DEA-C01 Practice Test 15 — 15 Questions

Question 1

A data engineer needs to share a dataset from an S3 bucket in Account A with another AWS account (Account B). The data must remain encrypted at rest with KMS. Which steps are required?

Accepted Answer

Update the S3 bucket policy and the KMS key policy to allow Account B. The correct steps are to update both the S3 bucket policy to grant Account B access to the objects and the KMS key policy to grant Account B the necessary decrypt permissions. Option A is insufficient because it only updates the KMS key policy; the bucket policy must also be updated to allow Account B's access to the S3 objects. Option B is also insufficient because creating an IAM role alone does not grant KMS decrypt permissions; the KMS key policy must be updated. Option C is correct as it includes both. Option D is insufficient because it only updates the bucket policy, not the KMS key policy.

Answer

Update the KMS key policy to allow Account B's root user

Answer

Create an IAM role in Account A and grant cross-account access

Answer

Update the S3 bucket policy to allow Account B's root user

Question 2

A company stores sensitive data in Amazon S3 and needs to ensure that data is encrypted at rest. Which AWS service can be used to manage the encryption keys?

Accepted Answer

AWS Key Management Service (KMS). AWS Key Management Service (KMS) is the managed service for creating and controlling encryption keys used to encrypt data at rest in Amazon S3. Option A is correct. Option B (Secrets Manager) is for managing secrets like database passwords, not encryption keys. Option C (IAM) manages access permissions, not encryption keys. Option D (Certificate Manager) handles SSL/TLS certificates, not encryption keys for data at rest.

Answer

AWS Secrets Manager

Answer

AWS Identity and Access Management (IAM)

Answer

AWS Certificate Manager (ACM)

Question 3

A data engineer wants to ensure that only users with a specific tag (e.g., "Department": "DataEngineering") can access an S3 bucket. How can this be enforced?

Accepted Answer

Use a bucket policy with aws:PrincipalTag condition. S3 bucket policies support condition keys like aws:PrincipalTag, which allow access control based on tags attached to IAM principals (users or roles). Option A is correct because it uses aws:PrincipalTag in the bucket policy to restrict access to users with the specific tag. Option B is incorrect because S3 object tags are for objects, not principals, and cannot be used to filter users. Option C is incorrect because attaching an IAM policy to each user is less scalable and does not leverage the bucket policy's centralized control. Option D is incorrect because S3 Object Lambda is for modifying data during retrieval, not for access control decisions.

Answer

Use S3 object tags and a bucket policy condition

Answer

Attach an IAM policy to each user with the tag

Answer

Use S3 Object Lambda to check user tags

Question 4

Order the steps to set up an Amazon EMR cluster for processing data in S3 using Spark.

Accepted Answer

Prepare the S3 bucket, then launch the EMR cluster with Spark, then configure instances, then submit the job, then terminate the cluster.. First, prepare the S3 bucket. Then launch the EMR cluster with Spark, configure instances, submit the job, and terminate.

Answer

Launch the EMR cluster with Spark, then prepare the S3 bucket, then configure instances, then submit the job, then terminate the cluster.

Answer

Prepare the S3 bucket, then configure instances, then launch the EMR cluster with Spark, then submit the job, then terminate the cluster.

Answer

Submit the job, then launch the EMR cluster with Spark, then configure instances, then prepare the S3 bucket, then terminate the cluster.

Question 5

Refer to the exhibit. An IAM policy is attached to an IAM role used by an application. The application needs to read objects from 'my-bucket' that have the tag 'classification=public'. The application account is 123456789012. However, the application is getting 'Access Denied' errors. What is the most likely reason?

Accepted Answer

The object being accessed does not have the tag 'classification=public'.. The most likely reason for Access Denied is that the object being accessed does not have the tag 'classification=public'. The policy's Allow statement is conditioned on s3:ExistingObjectTag/classification equaling 'public', so if the tag is missing or has a different value, the Allow does not match and the request is denied. The Deny statement in the policy is a separate guardrail and is not the cause here.

Answer

The Deny statement uses StringNotEquals, which incorrectly denies the application account.

Answer

The policy does not grant s3:ListBucket permission, so the application cannot list objects.

