DEA-C01 Practice Test 11 — 15 Questions

Question 1

A company is using Amazon Kinesis Data Streams to ingest clickstream data from a website. The data is consumed by an AWS Lambda function that enriches records and writes to Amazon S3. The Lambda function is experiencing high error rates due to records exceeding the 256 KB payload limit. Which TWO actions should the team take to resolve this issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable compression on the producer side before sending records to Kinesis.. Enabling compression on the producer side reduces the size of each record before it is sent to Kinesis Data Streams, directly addressing the 256 KB payload limit. Option C is correct because the Kinesis Producer Library (KPL) aggregates multiple small records into a single larger record, which is then stored as one Kinesis record, reducing the number of records that exceed the limit and improving throughput.

Answer

Increase the Lambda function timeout.

Answer

Switch from Kinesis Data Streams to Kinesis Data Firehose.

Answer

Increase the number of shards in the Kinesis stream.

Question 2

A company is using AWS Lake Formation to manage access to data in a data lake stored in Amazon S3. A data engineer notices that users with SELECT permissions on a table can still query the underlying S3 data directly using Athena. What is the most likely cause?

Accepted Answer

The users are using a version of Athena that does not support Lake Formation. Athena workgroups using engine version 1 do not support integration with Lake Formation. In such cases, Lake Formation permissions are not enforced, and users can query the underlying S3 data directly through Athena, bypassing Lake Formation's access controls. Option A is incorrect: while a permissive S3 bucket policy could allow direct access, the most likely cause given Lake Formation integration is the Athena version. Option C is incorrect because server-side encryption does not affect Lake Formation's ability to enforce permissions. Option D is incorrect: Lake Formation does integrate with Athena, but only when using Athena engine version 2 or later.

Answer

The S3 bucket policy allows full access to all principals

Answer

The S3 bucket does not have server-side encryption enabled

Answer

Lake Formation does not support integration with Athena

Question 3

A data engineer is designing a data lake on Amazon S3 for storing raw sensor data. The data is append-only and accessed infrequently after 30 days. Compliance requires that data be retained for 7 years. Which S3 storage class is the MOST cost-effective for data older than 30 days?

Accepted Answer

S3 Glacier Deep Archive. B is correct because Amazon S3 Glacier Deep Archive is the most cost-effective storage class for data that is accessed infrequently and must be retained for long periods (7 years). For data older than 30 days, the retrieval time of 12 hours is acceptable given the append-only, infrequent access pattern, and the storage cost is significantly lower than other classes.

Answer

S3 Standard-IA

Answer

S3 One Zone-IA

Answer

S3 Intelligent-Tiering

Question 4

A company runs an Amazon RDS for PostgreSQL instance for an OLTP application. The database size is 500 GB. The company wants to minimize downtime during backups and ensure point-in-time recovery (PITR) for the last 7 days. Which TWO features should the company use? (Choose TWO.)

Accepted Answer

Enable Multi-AZ deployment for high availability.. Multi-AZ deployment for Amazon RDS provides high availability by automatically provisioning and maintaining a synchronous standby replica in a different Availability Zone. This minimizes downtime during backups by allowing automated backups to be taken from the standby instance, eliminating I/O suspension on the primary. Option C is correct because enabling automated backups with a retention period of 7 days enables point-in-time recovery (PITR) within that window, restoring the database to any second within the retention period using transaction logs.

Answer

Create a read replica in a different Availability Zone.

Answer

Create daily manual snapshots and copy them to another region.

Answer

Enable Enhanced Monitoring to track backup progress.

Question 5

A company must encrypt all data at rest in their Amazon RDS for MySQL instance. Which THREE steps are required to achieve this? (Select THREE.)

Accepted Answer

Use an AWS KMS key to encrypt the instance. To encrypt data at rest in Amazon RDS for MySQL, you must enable encryption when creating the DB instance (option C). This uses an AWS KMS key (option B) to manage the encryption. Encrypted instances require that automated backups and snapshots are also encrypted (option E). Option A (SSL/TLS) encrypts data in transit, not at rest. Option D (modifying the DB parameter group) does not enable encryption at rest.

