DEA-C01 Practice Test 15 — 15 Questions

Question 1

A company wants to migrate its on-premises MySQL database to Amazon RDS for MySQL with minimal downtime. Which AWS service should be used for the migration?

Accepted Answer

AWS Database Migration Service (DMS). AWS Database Migration Service (DMS) is purpose-built for migrating databases to AWS with minimal downtime by using ongoing replication (change data capture, CDC) from the source MySQL database to the target Amazon RDS for MySQL instance. This allows the source to remain fully operational during the migration, meeting the minimal-downtime requirement.

Answer

AWS Schema Conversion Tool (SCT)

Answer

AWS DataSync

Answer

AWS Direct Connect

Question 2

Refer to the exhibit. A data engineer runs the above CLI command to find files smaller than 1000 bytes in a bucket. The command returns an empty array, but the engineer knows there are small files. What is the issue?

Accepted Answer

The Size is compared as a string, not an integer; remove quotes around '1000'.. In the AWS CLI `list-objects-v2` command with `--query`, the `Size` field is a numeric value, but the query string `Size < '1000'` compares it as a string. This causes a lexicographic comparison, so files with sizes like '900' would be correctly matched, but any size with more digits (e.g., '1000' itself or '999') may fail due to string ordering. Removing the quotes around `1000` treats it as an integer, enabling proper numeric comparison.

Answer

The prefix is incorrect; it should be 'logs/2023/01/01/'.

Answer

The bucket policy does not allow listing objects.

Answer

The query syntax is invalid; use a filter instead.

Question 3

Refer to the exhibit. A company uses S3 Event Notifications to trigger an AWS Lambda function whenever a new object is uploaded to an S3 bucket. The Lambda function processes the file and moves it to a different bucket. Recently, the function has been failing intermittently. The engineer checks the Lambda CloudWatch logs and sees the above event. What is the MOST likely cause of the intermittent failures?

Accepted Answer

The S3 event notifications are not guaranteed to be delivered exactly once, causing duplicate processing.. S3 Event Notifications are asynchronous and may be duplicated or delivered out of order, causing race conditions. Option A is wrong because the event has all required fields. Option B is wrong because the bucket name is valid. Option D is wrong because the event format is correct.

Answer

The event JSON is malformed; the 'EventSource' should be 's3.amazonaws.com'.

Answer

The S3 bucket name contains a hyphen, which is not allowed.

Answer

The event is missing the 'object:versionId' field.

Question 4

A data engineer is designing a pipeline that ingests JSON logs from an application into Amazon S3. The logs contain a timestamp field. The pipeline must partition the data by date in S3 (e.g., year=2024/month=10/day=01). Which approach minimizes transformation effort?

Accepted Answer

Use Amazon Kinesis Data Firehose with dynamic partitioning. Amazon Kinesis Data Firehose with dynamic partitioning can automatically partition incoming JSON data based on the timestamp field without requiring custom transformation code. It evaluates the timestamp using a JQ expression or inline parsing, then writes records directly to S3 prefixes like year=2024/month=10/day=01. This minimizes transformation effort because the partitioning logic is configured declaratively in the Firehose delivery stream, eliminating the need for Lambda functions or post-ingestion processing.

Answer

Use AWS Glue crawlers to infer schema and create partitions

Answer

Use AWS Lambda to process each object and copy to the appropriate prefix

Answer

Use Amazon Athena to create partitions on the existing data

Question 5

A data engineer is configuring a VPC for an Amazon Redshift cluster. The cluster must be accessible only from a specific on-premises network via a Direct Connect connection. Which TWO actions should the engineer take to meet this requirement? (Choose TWO.)

Accepted Answer

Configure a security group to allow inbound traffic from the on-premises CIDR block.. To restrict access to an Amazon Redshift cluster from a specific on-premises network via Direct Connect, the engineer should use a security group (option B) to control inbound traffic at the instance level, and a network ACL (option C) for subnet-level traffic control. Both should allow traffic from the on-premises CIDR block. Option A (Enhanced VPC Routing) is incorrect because it controls how traffic flows between the cluster and other resources, not inbound access. Option D (VPC endpoint) is incorrect because a VPC endpoint provides private connectivity from within the VPC, not from on-premises via Direct Connect. Option E (publicly accessible) is insecure and unnecessary when using Direct Connect.

Answer

Enable Redshift Enhanced VPC Routing.

Answer

Create a VPC endpoint for Redshift.

Answer

Make the Redshift cluster publicly accessible.

Question 6

A company is using AWS Glue to run ETL jobs that process data from Amazon S3 and load it into Amazon Redshift. The jobs are failing with the error 'Unable to connect to Redshift cluster'. The Redshift cluster is in the same VPC as the Glue job. What is the MOST likely cause?