Answer

The Deny statement blocks all access from accounts other than 123456789012, but the application is in that account.

Question 6

A company uses Amazon Kinesis Data Analytics for Apache Flink to process streaming data. The Flink application reads from a Kinesis Data Streams source, performs aggregations, and writes results to Amazon S3. The application is experiencing high checkpoint failures, and the processing lag is increasing. The data volume is 50 MB/s with an average record size of 1 KB. Which TWO actions would improve checkpoint reliability and reduce lag? (Choose TWO.)

Accepted Answer

Increase the checkpoint interval in the Flink configuration.. Increasing the checkpoint interval (Option D) reduces the frequency of checkpoint operations, which decreases the overhead on the Flink application and allows it to dedicate more resources to processing data, thereby reducing lag. This is especially effective when checkpoint failures are caused by the system being unable to complete checkpoints within the current interval due to high throughput (50 MB/s).

Answer

Decrease the checkpoint interval to complete checkpoints faster.

Answer

Replace the S3 sink with Kinesis Data Firehose.

Answer

Decrease the parallelism of the Flink application.

Question 7

A data engineer is building a pipeline to ingest data from an on-premises Oracle database into Amazon S3. The pipeline must capture change data (CDC) in near real-time and handle schema changes. Which TWO AWS services should the engineer use?

Accepted Answer

AWS Glue Schema Registry. AWS Glue Schema Registry (A) is correct because it enables schema discovery, validation, and evolution for streaming data, allowing the pipeline to handle schema changes from the Oracle CDC source. It integrates with Apache Kafka and Amazon Kinesis Data Streams to enforce schema compatibility rules (e.g., backward, forward, full) as data arrives, ensuring downstream consumers can adapt to evolving schemas without breaking.

Answer

AWS Snowball Edge

Answer

Amazon AppFlow

Answer

Amazon Kinesis Data Streams with Kinesis Agent

Question 8

A company uses AWS KMS to encrypt data in Amazon S3. The security team wants to ensure that the KMS key can only be used from within the company's VPC. Which policy element should be added to the KMS key policy?

Accepted Answer

Add a condition using aws:SourceVpc to allow only requests from the VPC.. The correct approach is to add a condition using the aws:SourceVpc condition key in the KMS key policy. This condition evaluates the VPC ID from which the request originates, allowing you to restrict key usage to requests that come through a VPC endpoint within your VPC. When a request is made to KMS through a VPC endpoint, the aws:SourceVpc condition key is populated with the VPC ID, enabling precise control. This ensures that the KMS key can only be used from within the specified VPC, meeting the security team's requirement.

Answer

Set the Principal element to restrict access to the VPC.

Answer

Add a condition using aws:SourceIp to allow only IP addresses from the VPC.

Answer

Add a condition using kms:ViaService to allow only via VPC endpoints.

Question 9

A company uses AWS Glue to run ETL jobs that transform data from Amazon S3 (Parquet) into a denormalized format for Amazon Redshift. The Glue job uses the DynamicFrame API. The job is failing with a 'MemoryError' when performing a join operation. The data is skewed on the join key. Which THREE actions can reduce memory usage and improve job stability? (Choose THREE.)

Accepted Answer

Use a broadcast join if one of the tables is small enough.. A broadcast join (using `join` with `broadcast` hint or `DynamicFrame.join(..., transformation_ctx='...')` with broadcast enabled) avoids shuffling the larger table across the cluster by copying the small table to every executor. This eliminates the memory pressure from skewed key distribution during the shuffle phase, reducing the risk of a MemoryError.

Answer

Increase the number of DPUs for the Glue job.

Answer

Repartition the data on the join key before the join operation.

Question 10

A data engineer is monitoring an Amazon EMR cluster and notices that the cluster is running out of disk space on the core nodes. Which action can be taken to resolve this issue?

Accepted Answer

Increase the EBS volume size attached to core nodes. Increasing the EBS volume size attached to core nodes directly adds storage capacity, resolving the disk space issue. Option A is wrong because reducing HDFS data retention may free space but does not increase available disk space; it could result in data loss. Option B is wrong because changing to a compute-optimized instance type affects CPU and memory, not storage. Option D is wrong because Spot Instances are a pricing model and do not add disk space.

