DEA-C01 Practice Test 17 — 15 Questions

Question 1

A data engineer runs the AWS CLI command to retrieve the lifecycle configuration of the 'my-data-lake' bucket. The output is shown in the exhibit. What is the effect of this lifecycle policy?

Accepted Answer

Objects in the 'logs/' prefix are moved to S3 Standard-IA after 30 days, to Glacier after 90 days, and deleted after 365 days.. The lifecycle policy explicitly applies to the 'logs/' prefix, transitioning objects to S3 Standard-IA after 30 days, then to Glacier after 90 days, and finally expiring (deleting) them after 365 days. The 'Expiration' action with 'Days: 365' permanently removes the objects, while the 'Transitions' define the storage class changes at the specified intervals.

Answer

Objects in the 'logs/' prefix are deleted after 365 days and their delete markers are removed.

Answer

All objects in the bucket are moved to STANDARD_IA after 30 days.

Answer

Objects in the 'logs/' prefix are moved to Glacier after 90 days and expired after 90 days.

Question 2

A data engineer needs to grant an IAM user access to query a specific table in Amazon Athena, but the user should not be able to view other tables in the same database. Which method should the engineer use?

Accepted Answer

Use AWS Lake Formation to grant SELECT permission on the specific table to the user. AWS Lake Formation provides fine-grained access control at the table and column level, so granting SELECT permission on the specific table to the IAM user restricts them to that table while denying access to others in the same database. This is the intended service for table-level Athena permissions. It integrates with the Glue Data Catalog to enforce permissions at query time.

Answer

Attach an IAM policy that allows athena:StartQueryExecution and restrict the query by table name

Answer

Apply an S3 bucket policy that restricts access to the table's underlying data

Answer

Create a separate Athena workgroup with a query limit that only allows queries on that table

Question 3

A company uses Amazon Kinesis Data Analytics for Apache Flink to process streaming data. The application reads from a Kinesis data stream, performs a 1-minute tumbling window aggregation, and writes results to an S3 bucket. Recently, the application started experiencing checkpoint failures and increasing processing delay. Which action should the engineer take FIRST to diagnose the issue?

Accepted Answer

Monitor CPU and memory utilization of the Flink application using Amazon CloudWatch metrics.. When a Flink application shows checkpoint failures and growing processing delay, the first diagnostic step is to check resource utilization via CloudWatch metrics (CPU, memory, heap, checkpoint duration). Checkpoint failures often stem from backpressure or resource exhaustion, so understanding whether the application is CPU- or memory-bound guides the next action. This is the least invasive, most informative first step.

Answer

Increase the parallelism of the Flink application.

Answer

Switch to the Kinesis Client Library (KCL) for checkpointing.

Answer

Increase the checkpoint interval to reduce checkpoint frequency.

Question 4

A data engineer needs to move data from an Amazon S3 bucket to an Amazon Redshift cluster on a daily schedule. The data is in CSV format and the target table already exists. Which AWS service should the engineer use to automate this task?

Accepted Answer

AWS Glue. AWS Glue is a fully managed extract, transform, and load (ETL) service that can schedule and run jobs to move data from S3 to Redshift. It provides built-in connectors for both S3 and Redshift, and you can define a crawler to infer the schema and a job to load the data into the existing Redshift table. Glue handles the scheduling, retries, and scaling, making it the ideal choice for this daily automated task.

Answer

Amazon Athena

Answer

Amazon EMR

Answer

Amazon Kinesis Data Analytics

Question 5

Which TWO actions should a data engineer take to protect sensitive data in an Amazon S3 bucket from being accessed by unauthorized users? (Select TWO.)

Accepted Answer

Add a bucket policy with a Deny effect for unauthorized principals. Option C is correct because an S3 bucket policy with an explicit Deny effect overrides any Allow in IAM or bucket policies, so it reliably blocks the specified unauthorized principals from accessing the sensitive objects. Option E is correct because S3 Block Public Access settings prevent public ACLs and public bucket policies from exposing the bucket, closing off the most common accidental data-exposure path. Options A, B, and D do not restrict access: a VPC endpoint only controls how traffic reaches S3 (not who is authorized), server access logging only records requests after they occur, and CloudTrail only provides audit logging of API activity rather than preventing unauthorized access.

