DEA-C01 Practice Test 13 — 15 Questions

Question 1

A data engineer needs to store time-series data from IoT devices. The data is write-heavy and requires low-latency queries by device ID and timestamp. The data volume is expected to grow to terabytes. Which AWS database service is most suitable?

Accepted Answer

Amazon Timestream. Amazon Timestream is purpose-built for time-series data, offering automatic tiered storage (in-memory for recent data and magnetic for historical) to handle write-heavy IoT workloads at scale. It supports low-latency queries by device ID and timestamp via its SQL-compatible query engine, making it the most suitable choice for terabytes of time-series data.

Answer

Amazon RDS for MySQL

Answer

Amazon ElastiCache for Redis

Answer

Amazon DynamoDB

Question 2

A company uses Amazon RDS for PostgreSQL. The data engineer needs to ensure that the database is automatically backed up and that backups are retained for 35 days. What is the simplest way to achieve this?

Accepted Answer

Enable automated backups with a retention period of 35 days in the RDS instance configuration.. Amazon RDS for PostgreSQL allows you to enable automated backups directly in the instance configuration. By setting the backup retention period to 35 days, RDS automatically performs daily snapshots and retains transaction logs for point-in-time recovery within that window. This is the simplest method because it requires no external services or custom scripting.

Answer

Use AWS Backup to schedule daily backups with a 35-day retention.

Answer

Create a manual snapshot every day and delete them after 35 days using a script.

Answer

Enable automatic export of transaction logs to Amazon S3 and use S3 lifecycle policies.

Question 3

A data engineer needs to store and analyze time-series data from IoT devices. The data volume is 10 GB per day, and the queries are mostly on the most recent 7 days of data. The engineer wants to minimize storage costs while retaining historical data for 1 year. Which combination of AWS services is most cost-effective?

Accepted Answer

Amazon Timestream. Amazon Timestream is purpose-built for time-series data, offering automatic tiering between in-memory (for recent 7 days) and magnetic stores (for historical data up to 1 year). This matches the query pattern (mostly recent 7 days) and retention requirement (1 year) while minimizing storage costs through its serverless, pay-per-query model. Timestream also supports time-series-specific functions like interpolation and smoothing, making it more efficient than general-purpose databases for this workload.

Answer

Amazon DynamoDB with TTL and S3 for archival

Answer

Amazon Redshift

Answer

Amazon RDS with MySQL

Question 4

A data engineer is designing a data lake on Amazon S3. The data is ingested from multiple sources and stored in a partitioned structure under the 'landing' prefix. The engineer needs to ensure that only authorized applications can write to the 'landing' zone, while all AWS accounts in the organization can read the data. Which combination of S3 bucket policies and IAM policies should be used?

Accepted Answer

Create a bucket policy with a Deny for all principals except the authorized IAM roles on the 'landing' prefix. Add a separate statement allowing read access to the organization.. Option C is correct because it uses a bucket policy with an explicit Deny on the 'landing' prefix for all principals except the authorized IAM roles, ensuring only those roles can write. A separate Allow statement grants read access to the entire organization (e.g., via the `aws:PrincipalOrgID` condition key), which satisfies the requirement that all AWS accounts in the organization can read the data. This approach leverages S3 bucket policies for cross-account access control without relying on ACLs or IAM policies alone.

Answer

Use bucket ACLs to grant write access to the authorized IAM roles and read access to all authenticated users.

Answer

Use S3 Object Ownership to enforce bucket owner enforced. Grant write access via IAM roles.

Answer

Create an IAM policy that allows s3:PutObject only for the 'landing' prefix and attach it to the authorized roles. Allow read access via an S3 Access Point.

Question 5

A company is migrating its on-premises Oracle database to Amazon RDS for Oracle. The database is 2 TB in size and has a 24-hour maintenance window. The migration must have minimal downtime. Which AWS service should be used for the migration?

Accepted Answer

AWS Database Migration Service (DMS). AWS Database Migration Service (DMS) is the correct choice because it supports heterogeneous migrations (Oracle to RDS for Oracle) with minimal downtime using ongoing replication via Oracle LogMiner or binary reader. DMS can perform a full load of the 2 TB database and then continuously replicate changes from the source to the target during the 24-hour maintenance window, allowing a final cutover with only seconds of downtime.

