DEA-C01 Practice Test 12 — 15 Questions

Question 1

A company must comply with a regulation that requires logging all access to sensitive data stored in Amazon S3. Which AWS services can be used to capture and store access logs? (Choose TWO.)

Accepted Answer

AWS CloudTrail. Options C and D are correct. AWS CloudTrail can be configured to log API calls to S3, including data events for object-level access. Amazon S3 server access logs provide detailed records of requests made to an S3 bucket. Option A is wrong because AWS Config records configuration changes, not data access logs. Option B is wrong because Amazon CloudWatch Logs can store logs but does not generate S3 access logs directly. Option E is wrong because VPC Flow Logs capture IP traffic metadata, not S3 object-level access.

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Answer

VPC Flow Logs

Question 2

A company uses Amazon S3 to store raw data and AWS Glue to run ETL jobs that transform the data into analytics-ready tables. The Glue job reads from a source with a schema that changes frequently (new columns added). The engineer wants the Glue job to automatically adapt to schema changes without manual intervention. Which configuration should the engineer use?

Accepted Answer

Enable the 'Update schema' option in the Glue job's output target configuration.. Enabling the 'Update schema' option in the Glue job's output target configuration allows the job to automatically add new columns to the target table in the Data Catalog when the source schema changes. This setting directly addresses the requirement for automatic adaptation to schema changes without manual intervention, as it updates the table definition during the ETL job run.

Answer

Schedule a Glue crawler to run after each ETL job to update the Data Catalog.

Answer

Set the job to use schema-on-read by storing data in Parquet format.

Answer

Use Glue's partition indexes to automatically detect new columns.

Question 3

A company uses AWS KMS to encrypt data at rest in Amazon S3. The security team requires that all encryption keys be automatically rotated every year. Which key type should be used to meet this requirement without manual intervention?

Accepted Answer

Use a customer managed key with automatic rotation enabled.. AWS customer managed keys (CMKs) with automatic rotation enabled rotate every year, meeting the requirement of annual rotation. While enabling automatic rotation requires a one-time manual configuration, after that no further manual intervention is needed, and the rotation occurs automatically. AWS managed keys (aws/s3) rotate automatically every three years, not annually, so they do not satisfy the yearly rotation requirement. Imported key material cannot be rotated, and S3 does not generate a KMS key per upload. Therefore, option A is correct.

Answer

Use an imported key material because it supports automatic rotation.

Answer

Use a KMS key generated by S3 on each object upload.

Answer

Use an AWS managed key (aws/s3).

Question 4

A company wants to centrally manage access to multiple AWS accounts for its data engineers. The company already uses AWS Organizations. Which AWS service should be used to define fine-grained permissions across accounts?

Accepted Answer

AWS IAM Identity Center (AWS Single Sign-On). AWS IAM Identity Center (formerly AWS Single Sign-On) enables centralized management of permissions across multiple AWS accounts by allowing administrators to define fine-grained permissions using permission sets. This eliminates the need to create individual IAM users in each account. Option A is incorrect because IAM is per-account and does not support cross-account permission management without additional configuration. Option C is incorrect because AWS Resource Access Manager (RAM) is used to share resources, not to define permissions. Option D is incorrect because AWS Key Management Service (KMS) is for encryption key management, not access control.

Answer

AWS IAM

Answer

AWS Resource Access Manager (AWS RAM)

Answer

AWS Key Management Service (AWS KMS)

Question 5

A company is migrating its on-premises Oracle data warehouse to Amazon Redshift. The data engineering team needs to load data from Oracle to Redshift using AWS DMS (Database Migration Service). The source database is 2 TB in size. The team wants to minimize downtime and ensure data consistency during full load. Which approach should they take?

Accepted Answer

Use AWS DMS to perform a full load, then enable ongoing replication to capture changes.. AWS DMS can perform a full load of the 2 TB Oracle database while simultaneously capturing ongoing changes via CDC (Change Data Capture). After the full load completes, DMS applies the cached changes to Redshift, ensuring data consistency with minimal downtime. This approach avoids stopping the source database and leverages DMS's native replication capabilities.

Answer

Use UNLOAD command to export data from Oracle to S3, then COPY into Redshift.

Answer

Stop the source database, export data to flat files, upload to S3, and use COPY to load into Redshift.

Answer

Use COPY command directly from Oracle to Redshift over JDBC.

Question 6

Which TWO AWS services can be used to ingest streaming data into Amazon S3? (Choose two.)