Answer

Enable SSL/TLS for database connections

Answer

Modify the DB parameter group to require encryption

Question 6

A company has a nightly batch job that processes 100 GB of data from an Amazon S3 bucket and loads it into an Amazon Redshift table. The job currently runs on an Amazon EMR cluster. Which service would reduce operational overhead while providing similar functionality?

Accepted Answer

AWS Glue. AWS Glue is a serverless ETL service that can process 100 GB of data from S3 and load it into Redshift without managing any infrastructure. It provides built-in job scheduling, automatic retries, and a Spark-based engine that handles large-scale data transformations, directly replacing the EMR cluster's functionality while eliminating operational overhead.

Answer

AWS Database Migration Service

Answer

Amazon Redshift Spectrum

Answer

Amazon Athena

Question 7

A data engineer is building a data pipeline that ingests data from Amazon S3 into Amazon Redshift. The data is in CSV format and includes a timestamp column. The pipeline should load only new data incrementally. Which approach is most efficient?

Accepted Answer

Use the COPY command with a manifest file that lists only the new S3 objects. Using the COPY command with a manifest file allows you to explicitly list only the new S3 objects to be loaded, enabling incremental loading without scanning or loading the entire bucket. This approach is efficient as it avoids the overhead of deduplication or full-bucket scans, and it leverages Redshift's native high-speed parallel ingestion from S3.

Answer

Use the COPY command to load the entire bucket and rely on Redshift to deduplicate

Answer

Use Amazon Redshift Spectrum to query the S3 data directly without loading

Answer

Use INSERT statements within a loop to load each new file

Question 8

A company has a multi-account strategy using AWS Organizations. The data engineering team needs to share a central S3 bucket across multiple accounts while maintaining fine-grained access control. Which solution should be used?

Accepted Answer

Use S3 access points with a policy per account. S3 access points allow you to create separate access points for each account with their own policies, enabling fine-grained access control while sharing the same bucket. This integrates with AWS Organizations to simplify policy management. Option A is incorrect because cross-account IAM roles grant full access to the role's permissions and lack object-level granularity. Option B is incorrect because CloudFront is a content delivery network, not an access control mechanism. Option D is incorrect because a bucket policy with principal ARNs for each account becomes difficult to manage as accounts scale, and it doesn't provide per-account fine-grained control like access points do.

Answer

Use IAM roles in each account with cross-account access

Answer

Use Amazon CloudFront to serve the data

Answer

Create a bucket policy with principal ARNs for each account

Question 9

A company wants to audit all changes to IAM policies in their AWS account. Which combination of services should be used to achieve this?

Accepted Answer

AWS CloudTrail and Amazon CloudWatch Logs. AWS CloudTrail records all API calls made in the account, including IAM policy changes (e.g., PutRolePolicy, PutUserPolicy). By sending CloudTrail logs to Amazon CloudWatch Logs, you can monitor and set up alerts for policy modifications. This combination provides a complete audit trail for IAM changes. Option B is correct. AWS Config records resource configuration changes but not all API calls; Amazon SNS alone or with Config does not capture the API events; DynamoDB is not used for CloudTrail log storage or monitoring.

Answer

AWS Config and Amazon SNS

Answer

Amazon CloudWatch Logs and Amazon SNS

Answer

AWS CloudTrail and Amazon DynamoDB

Question 10

A data engineer is designing a data ingestion pipeline for IoT sensor data. The data is generated at a high velocity and must be processed in near real-time. The pipeline must also handle bursty traffic. Which TWO AWS services should be combined to achieve this? (Choose TWO.)

Accepted Answer

Amazon Kinesis Data Analytics. Amazon Kinesis Data Streams is designed for real-time, high-velocity data ingestion, providing durable, ordered data streams that can handle bursty traffic by scaling shard capacity. Amazon Kinesis Data Analytics can process these streams in near real-time using SQL or Apache Flink, enabling immediate transformations and analytics without needing to store data first.

Answer

Amazon S3

Answer

Amazon Simple Queue Service (SQS)

Answer

AWS Glue

Question 11

A data engineer is designing a real-time streaming pipeline to ingest clickstream data from a website into Amazon S3. The data must be transformed before storage. Which TWO AWS services can be used together to build this pipeline? (Choose TWO.)

