DEA-C01 Practice Test 14 — 15 Questions

Question 1

A data engineer is setting up Amazon S3 bucket policies for a data lake. The security team requires that all objects uploaded to the bucket be encrypted at rest using server-side encryption. Which TWO methods can enforce encryption at upload time?

Accepted Answer

Enable S3 default encryption on the bucket.. Option D is correct because enabling S3 default encryption on the bucket automatically applies server-side encryption (SSE-S3 or SSE-KMS) to all objects uploaded without an encryption header, ensuring encryption at rest. Option E is correct because a bucket policy with a Deny effect on PutObject when the x-amz-server-side-encryption header is missing enforces encryption at upload time by rejecting unencrypted uploads, providing a complementary enforcement mechanism.

Answer

Enable S3 Transfer Acceleration.

Answer

Enable AWS CloudTrail to monitor uploads.

Answer

Enable AWS KMS automatic key rotation.

Question 2

A company runs a real-time analytics platform on AWS. Data is ingested from thousands of IoT devices into Amazon Kinesis Data Streams. A Lambda function consumes the stream, processes the data, and writes the results to an Amazon DynamoDB table. The DynamoDB table has a provisioned write capacity of 1000 WCU, and the read capacity is set to 200 RCU. Recently, the company noticed that the Lambda function is failing with ProvisionedThroughputExceededException on DynamoDB writes. The Lambda function is configured with a batch size of 100 and a concurrency limit of 10. The Kinesis shard count is 4. The number of devices has increased, but the data volume per device has remained the same. The company needs to resolve the write throttling without increasing the DynamoDB write capacity. Which action should the data engineer take?

Accepted Answer

Reduce the batch size of the Lambda function to 10.. Reducing the batch size from 100 to 10 decreases the number of records processed per Lambda invocation, which reduces the burst of write requests to DynamoDB per invocation. This helps stay within the 1000 WCU limit without increasing capacity, as the same total throughput is spread across more invocations with smaller batches.

Answer

Increase the number of Kinesis shards to 8.

Answer

Increase the Lambda concurrency limit to 20.

Answer

Increase the batch size to 200.

Question 3

A company is migrating its on-premises Oracle data warehouse to Amazon Redshift. The data engineering team needs to load data from Oracle to Redshift using AWS DMS (Database Migration Service). The source database is 2 TB in size. The team wants to minimize downtime and ensure data consistency during full load. Which approach should they take?

Accepted Answer

Use AWS DMS to perform a full load, then enable ongoing replication to capture changes.. Option B is correct because AWS DMS can perform a full load of the 2 TB Oracle database while simultaneously capturing ongoing changes via CDC (Change Data Capture). After the full load completes, DMS applies the cached changes to Redshift, ensuring data consistency with minimal downtime. This approach avoids stopping the source database and leverages DMS's native replication capabilities.

Answer

Use UNLOAD command to export data from Oracle to S3, then COPY into Redshift.

Answer

Stop the source database, export data to flat files, upload to S3, and use COPY to load into Redshift.

Answer

Use COPY command directly from Oracle to Redshift over JDBC.

Question 4

A data engineer is using Amazon DynamoDB to store session data for a web application. The engineer wants to ensure that all data is encrypted at rest using an AWS managed key. Which THREE steps should the engineer take to achieve this? (Choose THREE.)

Accepted Answer

Specify an AWS KMS customer managed key for encryption if required.. Option C is correct because when using DynamoDB encryption at rest, you can choose between an AWS managed key (aws/dynamodb) or a customer managed key (CMK) in AWS KMS. Specifying a customer managed key is a valid step if the requirement is to use an AWS managed key, but the question asks for steps to achieve encryption with an AWS managed key, so selecting a customer managed key would be incorrect unless the engineer intends to use it; however, the option states 'if required', which aligns with the flexibility to choose. Option E is correct because creating the DynamoDB table with encryption at rest enabled using an AWS managed key directly fulfills the requirement—DynamoDB defaults to the AWS managed key when encryption is enabled without specifying a CMK.

Answer

Enable server-side encryption with S3-managed keys (SSE-S3) on the DynamoDB table.

Answer

Disable encryption at rest to improve performance.

Answer

Use client-side encryption before writing data to DynamoDB.

