DEA-C01 Practice Test 16 — 15 Questions

Question 1

A company uses Amazon S3 to store sensitive data. The security team requires that all data be encrypted at rest using a customer-managed key that is rotated annually. Which encryption option should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

SSE-KMS (Server-Side Encryption with AWS KMS).. SSE-KMS is the correct choice because it allows you to use a customer-managed key (CMK) in AWS KMS, which you can configure to rotate automatically on an annual schedule. This satisfies the security team's requirement for encryption at rest with a key you control and rotate yearly, while still leveraging server-side encryption that integrates with S3's existing infrastructure.

Answer

SSE-S3 (Server-Side Encryption with S3-managed keys).

Answer

Client-side encryption.

Answer

SSE-C (Server-Side Encryption with Customer-Provided keys).

Question 2

A data engineer is setting up an Amazon Kinesis Data Analytics application to process streaming data from a Kinesis data stream named "input-stream". The application uses a reference data source from an S3 bucket. The engineer has attached the IAM policy shown in the exhibit to the application's IAM role. When starting the application, the engineer receives an 'AccessDeniedException' error. Which additional permission is required?

Accepted Answer

s3:GetObject on the S3 bucket containing the reference data. The Kinesis Data Analytics application needs to read reference data from the S3 bucket, which requires the s3:GetObject permission on the bucket and its objects. The error 'AccessDeniedException' indicates the IAM role lacks this specific permission to retrieve the reference data file. Option B correctly adds the missing s3:GetObject action to allow the application to fetch the reference data from S3.

Answer

kinesis:PutRecord on the input stream

Answer

kinesis:CreateStream on the input stream

Answer

kinesis:PutRecords on the input stream

Question 3

A data engineer is setting up a data pipeline to ingest streaming data from an IoT fleet. The data must be processed in near real-time and stored in Amazon S3 for analytics. Which THREE AWS services should the engineer consider using?

Accepted Answer

Amazon Kinesis Data Firehose. Amazon Kinesis Data Firehose (B) is correct because it is a fully managed service designed to reliably load streaming data directly into Amazon S3 (and other destinations) with near real-time delivery, requiring no server management. Amazon Kinesis Data Streams (E) is correct because it ingests and buffers high-throughput streaming data from IoT fleets in real time, allowing custom consumers to process the data before it is stored in S3. AWS Lambda (C) is correct because it can be invoked by Kinesis to process streaming records in near real-time, enabling serverless transformation or enrichment of the IoT data before it lands in S3. Amazon EMR (A) is not the best fit here because it is a batch-oriented big data processing platform (Hadoop/Spark) rather than a streaming ingestion service, and AWS Glue (D) is primarily a serverless ETL and data catalog service for batch and some streaming jobs, not a dedicated real-time ingestion pipeline component for this scenario.

Answer

Amazon EMR

Answer

AWS Glue

Question 4

A company uses AWS Glue to run ETL jobs daily. The jobs consume data from an Amazon RDS for MySQL database and write results to Amazon S3. The company wants to minimize the impact on the source database during extraction. Which THREE actions should the data engineer take to achieve this? (Choose THREE.)

Accepted Answer

Schedule the Glue job to run during off-peak hours.. Scheduling the Glue job to run during off-peak hours minimizes the load on the source RDS for MySQL database by avoiding high-traffic periods, reducing contention for CPU, memory, and I/O resources. This is a straightforward operational practice to reduce impact on production databases during extraction.

Answer

Increase the number of Glue DPUs to process data faster.

Answer

Disable Glue job bookmarks to force full refresh.

Question 5

Which TWO of the following are best practices for Amazon Redshift table design? (Choose TWO.)

Accepted Answer

Choose sort keys based on query patterns. Option A is correct because choosing sort keys based on query patterns allows Amazon Redshift to use zone maps and skip scanning irrelevant blocks, dramatically reducing I/O for range-filtered and ordered queries. Option D is correct because specifying an appropriate distribution key colocates matching rows on the same compute node slice, so joins and aggregations on that key avoid costly data redistribution across the network. Option B is wrong because large data loads should use COPY (ideally from Amazon S3) rather than INSERT, which is slow and row-by-row. Option C is wrong because compression encoding is a best practice that reduces storage and I/O; Redshift uses columnar compression with minimal CPU penalty, so avoiding it is counterproductive. Option E is wrong because distribution style ALL replicates the entire table to every node, which is only suitable for small dimension tables and causes excessive storage and load overhead on large tables.