Accepted Answer

Amazon Kinesis Data Firehose. The correct combination is Amazon Kinesis Data Streams to ingest the streaming clickstream data, and Amazon Kinesis Data Firehose to read from the stream, perform transformations (e.g., via Lambda), and deliver the transformed data to Amazon S3. Kinesis Data Streams provides the durable ingestion layer, while Kinesis Data Firehose handles the delivery and transformation without managing servers.

Answer

AWS Glue

Answer

Amazon S3 Transfer Acceleration

Answer

AWS Database Migration Service (DMS)

Question 12

A company uses AWS Lake Formation to manage permissions on a data lake stored in S3. A data scientist is unable to query a table in Amazon Athena, receiving an 'Access Denied' error. The data scientist has IAM permissions to call Athena and has been granted SELECT permission on the table in Lake Formation. What is the most likely cause?

Accepted Answer

The S3 bucket containing the data is not registered as a Lake Formation location.. The most likely cause is that the S3 bucket containing the data is not registered as a Lake Formation location. Lake Formation manages permissions for registered S3 locations, but if the bucket is not registered, Lake Formation cannot enforce its permissions, and the data scientist would rely on S3 bucket policies, which may deny access. Option A is incorrect because DESCRIBE permission is not required for querying. Option B is incorrect because encryption is not mentioned as an issue. Option C is incorrect because bucket policies are not the primary issue if the bucket is registered; the error occurs because the bucket is not registered.

Answer

The data scientist does not have DESCRIBE permission on the table.

Answer

The data is encrypted with SSE-KMS and the data scientist lacks kms:Decrypt permission.

Answer

The S3 bucket policy denies access to the data scientist's IAM role.

Question 13

Refer to the exhibit. An IAM policy is attached to an IAM user. The user is trying to download an object from the S3 bucket 'example-bucket' from an IP address 10.1.1.1, but the request is denied. What is the most likely reason?

Accepted Answer

The user's IP address does not match the condition in the policy.. The policy includes a condition that allows s3:GetObject only if the request originates from the 10.0.0.0/16 IP range. The user's IP address 10.1.1.1 falls outside this range, so the condition is not satisfied, resulting in an implicit deny. Therefore, the most likely reason for the denial is that the user's IP address does not match the condition, making option D correct. Option A is incorrect because the policy does allow s3:GetObject. Option B is incorrect because the policy has no syntax error. Option C is incorrect because there is no explicit deny statement.

Answer

The policy does not allow the s3:GetObject action.

Answer

The policy has a syntax error.

Answer

There is an explicit deny statement elsewhere that overrides the allow.

Question 14

A data engineer needs to ensure that all data stored in an S3 bucket is encrypted at rest. Which S3 bucket policy condition key should be used to enforce encryption using AWS KMS?

Accepted Answer

s3:x-amz-server-side-encryption-aws-kms-key-id. The s3:x-amz-server-side-encryption-aws-kms-key-id condition key allows you to enforce that a specific KMS key is used for server-side encryption with AWS KMS (SSE-KMS). Option A is incorrect because s3:x-amz-server-side-encryption only checks whether server-side encryption is enabled, but does not require a specific KMS key. Option B is incorrect because kms:EncryptionContext is a condition key used in KMS policies, not S3 bucket policies. Option C is incorrect because s3:x-amz-acl is used for access control lists, not encryption.

Answer

s3:x-amz-server-side-encryption

Answer

kms:EncryptionContext

Answer

s3:x-amz-acl

Question 15

A data engineer needs to ensure that all data in an S3 bucket is encrypted at rest. The bucket contains objects uploaded by various applications. What is the simplest method to enforce encryption for all new objects?

Accepted Answer

Configure an S3 bucket policy that denies PutObject requests without the x-amz-server-side-encryption header.. An S3 bucket policy can deny PutObject requests that do not include the x-amz-server-side-encryption header, thereby enforcing encryption for all new objects. Option A is wrong because S3 Block Public Access does not enforce encryption. Option B is wrong because default encryption applies only if the upload request does not specify encryption headers; it does not enforce encryption for requests that specify 'None'. Option C is wrong because S3 Object Lock prevents deletion but does not enforce encryption.

Answer

Enable S3 Block Public Access to block public access to the bucket.

Answer

Enable default encryption on the S3 bucket using S3-Managed Keys (SSE-S3).

Answer

Enable S3 Object Lock on the bucket.