Answer

Amazon RDS native backup and restore

Answer

Amazon S3 Transfer Acceleration

Answer

AWS Snowball Edge

Question 6

A data engineer is designing a data lake on Amazon S3. The data consists of sensitive personally identifiable information (PII) that must be encrypted at rest. The company requires that encryption keys be rotated every 90 days and that access to the keys be logged. Which encryption solution meets these requirements?

Accepted Answer

Use server-side encryption with AWS KMS (SSE-KMS) and enable automatic key rotation.. SSE-KMS with automatic key rotation (Option D) meets the requirements because it encrypts data at rest in S3, allows key rotation every 90 days via AWS KMS automatic rotation, and logs all key usage in AWS CloudTrail for auditing. This provides the necessary encryption, rotation, and access logging without managing keys externally.

Answer

Use server-side encryption with customer-provided keys (SSE-C).

Answer

Use client-side encryption with a master key stored in AWS Secrets Manager.

Answer

Use server-side encryption with S3 managed keys (SSE-S3).

Question 7

A data engineer needs to store semi-structured JSON data for a real-time analytics application. The data will be queried using SQL-like statements and must support high-speed ingestion with minimal latency. Which AWS service is best suited for this use case?

Accepted Answer

Amazon Kinesis Data Analytics. Amazon Kinesis Data Analytics is best suited because it natively processes streaming JSON data using SQL-like statements (via Kinesis Data Analytics for SQL applications) with sub-second latency, enabling real-time analytics on semi-structured data without requiring a separate storage layer for ingestion. It directly integrates with Kinesis Data Streams or Firehose for high-speed ingestion and supports in-application queries on JSON payloads using the `json_extract` function or schema discovery.

Answer

Amazon S3

Answer

Amazon Redshift

Answer

Amazon DynamoDB

Question 8

A company is running a MySQL database on Amazon RDS. The database size is 2 TB, and the company needs to migrate it to Amazon Aurora MySQL with minimal downtime. Which migration strategy is most appropriate?

Accepted Answer

Create an Aurora MySQL read replica from the RDS instance, then promote it.. Creating an Aurora MySQL read replica from the existing RDS MySQL instance allows the Aurora cluster to stay synchronized with the source using MySQL’s native binlog replication. Once the replica lag reaches zero, you can promote it to a standalone Aurora cluster with minimal downtime, typically just a few seconds to stop writes and redirect traffic. This approach avoids the lengthy export/import process and leverages Amazon’s managed replication for near-zero-downtime migration.

Answer

Use mysqldump to export the database and import it into Aurora.

Answer

Take a snapshot of the RDS instance and restore it as an Aurora cluster.

Answer

Use AWS Database Migration Service (DMS) with full load and ongoing replication.

Question 9

A data engineer is troubleshooting a failed AWS Glue ETL job. The job reads from an S3 bucket and writes to an RDS MySQL database. The job fails with an 'Access Denied' error when trying to write to RDS. What is the most likely cause?

Accepted Answer

The IAM role associated with the Glue job does not have the necessary permissions to write to the RDS instance.. The error 'Access Denied' when writing to RDS indicates that the AWS Glue job's IAM role lacks the necessary permissions (e.g., rds-db:connect, or specific database-level GRANTs) to perform write operations on the RDS MySQL instance. AWS Glue uses the attached IAM role to authenticate and authorize actions against AWS services, and without proper IAM policies allowing access to the RDS resource, the write attempt is denied.

Answer

The Glue job is running in a VPC without a route to the internet.

Answer

The S3 bucket policy does not allow the Glue job to read the data.

Answer

The RDS instance is encrypted with a KMS key that the Glue job cannot access.

Question 10

A data engineer needs to store time-series sensor data from thousands of IoT devices. The data is written once, read frequently for the last 24 hours, and rarely accessed after 30 days. Which storage solution is MOST cost-effective?

Accepted Answer

Amazon Timestream with a 30-day retention policy.. Amazon Timestream is purpose-built for time-series data, offering automatic storage tiering where recent data resides in memory for fast queries and historical data is moved to a cost-optimized magnetic store. A 30-day retention policy aligns perfectly with the requirement to keep data accessible for frequent reads over the last 24 hours while automatically expiring older data, minimizing storage costs without manual intervention.

