughput, not read. Option D is wrong because the error is not about data format.

Answer

Modify the producer to use a different partition key.

Answer

Compress the data before sending to the stream.

Answer

Enable enhanced fan-out for consumers.

Question 10

A data engineer is setting up a data pipeline using AWS Glue. The engineer wants to monitor job failures and receive notifications. Which TWO services can be used together for this purpose?

Accepted Answer

Amazon CloudWatch. Amazon CloudWatch (B) is correct because it is the native monitoring service for AWS Glue, capturing job metrics, logs, and state changes. You can configure CloudWatch alarms to trigger on job failures, which then invoke Amazon SNS (C) to send notifications via email, SMS, or other endpoints. Together, they provide a complete monitoring and alerting solution without additional orchestration.

Answer

AWS Step Functions

Answer

Amazon Kinesis Data Streams

Answer

Amazon SQS