Answer

Use INSERT statements for large data loads

Answer

Avoid compression encoding to reduce CPU overhead

Answer

Set distribution style to ALL for all tables

Question 6

A company uses AWS DMS to migrate data from an on-premises Oracle database to Amazon Aurora MySQL. After the migration, the data in Aurora is inconsistent with the source. The engineer needs to ensure ongoing replication with minimal downtime. Which solution should the engineer implement?

Accepted Answer

Configure a DMS task with change data capture (CDC). Configuring a DMS task with Change Data Capture (CDC) enables ongoing replication of changes from the source Oracle database to the target Aurora MySQL database with minimal downtime, ensuring consistency. Option A is incorrect because AWS Schema Conversion Tool (SCT) only converts schema and does not handle data replication. Option B is incorrect because mysqldump provides a one-time export/import, not ongoing replication. Option D is incorrect because performing a full load migration again would disrupt operations and would not capture ongoing changes.

Answer

Use AWS Schema Conversion Tool (SCT) to convert the schema

Answer

Export the data from Oracle and import into Aurora using mysqldump

Answer

Perform a full load migration again

Question 7

Which THREE AWS services can be used to centrally manage and govern data across multiple AWS accounts? (Select THREE.)

Accepted Answer

AWS Control Tower. AWS Control Tower (B) is correct because it provides a centralized landing zone with guardrails and account provisioning that enforces governance and data management policies across multiple AWS accounts. AWS Organizations (C) is correct because it enables central management of multiple accounts through organizational units, service control policies (SCPs), and consolidated billing, which are foundational for cross-account governance. AWS Lake Formation (E) is correct because it centrally manages data lake permissions, cataloging, and fine-grained access control across accounts using AWS RAM resource shares and the Glue Data Catalog. Amazon S3 (A) is incorrect because it is an object storage service, not a cross-account governance or central management service, even though it can host data governed by other services. Amazon Redshift (D) is incorrect because it is a data warehouse service for analytics, not a service for centrally managing and governing data across multiple accounts.

Answer

Amazon S3

Answer

Amazon Redshift

Question 8

A media company stores video files in an Amazon S3 bucket. The bucket policy allows access only from a specific VPC. The company has enabled S3 Server Access Logs to monitor access. Recently, the security team found that some requests were coming from an IP address outside the allowed VPC. They suspect that the bucket policy may have an incorrect condition. What should they check first?

Accepted Answer

Verify that the bucket policy uses the 'aws:SourceVpc' condition key with the correct VPC ID.. The first thing to check is the bucket policy condition key. The 'aws:SourceVpc' condition key is used to restrict access to a specific VPC, but if it is misconfigured (e.g., wrong VPC ID or incorrect condition operator), requests from outside the VPC might be allowed. Verifying this key ensures the policy is correctly enforcing the VPC restriction.

Answer

Review the S3 Server Access Logs to identify the source IP addresses.

Answer

Ensure that the IAM role used by the application has the correct permissions.

Answer

Check if the bucket policy allows public access.

Question 9

A company runs a data warehouse on Amazon Redshift. The data engineer notices that some queries are running slowly. Upon reviewing the system tables, the engineer finds that the 'svv_table_info' shows high 'unsorted' percentage for several large tables. What is the MOST effective action to improve query performance?

Accepted Answer

Run the VACUUM command on the tables.. A high 'unsorted' percentage in svv_table_info means many rows were added after the last sort and are not in sort-key order, forcing Redshift to scan more blocks and slowing range-restricted queries. VACUUM re-sorts the table and reclaims space, restoring the benefits of the sort key. This is the direct, most effective fix for the reported symptom.

Answer

Run the ANALYZE command on the tables.

Answer

Change the distribution style of the tables to ALL.

Answer

Increase the number of nodes in the Redshift cluster.

Question 10

A data engineer is troubleshooting a slow-running Amazon Athena query. The query scans a large amount of data. Which TWO actions can improve query performance? (Choose TWO.)

Accepted Answer

Convert the data to Parquet or ORC format.. Option A is correct because converting data to columnar formats like Parquet or ORC lets Athena read only the columns referenced in the query and benefits from compression and predicate pushdown, drastically reducing the bytes scanned and thus improving performance and lowering cost. Option D is correct because partitioning the table on frequently filtered columns (e.g., date or region) enables partition pruning, so Athena skips scanning irrelevant partitions instead of reading the entire dataset. Option B is incorrect because encryption at rest protects stored data but does not reduce the amount of data scanned or speed up query execution. Option C is incorrect because increasing the query timeout only allows a slow query to run longer; it does not make the query faster. Option E is incorrect because using SELECT * retrieves all columns, which increases the data scanned and worsens performance, especially with columnar formats.

Answer

Enable encryption at rest.

Answer

Increase the Athena query timeout.

Answer

Use SELECT * to retrieve all columns.