Accepted Answer

The Glue job is not configured to use the same VPC as the Redshift cluster.. The most likely cause is that the Glue job is not configured to use the same VPC as the Redshift cluster. By default, AWS Glue jobs run in a separate VPC managed by Glue. To connect to resources in a customer VPC (like a Redshift cluster), the Glue job must be explicitly associated with that VPC via a Glue connection or job configuration. Option C is correct. Option A is incorrect because even if the security group allows inbound traffic, the Glue job's network may not be routed to the Redshift cluster if it is in a different VPC. Option B is incorrect because the IAM role handles authentication, not network connectivity. Option D is incorrect because the Redshift cluster is in the same VPC, so public accessibility is not required; the error indicates a network connectivity issue, not a public access issue.

Answer

The Redshift cluster's security group does not allow inbound traffic from the Glue job's security group.

Answer

The IAM role associated with the Glue job does not have permission to access Redshift.

Answer

The Redshift cluster is not publicly accessible and Glue is trying to connect from outside the VPC.

Question 7

A company runs a data pipeline on AWS Glue that processes streaming data from Amazon Kinesis Data Streams and writes results to an Amazon Redshift cluster. The pipeline has been running smoothly, but recently the Glue job started failing with 'ResourceNotFoundException' for the Redshift table. What should the data engineer check first?

Accepted Answer

Verify that the target Redshift table exists and was not dropped or renamed.. The error indicates the table does not exist or was deleted. Option B is wrong because IAM role issues would cause Access Denied, not ResourceNotFoundException. Option C is wrong because network issues would cause timeout or connection refused. Option D is wrong because schema changes could cause type mismatch but not ResourceNotFoundException.

Answer

Ensure the Redshift table schema matches the Glue job output.

Answer

Check the IAM role permissions for the Glue job to access Redshift.

Answer

Review security group rules for the Redshift cluster.

Question 8

A company uses Amazon Redshift for data warehousing. The security team requires that data be encrypted at rest using a customer-managed key (CMK) in AWS KMS, and that the key be rotated automatically every year. Additionally, the team wants to restrict access to the key to only the Redshift cluster and a security admin IAM role. Which steps should the company take? (Choose THREE.)

Accepted Answer

Add the security admin IAM role as a key user in the KMS key policy.. Options A, C, and E are correct. Option A adds the security admin IAM role as a key user in the KMS key policy. Option C enables automatic yearly rotation of the CMK. Option E creates a new Redshift cluster and specifies the CMK for encryption. Option B is wrong because you cannot enable encryption on an existing unencrypted cluster by altering it; you must create a new cluster or restore from an encrypted snapshot. Option D is wrong because it disables rotation, which conflicts with the security requirement.

Answer

Alter the existing Redshift cluster to enable encryption with the CMK.

Answer

Disable automatic key rotation to comply with security policy.

Question 9

A media company ingests large video files from partners via AWS Transfer Family (SFTP) into an S3 bucket. Each file is typically 2-5 GB. Once uploaded, an AWS Lambda function is triggered to transcode the video using Amazon Elastic Transcoder. The Lambda function reads the file from S3, submits a transcoding job to Elastic Transcoder, and writes the output back to a different S3 bucket. Recently, the Lambda function has been failing intermittently with timeouts, and the company reports that some files are not being transcoded. The CloudWatch logs show that the Lambda function is timing out after 15 minutes. The average transcoding job takes about 10 minutes to complete. The data engineer needs to fix the issue without changing the architecture drastically. What should the data engineer do?

Accepted Answer

Modify the Lambda function to submit the transcoding job asynchronously and exit, using an SNS topic to trigger a second Lambda function when the job completes.. The Lambda function is timing out because it waits synchronously for the Elastic Transcoder job to complete, which can exceed the 15-minute Lambda timeout. The correct fix is to decouple the transcoding submission from the waiting: modify the Lambda function to submit the job asynchronously and exit immediately, then use an SNS topic or CloudWatch Events to trigger a second Lambda function when the job completes. This avoids the timeout. Option A (increasing reserved concurrency) does not address the root cause; timeouts occur per invocation, not due to lack of concurrency. Option B (increasing timeout to 20 minutes) might work but is not ideal because jobs can vary and still exceed the new timeout; the better pattern is asynchronous processing. Option D (replacing Transfer Family with DMS) is incorrect because DMS is for database migration, not file transfer and transcoding.

Answer

Increase the Lambda function's reserved concurrency to allow multiple invocations in parallel.

Answer

Increase the Lambda function timeout to 20 minutes to accommodate longer transcoding jobs.

Answer

Replace AWS Transfer Family with AWS Database Migration Service to handle file transfers more efficiently.

Question 10

A data engineer is troubleshooting a slow Amazon Redshift query that joins several large tables. The query plan shows a large number of broadcasts. Which design change would most likely reduce the broadcast operations?

Accepted Answer

Change the DISTKEY on all tables to match the join column.. Setting the DISTKEY on all tables to the join column ensures that rows with the same join key value are co-located on the same compute node. This allows Redshift to perform a collocated join, eliminating the need to broadcast entire tables across the network, which is the primary cause of the slow query.

Answer

Change the SORT KEY on all tables to match the join column.