Accepted Answer

Amazon Managed Streaming for Apache Kafka (Amazon MSK). Amazon Kinesis Data Firehose is the easiest way to reliably load streaming data into Amazon S3. It can capture, transform, and deliver streaming data to S3 destinations in near real-time with no code required. Amazon MSK (Managed Streaming for Apache Kafka) can also ingest streaming data into S3 by using Kafka Connect with an S3 sink connector, which writes data from Kafka topics directly to S3.

Answer

Amazon S3 Transfer Acceleration

Answer

Amazon Elastic Block Store (Amazon EBS)

Answer

AWS Snowball

Question 7

A company needs to enforce encryption at rest for all data stored in Amazon S3. Which of the following are valid methods to achieve this? (Choose TWO.)

Accepted Answer

Enable default bucket encryption using SSE-S3.. Server-side encryption with S3 managed keys (SSE-S3) encrypts data at rest on the server side. Client-side encryption encrypts data before uploading, ensuring it is encrypted at rest from the client's perspective. Options A and E are for encryption in transit, and C is versioning, not encryption. Correct: B and D.

Answer

Use Amazon S3 Transfer Acceleration.

Answer

Enable S3 Versioning.

Answer

Use SSL/TLS for all S3 API calls.

Question 8

A data engineer is tasked with setting up a data pipeline that moves data from an on-premises Oracle database to Amazon S3 every hour. The network bandwidth is limited, and the engineer needs to ensure data consistency. Which AWS service should the engineer use?

Accepted Answer

AWS Database Migration Service (DMS) with change data capture (CDC).. AWS DMS with CDC is the correct choice because it can continuously replicate ongoing changes from an on-premises Oracle database to Amazon S3 while ensuring data consistency. CDC captures only the incremental changes (inserts, updates, deletes) after an initial full load, minimizing the data transferred over limited bandwidth and maintaining transactional integrity.

Answer

AWS DataSync.

Answer

Amazon Kinesis Data Firehose.

Answer

S3 Transfer Acceleration.

Question 9

A company uses AWS Glue ETL jobs to transform data from Amazon S3 to Amazon Redshift. The job reads JSON files, applies schema mapping, and writes to a Redshift table. Recently, the job started failing with memory errors. The data volume has increased tenfold. Which approach should a data engineer take to resolve this issue with minimal code changes?

Accepted Answer

Increase the number of DPUs allocated to the Glue job.. Increasing the number of DPUs (Data Processing Units) allocated to the AWS Glue job directly addresses the memory constraint caused by a tenfold increase in data volume. Glue ETL jobs run on Apache Spark, which distributes data processing across executors; more DPUs provide more memory and compute capacity, allowing the job to handle larger datasets without code changes.

Answer

Switch from Spark to Python Shell job type.

Answer

Implement batch processing with smaller file sizes.

Answer

Use Redshift Spectrum to query data directly from S3.

Question 10

A data engineer is troubleshooting a failed AWS Glue Crawler. The crawler logs show 'Insufficient permissions to access S3 bucket'. What should the engineer do to resolve this?

Accepted Answer

Update the IAM role used by the crawler to include S3 read permissions. The AWS Glue Crawler uses an IAM role to access data sources. The error 'Insufficient permissions to access S3 bucket' indicates that the IAM role attached to the crawler lacks the necessary S3 read permissions (e.g., s3:GetObject, s3:ListBucket). Updating the IAM role's policy to include these permissions resolves the issue, as the crawler operates under that role, not under a specific IAM user.

Answer

Grant the crawler's IAM user access to the bucket

Answer

Attach a VPC endpoint to the S3 bucket

Answer

Enable S3 default encryption on the bucket

Question 11

A financial services company ingests real-time stock trade data from multiple exchanges into Amazon Kinesis Data Streams. Each trade record is a JSON object containing fields: trade_id, symbol, price, quantity, and timestamp. The data is consumed by an AWS Lambda function that performs data validation and enrichment, then writes the processed records to an Amazon DynamoDB table for low-latency querying. Recently, the Lambda function has been timing out and failing to process all records. The Lambda function is configured with a 5-second timeout and 128 MB memory. The average record size is 2 KB, and the stream receives about 1000 records per second. The Lambda function's concurrency limit is 1000. Which set of actions should the data engineer take to resolve the issue without losing data?