Answer

Create a VPC endpoint for S3

Answer

Enable S3 server access logging

Answer

Enable AWS CloudTrail for the bucket

Question 6

Which TWO methods can be used to enforce least-privilege access to an Amazon S3 bucket? (Choose two.)

Accepted Answer

Use IAM policies to grant specific permissions to users and roles.. IAM policies allow you to grant granular, specific permissions to individual users and roles, adhering to the principle of least privilege by explicitly allowing only the actions required. This avoids granting broad or default permissions, ensuring that each identity has only the access necessary for its function.

Answer

Set bucket ACLs to allow full control to the bucket owner only.

Answer

Configure a VPC endpoint to restrict access to the bucket.

Answer

Generate pre-signed URLs for all access.

Question 7

Match each AWS storage class to its description.

Accepted Answer

S3 Standard: Designed for frequently accessed data with low latency and high throughput.. Correct matches: S3 Standard for frequently accessed data, S3 Intelligent-Tiering for automatic cost optimization, and S3 Glacier for archival. Common confusions involve mixing up Standard-IA and Glacier Deep Archive definitions.

Answer

S3 Standard-IA: Lowest-cost storage class for long-term retention with retrieval times of 12 hours.

Answer

S3 Glacier Deep Archive: For data accessed less frequently but requires rapid access when needed.

Question 8

Which TWO actions can help improve query performance in Amazon Redshift? (Choose two.)

Accepted Answer

Use appropriate sort keys for tables.. Defining appropriate sort keys in Amazon Redshift enables the query optimizer to use zone maps to skip irrelevant data blocks during table scans, significantly reducing the amount of data read from disk. Sort keys also improve the effectiveness of merge joins and the performance of range-restricted queries by physically co-locating rows with similar sort key values on disk.

Answer

Disable SSL encryption for connections.

Answer

Use VARCHAR instead of CHAR for fixed-length strings.

Answer

Increase the number of nodes in the cluster.

Question 9

A data engineer runs the describe-stream command and sees the output above. The stream has a retention period of 24 hours. The engineer needs to ensure that consumers can replay data for up to 7 days. Which action is required?

Accepted Answer

Use the IncreaseStreamRetentionPeriod API to set retention to 168 hours.. The describe-stream output shows a retention period of 24 hours, but the requirement is to allow consumers to replay data for up to 7 days (168 hours). Amazon Kinesis Data Streams supports modifying the retention period dynamically without recreating the stream, using the IncreaseStreamRetentionPeriod API or the update-shard-count command. Option C correctly uses this API to set retention to 168 hours, which is the maximum supported retention period for Kinesis Data Streams.

Answer

Increase the number of shards to allow more data storage.

Answer

Delete the stream and recreate it with a longer retention period.

Answer

Create new consumer applications that read from the stream.

Question 10

A company uses AWS Glue to catalog data in Amazon S3. The data includes personally identifiable information (PII). The security team requires that PII be masked when queried by users who are not data owners. Which AWS service should be used to enforce this requirement?

Accepted Answer

Use AWS Lake Formation to define column-level security and data masking.. AWS Lake Formation allows you to define column-level security and data masking policies on tables cataloged in the AWS Glue Data Catalog. You can grant or deny access to specific columns and apply masking to sensitive columns like PII for users who are not data owners, enforcing the requirement at query time. This is the native AWS service for fine-grained access control on data lakes.

Answer

Use Amazon Macie to automatically redact PII from S3 objects.

Answer

Use IAM policies with condition keys to restrict access based on tags.

Answer

Use Amazon S3 Object Lambda to transform data on the fly.

Question 11

A data engineer needs to share a dataset stored in an Amazon S3 bucket with another AWS account. The dataset must remain encrypted at rest using AWS KMS. The data engineer creates a bucket policy that grants the other account access to the bucket. However, the other account reports that objects appear encrypted and they cannot decrypt them. What is the most likely cause?