Question 5

A company uses Amazon S3 to store historical stock market data as CSV files. They run daily Amazon Athena queries to generate reports. Recently, the finance team reported that queries are timing out and costs have increased significantly. The data engineering team notices that the S3 bucket contains thousands of small files (average 100 KB) due to a misconfigured ingestion pipeline. They need to improve query performance and reduce costs without changing the existing reporting schedule. The team has access to AWS Glue and can create new tables. Which solution should they implement?

Accepted Answer

Use AWS Glue ETL to read the CSV files, convert them to Parquet, and write them back to S3 in fewer, larger files.. Option D is correct because converting the thousands of small CSV files into fewer, larger Parquet files using AWS Glue ETL directly addresses the root cause of poor Athena performance and high costs. Parquet is a columnar format that reduces the amount of data scanned per query, and larger files minimize the overhead of S3 LIST and GET operations, improving throughput. This solution does not change the reporting schedule and leverages existing Glue capabilities to create new optimized tables.

Answer

Partition the data by date and create a new Athena table with partitions.

Answer

Use S3 Select to filter rows within each file before Athena processes them.

Answer

Increase the Athena query timeout to 30 minutes.

Question 6

A company uses Kinesis Data Streams to ingest real-time clickstream data. The data is processed by a Lambda function that writes to an S3 bucket. Recently, the Lambda function has been failing with 'ProvisionedThroughputExceededException' errors. Which action should be taken to resolve this issue?

Accepted Answer

Increase the number of shards in the Kinesis stream.. The 'ProvisionedThroughputExceededException' error indicates that the Lambda function is reading data from the Kinesis stream faster than the stream's shard-level throughput limits allow. Each shard in a Kinesis Data Stream supports up to 2 MB/s read throughput or 5 read transactions per second. Increasing the number of shards distributes the read load across more shards, raising the total available read throughput and resolving the throttling.

Answer

Increase the Lambda function's memory allocation.

Answer

Enable enhanced fan-out for the stream.

Answer

Reduce the batch size in the Lambda event source mapping.

Question 7

A data engineering team is responsible for an Amazon RDS for PostgreSQL instance that stores financial data. The database is 500 GB in size. The team needs to create a read replica in a different AWS Region for disaster recovery. The source database has automated backups enabled with a retention period of 7 days. The team initiates the cross-region read replica creation. After several hours, the replica status shows 'Replication Lag' of 30 minutes and is increasing. What should the team do to reduce the replication lag?

Accepted Answer

Enable Multi-AZ on the source database instance.. Option C is correct because enabling Multi-AZ on the source provides synchronous standby and reduces replication lag by offloading backups and improving stability. Option A is incorrect because increasing backup retention does not affect replication. Option B is incorrect because modifying the DB instance class may help but is not the primary solution; Multi-AZ is more effective. Option D is incorrect because deleting and recreating may not solve the underlying issue.

Answer

Modify the source DB instance to use a larger instance class.

Answer

Delete the replica and create a new one from a snapshot.

Answer

Increase the backup retention period to 35 days.

Question 8

A company uses Amazon S3 to store large datasets for analytics. Each dataset is stored in a separate prefix and consists of thousands of small objects (1-10 KB each). The company notices that listing objects in a prefix takes several seconds, slowing down data processing. Which solution would MOST improve listing performance?

Accepted Answer

Use S3 Inventory to generate a daily listing of objects.. S3 Inventory provides a scheduled CSV/Parquet file listing all objects in a bucket or prefix, including metadata like size and last modified date. By querying this inventory file instead of issuing real-time ListObject API calls, you avoid the latency of enumerating thousands of small objects, dramatically improving listing performance for analytics workflows.

Answer

Add a lifecycle policy to transition objects to S3 Glacier.

Answer

Use S3 Select to filter objects during listing.

Answer

Increase the number of parallel requests by using more prefixes.

Question 9

A company uses Amazon CloudWatch Logs to collect application logs from EC2 instances. The logs are exported to Amazon S3 for long-term storage. Recently, the export task failed with the error 'Access Denied'. What is the most likely cause of this failure?

Accepted Answer

The IAM role does not have s3:PutObject permission on the destination bucket.. The export task from CloudWatch Logs to S3 uses an IAM role to write data to the destination bucket. If the role lacks the s3:PutObject permission, the S3 service will reject the request with an 'Access Denied' error. This is the most common cause because the export operation requires write access to the bucket.

Answer

The S3 bucket policy denies access from the CloudWatch Logs service.

Answer

The IAM role does not have s3:ListBucket permission.