Answer

Change the DISTSTYLE to EVEN on all tables.

Answer

Change the DISTSTYLE to ALL on all large tables.

Question 11

A company uses Amazon DynamoDB as a session store for a web application. During peak hours, the application experiences high latency and throttling on the DynamoDB table. The table has a read capacity of 5000 RCU and write capacity of 2000 WCU. The application reads and writes session data using the session ID as the partition key. What is the most cost-effective solution to reduce throttling?

Accepted Answer

Implement DynamoDB Accelerator (DAX) to cache frequent reads.. DynamoDB Accelerator (DAX) provides an in-memory cache that absorbs read-heavy traffic, reducing the load on the underlying DynamoDB table. Since the application reads session data using the session ID as the partition key, DAX can serve frequent reads with microsecond latency, eliminating throttling without requiring a capacity increase. This is the most cost-effective solution because it avoids provisioning additional RCUs for reads that are repetitive and cacheable.

Answer

Enable Auto Scaling on the table to automatically adjust capacity.

Answer

Increase the read capacity units (RCU) and write capacity units (WCU) to 10000 each.

Answer

Enable DynamoDB global tables to distribute read traffic.

Question 12

A data engineer needs to share a dataset from an S3 bucket in Account A with users in Account B. The dataset must remain encrypted at rest with an S3-managed key. What is the MOST secure way to grant cross-account access?

Accepted Answer

Create a bucket policy that grants cross-account access to an IAM role in Account B.. A bucket policy granting access to the IAM role in Account B is the recommended secure method for cross-account access to S3 objects encrypted with S3-managed keys. Option A is insecure because it grants public access. Option C is incorrect because ACLs are legacy and less secure for cross-account scenarios. Option D is incorrect because while S3 VPC endpoints are a valid AWS feature that provides private connectivity to S3, they do not grant cross-account access; bucket policies are still required to authorize access.

Answer

Make the bucket public and use bucket policies to allow only Account B users.

Answer

Use S3 object ACLs to grant access to Account B's root user.

Answer

Use an S3 VPC endpoint to allow Account B users through private IPs.

Question 13

A company uses Amazon Kinesis Data Analytics for real-time anomaly detection on clickstream data. The application uses a sliding window of 1 minute. The data engineer notices that the application is producing incorrect results because late-arriving records are not being handled properly. What should the data engineer do to ensure late records are included in the window calculations?

Accepted Answer

Increase the watermark delay in the Kinesis Data Analytics application to allow more time for late records.. Kinesis Data Analytics uses watermarks to track event time progress and determine when to finalize window calculations. Increasing the watermark delay allows the application to wait longer for late-arriving records before closing the window, ensuring they are included in the aggregation.

Answer

Use a Kinesis Data Firehose to buffer the data and then send to Kinesis Data Analytics.

Answer

Increase the window size from 1 minute to 2 minutes.

Answer

Increase the retention period of the Kinesis stream to 7 days.

Question 14

A healthcare company stores sensitive patient data in an S3 bucket (bucket name: patient-data-prod). The security team requires that all data be encrypted in transit and at rest, and that access be logged for auditing. The company currently uses S3 default encryption with SSE-S3. An external auditor finds that some objects have been uploaded without encryption because the default encryption setting was not applied to objects uploaded before the setting was enabled. The company wants to prevent any future unencrypted uploads and ensure all existing objects are encrypted. Which combination of actions should the data engineer take? (Choose TWO.)

Accepted Answer

Use S3 Batch Operations to copy all existing objects in place with the 'Copy' operation to apply default encryption.. To prevent future unencrypted uploads, the bucket policy must deny PutObject requests that do not include the x-amz-server-side-encryption header set to 'AES256' (Option E). This ensures all new objects are encrypted with SSE-S3. To encrypt existing objects that were uploaded before default encryption was enabled, S3 Batch Operations can perform a copy in place to apply default encryption (Option A). Option C alone would not apply to existing objects. Option B is unrelated, and Option D references KMS, which is not needed since SSE-S3 uses AES256. Therefore, the correct combination is Options A and E.

Answer

Enable S3 Object Ownership and set the bucket ACL to private.

Answer

Enable S3 default encryption on the bucket.

Answer

Create a bucket policy that denies s3:PutObject if the x-amz-server-side-encryption-aws-kms-key-id is not present.

Question 15

Refer to the exhibit. A data engineer ran the CLI command to check the configuration of an RDS instance named 'mydb'. Which statement accurately describes the current configuration?

Accepted Answer

The database is a Single-AZ deployment and is not a read replica. The CLI command output shows 'DBInstanceStatus: available' and 'MultiAZ: False', indicating the database is running as a Single-AZ deployment. Additionally, the absence of a 'SourceDBInstanceIdentifier' field confirms it is not a read replica. The 'ReadReplicaSourceDBInstanceIdentifier' is not present, which would be required if it were a read replica.

Answer

The database is in the 'stopped' state

Answer

The database is a read replica of another instance

Answer

The database is a Multi-AZ deployment