Answer

Reduce the retention period of data stored on HDFS

Answer

Change the core node instance type to a compute-optimized type

Answer

Use Spot Instances for core nodes

Question 11

A data engineer is monitoring an Amazon Redshift cluster and notices that the disk space usage is increasing rapidly. The engineer wants to reclaim space from deleted rows. Which command should the engineer run?

Accepted Answer

VACUUM. VACUUM in Amazon Redshift reclaims disk space occupied by rows marked for deletion and re-sorts rows to restore sort order. When rows are deleted, they are only logically marked until VACUUM runs, so disk usage keeps growing. Running VACUUM (or VACUUM DELETE ONLY) releases that space back to the system.

Answer

ANALYZE

Answer

UNLOAD

Answer

COPY

Question 12

A data engineer needs to load data from an on-premises Oracle database to Amazon S3 daily. The table is 500 GB and grows by 50 MB per day. The load must capture only new and changed rows since the last run. Which solution is MOST cost-effective and requires the least maintenance?

Accepted Answer

Use AWS Database Migration Service (DMS) with ongoing replication (CDC). AWS DMS with ongoing replication (CDC) is the most cost-effective and low-maintenance solution because it continuously captures only new and changed rows from the Oracle source using its built-in CDC mechanism (reading redo logs), without requiring custom scripting or full table exports. It automatically handles schema changes, resumability, and incremental loading to S3, minimizing operational overhead and data transfer costs.

Answer

Write a custom Python script on EC2 to query the Oracle redo logs and upload to S3

Answer

Export the entire table to CSV daily using a script and upload to S3

Answer

Use AWS Glue ETL job with a JDBC connection and a timestamp filter

Question 13

A company is using Amazon RDS for MySQL and needs to automate backups with a retention period of 35 days. They also want to be able to restore to any point within the retention period. Which configuration should be used?

Accepted Answer

Set the backup retention period to 35 days and enable automatic backups.. Amazon RDS for MySQL supports automated backups with a configurable retention period of up to 35 days. By setting the backup retention period to 35 days and enabling automatic backups, RDS automatically performs daily snapshots and transaction log backups, enabling point-in-time recovery (PITR) to any second within the retention window. This meets the requirement for both a 35-day retention and full PITR capability without manual intervention.

Answer

Enable manual snapshots daily and retain for 35 days.

Answer

Set the backup retention period to 7 days and create daily manual snapshots.

Answer

Disable automated backups and rely on Multi-AZ for recovery.

Question 14

A data engineer is troubleshooting a failed AWS Glue job that reads from an Apache Hive metastore in an Amazon EMR cluster. The error message indicates 'ClassNotFoundException: org.apache.hadoop.hive.ql.metadata.HiveException'. The Glue job uses a custom Python shell script. What is the most likely cause of this error?

Accepted Answer

Include the Hive JAR files in the 'Python library path' or use a Glue version with Hive support.. The 'ClassNotFoundException' for a Hive class indicates the Hive JARs are not on the classpath at runtime. AWS Glue's Python shell jobs run in an environment that does not include Hive libraries by default, so the engineer must either add the Hive JARs to the Python library path or use a Glue version/configuration that bundles Hive support. This is a classpath/dependency issue, not a network or IAM problem.

Answer

Check the network connectivity between Glue and the EMR cluster.

Answer

Modify the Python script to import the Hive libraries manually.

Answer

Update the IAM role to allow 'hive:Describe*' actions.

Question 15

A company runs an Amazon RDS for PostgreSQL database and wants to capture change data (inserts, updates, deletes) to stream into Amazon Kinesis Data Streams for real-time processing. Which AWS service should be used to capture the changes directly from the database?

Accepted Answer

AWS Database Migration Service (DMS) with ongoing replication. AWS DMS with ongoing replication (change data capture) is the correct service because it can continuously capture insert, update, and delete operations from the PostgreSQL transaction logs (WAL) and stream them to a Kinesis Data Streams endpoint. This allows real-time processing without modifying the source database or requiring application-level triggers.

Answer

Amazon RDS automated snapshots

Answer

AWS Glue ETL job scheduled to run every minute

Answer

Amazon Kinesis Agent