Answer

Amazon Redshift with automatic compression and distribution keys.

Answer

Amazon DynamoDB with TTL to expire data after 30 days.

Answer

Amazon S3 with lifecycle policies to transition to S3 Glacier after 30 days.

Question 11

A company is using Amazon EMR to process large datasets stored in Amazon S3. The data engineer wants to reduce the time it takes to read data from S3 by optimizing the data format. Which file format should the engineer recommend?

Accepted Answer

Parquet. Parquet is the correct choice because it is a columnar storage format that significantly reduces the amount of data read from Amazon S3 during analytical queries. By storing data column-wise, Parquet enables predicate pushdown and compression, which minimizes I/O and speeds up data processing in Amazon EMR, especially for large datasets.

Answer

CSV

Answer

ORC

Answer

JSON

Question 12

Which TWO options are valid ways to encrypt data at rest in Amazon S3? (Choose two.)

Accepted Answer

Server-Side Encryption with S3-Managed Keys (SSE-S3). Server-Side Encryption with S3-Managed Keys (SSE-S3) is a valid method for encrypting data at rest in Amazon S3 because it uses AES-256 encryption to automatically encrypt objects when they are written to S3 and decrypt them when accessed, with the encryption keys managed entirely by AWS. This option is correct as it directly addresses data at rest encryption within S3, requiring no client-side effort beyond setting the `x-amz-server-side-encryption` header to `AES256`.

Answer

Client-Side Encryption

Answer

SSL/TLS Encryption

Answer

IAM Policy Encryption

Question 13

A data engineer needs to store semi-structured JSON data that is accessed infrequently but must be retrievable within minutes. The data is generated by IoT devices and each object is about 500 KB. The engineer wants the most cost-effective storage solution. Which AWS service should be used?

Accepted Answer

Amazon S3 Standard-Infrequent Access (S3 Standard-IA). Amazon S3 Standard-Infrequent Access (S3 Standard-IA) is the correct choice because it is designed for data that is accessed infrequently but requires rapid retrieval (within minutes). The 500 KB JSON objects from IoT devices fit the use case, and S3 Standard-IA offers lower storage costs than S3 Standard while maintaining the same low-latency retrieval performance, making it the most cost-effective option for this scenario.

Answer

Amazon S3 Glacier Deep Archive

Answer

Amazon S3 Standard

Answer

Amazon Elastic Block Store (EBS)

Question 14

A company uses Amazon S3 to store sensitive financial data. The security team requires that all objects be encrypted at rest using AWS KMS with a customer-managed key. Additionally, they want to audit all KMS decrypt calls for compliance. Which configuration should be used to meet these requirements?

Accepted Answer

Use SSE-KMS with a customer-managed KMS key and enable CloudTrail data events for the key.. Option C is correct because SSE-KMS with a customer-managed key allows the company to control the encryption key lifecycle and meet the requirement for customer-managed keys. Enabling CloudTrail data events for the KMS key captures all decrypt API calls, providing the necessary audit trail for compliance.

Answer

Enable default encryption on the bucket with SSE-KMS using an AWS managed key.

Answer

Use SSE-S3 with a bucket policy that denies uploads without encryption.

Answer

Use SSE-C with client-managed keys and log S3 API calls.

Question 15

A company is using Amazon DynamoDB with auto scaling enabled. During a marketing campaign, write traffic spikes, and some write requests fail with ProvisionedThroughputExceededException. The auto scaling policy has a target utilization of 70% and a maximum capacity that is high enough. What is the most likely cause of the throttling?

Accepted Answer

Auto scaling cannot react quickly enough to sudden traffic spikes.. Auto scaling in DynamoDB adjusts capacity based on the average utilization over a period (typically 5-10 minutes). When a sudden traffic spike occurs, the write requests can exceed the current provisioned capacity before the auto scaling policy has time to react and increase the capacity. This delay causes ProvisionedThroughputExceededException errors, even though the maximum capacity is set high enough.

Answer

The table has a global secondary index that is throttling.

Answer

The table does not have enough maximum capacity.

Answer

The auto scaling policy is not configured correctly.