Question 11

A company uses AWS Glue to process data from Amazon S3. The data contains personally identifiable information (PII). The data engineer needs to automatically detect and mask PII fields before the data is loaded into Amazon Redshift. Which combination of AWS services should be used?

Accepted Answer

Amazon Macie and AWS Glue. Amazon Macie uses machine learning to automatically discover and classify PII in S3 data, and AWS Glue can then apply transforms (e.g., via a Glue ETL job or Glue Studio) to mask or redact those fields before loading into Redshift. Macie identifies sensitive data locations, and Glue performs the masking during the ETL pipeline, satisfying the requirement to detect and mask PII automatically.

Answer

Amazon CloudWatch Logs and AWS Lambda

Answer

Amazon S3 Object Lambda and AWS Glue

Answer

AWS IAM Access Analyzer and AWS Glue

Question 12

A company uses S3 to store sensitive data. Which TWO S3 features can be used to protect data at rest?

Accepted Answer

Server-Side Encryption with S3 Managed Keys (SSE-S3). SSE-S3 (option B) is correct because it encrypts objects at rest using AES-256 with keys fully managed by Amazon S3, directly protecting stored data without any customer key management. SSE-KMS (option C) is also correct because it encrypts objects at rest using AWS KMS customer master keys, adding key control, audit trails via CloudTrail, and separation of duties. S3 Versioning (A) only keeps multiple variants of an object to aid recovery; it does not encrypt data. S3 Transfer Acceleration (D) speeds up uploads/downloads over AWS edge locations and is a transfer optimization, not encryption at rest. S3 Object Lock (E) enforces WORM retention to prevent deletion or modification, which is immutability, not encryption.

Answer

S3 Versioning

Answer

S3 Transfer Acceleration

Answer

S3 Object Lock

Question 13

A data engineer is designing a streaming pipeline using Amazon Kinesis Data Streams with a shard count of 10. The incoming data rate is 1 MB/second. The consuming application uses the Kinesis Client Library (KCL) with a single worker. What is the most likely performance bottleneck?

Accepted Answer

The single KCL worker cannot process all shards in parallel. The Kinesis Client Library (KCL) uses a 1:1 mapping between shards and record processors by default. With 10 shards and only a single KCL worker, that worker must run all 10 record processors sequentially on a single host, creating a bottleneck. The worker cannot process records from multiple shards in parallel, so the throughput is limited by the single worker's processing capacity, not the stream's write capacity.

Answer

The Lambda function invoked by the stream has a cold start issue

Answer

The data stream has insufficient write capacity

Answer

The shard count is too low to handle the data rate

Question 14

A company uses Amazon Athena to query data in S3. Recently, queries have become slow. The data is stored as CSV files in a partitioned table. What is the most effective way to improve query performance?

Accepted Answer

Convert the data to Parquet format and optimize partitioning.. The correct answer. Parquet is a columnar storage format that allows Athena to read only the columns needed for a query, reducing I/O and improving performance. Combined with effective partitioning, it enables partition pruning, which further limits the data scanned. CSV files are row-based and require full scans, even with partitioning. Option A is incorrect because Athena is serverless and users cannot increase nodes; resources are managed automatically. Option C is incorrect: JSON is also row-based and verbose, making it even slower than CSV. Option D is incorrect because larger CSV files still lead to full scans; Parquet's columnar nature is more impactful than file size.

Answer

Increase the number of nodes in the Athena query engine.

Answer

Convert the data to JSON format.

Answer

Increase the size of the CSV files to reduce the number of files.

Question 15

A data engineer is monitoring an AWS Glue ETL job that processes data from an S3 bucket and writes to a Redshift table. The job completes successfully but takes longer than expected. The engineer notices that the job uses 10 DPUs and the data size is 500 GB. The job runs in standard mode. Which change would MOST reduce job duration?

Accepted Answer

Increase the number of DPUs to 20.. Increasing the number of DPUs from 10 to 20 allows the job to process data in parallel, reducing execution time. AWS Glue standard mode scales linearly with DPUs for ETL jobs that are not I/O bound. In this case, with 500 GB of data and 10 DPUs, the job is likely CPU-bound and can benefit from additional parallelism. Option B is incorrect because using a smaller worker type (G.1X) reduces available memory and CPU, worsening performance. Option C is incorrect because changing the output from Parquet (columnar, compressed) to CSV (row-based, uncompressed) increases data size and I/O, slowing the job. Option D is incorrect because reducing partitions can cause data skew and reduce parallelism, increasing runtime.

Answer

Use a smaller worker type like G.1X.

Answer

Change the output format from Parquet to CSV.

Answer

Reduce the number of partitions in the data.