Answer

The EC2 instances are in a VPC without a VPC endpoint for CloudWatch Logs.

Question 10

A company is migrating an on-premises MySQL database to Amazon RDS for MySQL. The database is 500 GB and has a 24/7 uptime requirement. The migration must minimize downtime. Which approach should be used?

Accepted Answer

Use AWS Database Migration Service (DMS) with ongoing replication to migrate the data.. AWS DMS with ongoing replication (change data capture) allows you to perform a full load of the 500 GB database and then continuously replicate changes from the on-premises MySQL source to the Amazon RDS target. This minimizes downtime because you can cut over to RDS in seconds after the target is synchronized, rather than taking the source offline for an extended period.

Answer

Take a snapshot of the on-premises database, convert it to a volume, and restore to RDS.

Answer

Export the database using mysqldump and import it into RDS using mysql command.

Answer

Create an RDS MySQL read replica from the on-premises database using native replication.

Question 11

A data engineer is troubleshooting an Amazon Redshift cluster that is experiencing slow query performance. The engineer notices that the disk space is heavily utilized and queries are spilling to disk. What is the most cost-effective solution to improve performance?

Accepted Answer

Resize the cluster to a larger node type or add nodes. When queries spill to disk due to heavy disk utilization, the root cause is insufficient memory or compute capacity relative to the workload. Resizing the cluster (adding nodes or moving to a larger node type) directly increases available memory and CPU, reducing or eliminating disk spill and improving query performance. This is the most cost-effective solution because it scales resources proportionally without requiring manual tuning or schema changes.

Answer

Run VACUUM command to reclaim space

Answer

Change distribution style to KEY

Answer

Apply compression encoding to tables

Question 12

A company needs to store streaming data from IoT devices with a retention period of 7 days for real-time analysis. Which AWS service is most suitable?

Accepted Answer

Amazon Kinesis Data Streams. Amazon Kinesis Data Streams is the most suitable service because it is designed for real-time ingestion and processing of streaming data, such as IoT device telemetry, with a default retention period of 24 hours, extendable up to 365 days. The requirement for a 7-day retention period for real-time analysis aligns perfectly with Kinesis Data Streams' ability to retain data for exactly that duration, allowing consumers to process records in near real-time using the Kinesis Client Library (KCL) or AWS Lambda.

Answer

Amazon DynamoDB

Answer

Amazon Kinesis Data Firehose

Answer

Amazon S3

Question 13

A company needs to store relational data that requires complex joins and transactional consistency. The workload is predictable and the data size is less than 500 GB. Which AWS service is MOST cost-effective for this use case?

Accepted Answer

Amazon RDS for PostgreSQL. Option B is correct because Amazon RDS provides managed relational databases with support for complex joins and transactions. Option A is wrong because DynamoDB is NoSQL and does not support complex joins. Option C is wrong because Redshift is for analytics and is overkill for 500 GB. Option D is wrong because S3 is not a relational database.

Answer

Amazon Redshift

Answer

Amazon S3

Answer

Amazon DynamoDB

Question 14

Which TWO of the following are valid approaches to implement fine-grained access control for Amazon DynamoDB items based on user attributes? (Choose 2.)

Accepted Answer

Use Amazon Cognito identity pools with IAM roles that include conditions based on user attributes.. Option C is correct because Amazon Cognito identity pools can be configured to assume IAM roles with fine-grained policies that use condition keys such as `dynamodb:LeadingKeys` or custom attribute-based conditions. This allows access to DynamoDB items to be restricted based on user-specific attributes (e.g., user ID) without hardcoding permissions per user.

Answer

Enable row-level security in DynamoDB using AWS Lake Formation.

Answer

Configure a VPC endpoint with a bucket policy to restrict access to specific items.

Answer

Store user-specific items in separate S3 buckets and use IAM policies to restrict bucket access.

Question 15

A company has an Amazon S3 bucket with versioning enabled. They want to automatically delete noncurrent versions of objects after 30 days. Which lifecycle rule action should be used?

Accepted Answer

NoncurrentVersionExpiration. The NoncurrentVersionExpiration lifecycle action is specifically designed to remove noncurrent object versions after a specified number of days. Since versioning is enabled and the requirement is to delete noncurrent versions after 30 days, this action directly meets the goal without affecting current versions or other lifecycle aspects.

Answer

Expiration

Answer

NoncurrentVersionTransition

Answer

AbortIncompleteMultipartUpload