Accepted Answer

Increase the Lambda function timeout to 60 seconds and memory to 1024 MB. Set the batch size to 100 records and enable parallelization factor of 10.. Increasing the Lambda timeout and memory addresses the processing bottleneck, while setting the batch size to 100 and enabling a parallelization factor of 10 allows each shard to process up to 10 concurrent batches, dramatically increasing throughput to handle 1000 records/sec (each shard can process 10 batches of 100 records concurrently, yielding 1000 records/sec per shard if the stream has at least 1 shard). This combination ensures no data loss by keeping up with the ingestion rate without exceeding the Lambda concurrency limit of 1000.

Answer

Increase the number of shards in the Kinesis data stream to 20 and keep the Lambda configuration unchanged.

Answer

Replace the Lambda function with a Kinesis Data Firehose delivery stream that writes directly to DynamoDB using a Lambda transformation.

Answer

Increase the Lambda function timeout to 60 seconds and memory to 1024 MB. Set the batch size to 100 records.

Question 12

A data engineer is configuring Amazon S3 Lifecycle policies to transition objects between storage classes. The data is accessed frequently for the first 30 days, then rarely for the next 90 days, after which it must be archived. The engineer wants to minimize costs while ensuring immediate retrieval for the first 30 days. Which lifecycle policy should the engineer implement?

Accepted Answer

Transition to Standard-IA after 30 days, then to Glacier Deep Archive after 120 days. It transitions objects from S3 Standard (immediate retrieval, frequent access) to S3 Standard-IA (lower cost for infrequent access, immediate retrieval) after 30 days, then to S3 Glacier Deep Archive (lowest-cost archival storage) after 120 days. This matches the access pattern: frequent for 30 days, rare for 90 days, then archived, while minimizing cost and maintaining immediate retrieval for the first 30 days.

Answer

Transition to Glacier Flexible Retrieval after 30 days, then delete after 120 days

Answer

Transition to One Zone-IA after 30 days, then to Glacier Deep Archive after 120 days

Answer

Transition to Glacier Deep Archive after 30 days, then delete after 120 days

Question 13

A data engineer is using AWS Glue ETL to transform a large dataset in S3. The job processes 2 TB of data daily and currently runs for 6 hours. The engineer wants to reduce runtime without changing the transformation logic. What is the best approach?

Accepted Answer

Increase the number of Glue DPUs or enable auto-scaling.. Increasing the number of DPUs or enabling auto-scaling directly allocates more distributed processing capacity to the AWS Glue job, which reduces runtime for large datasets by parallelizing the workload across more resources. Since the transformation logic is fixed and the job is already running on Spark, adding compute capacity is the most straightforward way to speed up processing without code changes.

Answer

Reduce the number of DPUs to minimize overhead.

Answer

Use the Spark UI to analyze bottlenecks and rewrite code.

Answer

Switch from Spark to Python shell.

Question 14

A company runs a data pipeline using AWS Lambda to process records from an Amazon Kinesis Data Stream. Recently, the Lambda function has been experiencing high invocation errors and the stream is throttling. The function performs simple transformations and writes to Amazon S3. What is the most effective way to reduce throttling and errors?

Accepted Answer

Increase the batch size in the Lambda event source mapping.. Increasing the batch size in the Lambda event source mapping allows each invocation to process more records from the Kinesis stream, reducing the number of total invocations. This lowers the rate at which Lambda polls the stream, which decreases the likelihood of hitting the Kinesis read throughput limits (5 transactions per second per shard) and reduces throttling errors. The simple transformations and S3 writes are likely I/O-bound, so larger batches improve throughput without increasing invocation concurrency.

Answer

Increase the Lambda function timeout.

Answer

Enable provisioned concurrency on the Lambda function.

Answer

Increase the number of shards in the Kinesis stream.

Question 15

Refer to the exhibit. A DynamoDB table 'Orders' has a GSI 'CustomerDateIndex'. A developer tries to query the GSI for all orders of a customer between two dates. The query fails. What is the most likely reason?

Accepted Answer

The query uses a date format that is not lexicographically sortable as a string. DynamoDB's Query operation requires the sort key to be lexicographically sortable when using comparison operators like BETWEEN. If the 'order_date' attribute is stored as a non-lexicographically sortable string format (e.g., 'MM-DD-YYYY' instead of 'YYYY-MM-DD'), the BETWEEN condition will fail to return correct results or may throw an error. The GSI's sort key must be in a format that supports string comparison for range queries to work properly.

Answer

The GSI does not include 'order_id' in the key schema

Answer

The 'customer_id' attribute is not a partition key in the GSI

Answer

The 'order_date' attribute is not a sort key in the GSI