Accepted Answer

The KMS key policy does not grant the other account the kms:Decrypt permission. For cross-account access to KMS-encrypted S3 objects, both the S3 bucket policy and the KMS key policy must grant the necessary permissions. The bucket policy grants s3:GetObject, but decryption requires kms:Decrypt on the KMS key. If the key policy does not allow the other account, the objects cannot be decrypted, even with S3 access.

Answer

The bucket policy does not grant the s3:GetObject permission

Answer

The other account must use the same KMS key to upload objects

Answer

The objects are encrypted with SSE-S3, which is not supported for cross-account access

Question 12

A data engineer needs to ingest streaming data from a social media API into Amazon S3 for batch analytics. The data arrives at a rate of 500 records per second. Which service should be used to capture the stream?

Accepted Answer

Amazon Kinesis Data Streams. Amazon Kinesis Data Streams is designed for real-time streaming data ingestion at scale, supporting throughput of up to 1 MB/s or 1,000 records per second per shard. With 500 records per second, Kinesis can reliably capture and store the social media API data for up to 365 days, enabling batch analytics via S3 delivery through Kinesis Firehose or custom consumers.

Answer

Amazon Simple Notification Service (SNS)

Answer

Amazon Simple Queue Service (SQS)

Answer

Amazon MQ

Question 13

Which TWO AWS services can be used as sources for AWS Glue ETL jobs? (Choose two.)

Accepted Answer

Amazon S3. Amazon S3 is a fully managed object storage service that serves as a common source for AWS Glue ETL jobs. Glue can read data from S3 using its built-in crawlers and connectors, supporting formats like Parquet, JSON, CSV, and Avro. The Glue Data Catalog can reference S3 locations, and ETL scripts can directly read from S3 buckets via the s3:// protocol.

Answer

Amazon Route 53

Answer

Amazon CloudFront

Answer

Amazon API Gateway

Question 14

A company uses Amazon S3 to store historical stock market data as CSV files. They run daily Amazon Athena queries to generate reports. Recently, the finance team reported that queries are timing out and costs have increased significantly. The data engineering team notices that the S3 bucket contains thousands of small files (average 100 KB) due to a misconfigured ingestion pipeline. They need to improve query performance and reduce costs without changing the existing reporting schedule. The team has access to AWS Glue and can create new tables. Which solution should they implement?

Accepted Answer

Use AWS Glue ETL to read the CSV files, convert them to Parquet, and write them back to S3 in fewer, larger files.. Converting the thousands of small CSV files into fewer, larger Parquet files using AWS Glue ETL directly addresses the root cause of poor Athena performance and high costs. Parquet is a columnar format that reduces the amount of data scanned per query, and larger files minimize the overhead of S3 LIST and GET operations, improving throughput. This solution does not change the reporting schedule and leverages existing Glue capabilities to create new optimized tables.

Answer

Partition the data by date and create a new Athena table with partitions.

Answer

Use S3 Select to filter rows within each file before Athena processes them.

Answer

Increase the Athena query timeout to 30 minutes.

Question 15

A company is using Amazon Redshift for data warehousing. They need to ensure that data is encrypted at rest and in transit. Which TWO configurations are required to meet these requirements?

Accepted Answer

Enable encryption on the Redshift cluster using AWS KMS.. Option A is correct because enabling encryption on the Redshift cluster using AWS KMS provides encryption at rest — Redshift uses KMS customer master keys to encrypt the cluster's data blocks and system metadata on disk. Option B is correct because configuring the Redshift cluster to require SSL connections (via the require_ssl parameter set to true in the cluster's parameter group) enforces encryption in transit for all client and JDBC/ODBC connections to the cluster. Option C is not required because Redshift's at-rest encryption is natively managed through AWS KMS, not CloudHSM, and CloudHSM is not a prerequisite for meeting these requirements. Option D is incorrect because VPC Flow Logs capture IP traffic metadata for network monitoring and do not encrypt data at rest or in transit. Option E is incorrect because Redshift manages its own storage encryption at the cluster level; enabling EBS encryption on cluster nodes is neither a supported nor a required configuration for Redshift data encryption.

Answer

Use AWS CloudHSM to manage encryption keys for Redshift.

Answer

Enable VPC Flow Logs on the Redshift subnet.

Answer

Enable EBS encryption on the Redshift cluster nodes.