DEA-C01 Practice Test 17 — 15 Questions

Question 1

A company stores sensitive data in an S3 bucket. To meet compliance requirements, they must ensure that all objects are encrypted at rest using server-side encryption with AWS KMS. Which bucket policy statement should be applied to deny uploads that do not use the required encryption?

Accepted Answer

{"Effect":"Deny","Principal":"*","Action":"s3:PutObject","Resource":"arn:aws:s3:::bucketname/*","Condition":{"StringNotEquals":{"s3:x-amz-server-side-encryption":"aws:kms"}}}. Option D is correct because the condition 's3:x-amz-server-side-encryption': 'aws:kms' ensures that only objects encrypted with SSE-KMS are allowed. Option A uses SSE-S3, which is not KMS. Option B uses the wrong header. Option C uses SSE-C, which is not allowed. Option D correctly denies if the encryption is not 'aws:kms'.

Answer

{"Effect":"Deny","Principal":"*","Action":"s3:PutObject","Resource":"arn:aws:s3:::bucketname/*","Condition":{"StringNotEquals":{"s3:x-amz-server-side-encryption":"AES256"}}}

Answer

{"Effect":"Deny","Principal":"*","Action":"s3:PutObject","Resource":"arn:aws:s3:::bucketname/*","Condition":{"StringNotEquals":{"s3:x-amz-server-side-encryption-aws-kms-key-id":"arn:aws:kms:us-east-1:123456789012:key/abc123"}}}

Answer

{"Effect":"Deny","Principal":"*","Action":"s3:PutObject","Resource":"arn:aws:s3:::bucketname/*","Condition":{"Null":{"s3:x-amz-server-side-encryption":"true"}}}

Question 2

Which THREE of the following are best practices for managing data storage costs in Amazon S3? (Choose 3.)

Accepted Answer

Use S3 Lifecycle policies to transition objects to S3 Glacier Deep Archive after a specified period.. Option A is correct because lifecycle policies transition data to lower-cost storage classes. Option C is correct because S3 Intelligent-Tiering automatically optimizes costs for unknown access patterns. Option E is correct because S3 Object Lock prevents accidental deletion but can be used with lifecycle policies to archive. Option B is wrong because S3 Standard costs more for infrequent access. Option D is wrong because it increases costs.

Answer

Store all data in S3 Standard for maximum durability.

Answer

Create multiple bucket replicas in different regions to ensure availability.

Question 3

A data engineer needs to store JSON documents that are frequently accessed by a low-latency web application. The data does not require complex queries, and the access pattern is primarily by a key. Which AWS service is most appropriate?

Accepted Answer

Amazon DynamoDB. Option A is correct because Amazon DynamoDB is a key-value and document database that offers low-latency access. Option B (RDS) is relational and not optimized for JSON. Option C (S3) has higher latency for frequent reads. Option D (ElastiCache) is a cache, not a primary store.

Answer

Amazon ElastiCache for Redis

Answer

Amazon S3

Answer

Amazon RDS for MySQL

Question 4

A data engineer is troubleshooting an Amazon DynamoDB table that has frequent throttling exceptions for write requests. The table has auto scaling enabled. What is the most likely cause?

Accepted Answer

The partition key is causing a hot partition. Hot partition is a common cause where a single partition key receives a disproportionate amount of writes, exhausting that partition's capacity. Auto scaling adjusts total capacity, not partition-level distribution.

Answer

The table's read capacity is set too low

Answer

The table's auto scaling is disabled

Answer

The table is using global tables without conflict resolution

Question 5

A company is migrating an on-premises Hadoop cluster to AWS. The cluster processes large files in CSV format using Apache Spark. Which data store should be used as the primary storage for the data lake to optimize cost and performance?

Accepted Answer

Amazon S3. Option C is correct because Amazon S3 is the best choice for data lake storage due to its durability, scalability, and cost-effectiveness. Option A is wrong because EBS is block storage for EC2 instances, not suitable for large-scale data lakes. Option B is wrong because EMRFS is a connector for S3, not a separate storage. Option D is wrong because RDS is relational and not designed for large file storage.

Answer

Amazon EMR File System (EMRFS) backed by HDFS

Answer

Amazon RDS for MySQL

Answer

Amazon EBS volumes attached to the EMR cluster

Question 6

A data engineer is designing a data lake on Amazon S3. The data is accessed frequently for the first 30 days, then rarely accessed after 90 days, and must be archived after 1 year. Which S3 lifecycle policy configuration meets these requirements with the lowest cost?

Accepted Answer

Transition to S3 Standard-IA after 30 days, then to S3 Glacier Deep Archive after 365 days.. Option B is correct because it transitions to S3 Standard-IA after 30 days (cost-effective for infrequent access) and to S3 Glacier Deep Archive after 365 days (lowest cost archival). Option A transitions to S3 One Zone-IA, which is not recommended for durability. Option C transitions to S3 Glacier Flexible Retrieval, which costs more than Deep Archive. Option D transitions to S3 Glacier Instant Retrieval, which is expensive for archival.

Answer

Transition to S3 One Zone-IA after 30 days, then to S3 Glacier Deep Archive after 365 days.

Answer

Transition to S3 Glacier Flexible Retrieval after 90 days.

Answer

Transition to S3 Glacier Instant Retrieval after 30 days, then expire after 365 days.

Question 7

Which TWO of the following are features of Amazon RDS Multi-AZ deployments? (Choose 2.)

Accepted Answer

Automatic failover to a standby instance in case of an AZ failure.. Option B is correct because Multi-AZ provides automatic failover. Option D is correct because the standby instance is in a different AZ. Option A is wrong because read replicas are separate from Multi-AZ. Option C is wrong because Multi-AZ does not support cross-region failover. Option E is wrong because Multi-AZ does not automatically scale storage.

Answer

Read replicas in the same region for offloading read traffic.

Answer

Automatic storage scaling based on usage.

Answer

Synchronous replication across AWS Regions.

Question 8

A company uses Amazon Redshift for data warehousing. The data team notices that queries are slow due to high disk usage on the cluster. They need to free up space without deleting any data. What should they do?

Accepted Answer

Run a deep copy to re-sort and reclaim space. Option B is correct because deep copy reorganizes data and reclaims disk space. Option A (VACUUM) reclaims space from deleted rows but does not reorganize. Option C (increasing node count) adds cost. Option D (changing sort keys) requires a table redesign.

Answer

Change the table's sort keys

Answer

Run VACUUM command

Answer

Add more nodes to the cluster

Question 9

A company stores sensitive data in Amazon S3. They need to ensure that all objects are encrypted at rest. Which approach meets this requirement with minimal effort?

Accepted Answer

Enable default encryption on the S3 bucket with SSE-S3. Enabling S3 default encryption (SSE-S3) ensures all new objects are encrypted automatically. Bucket policies can enforce encryption but require more effort.

Answer

Use client-side encryption before uploading

Answer

Enable S3 Versioning and MFA Delete

Answer

Use a bucket policy to deny PutObject without encryption

Question 10

The exhibit shows a build log from AWS CodeBuild. The build fails with a permission error when trying to open the downloaded file. What is the most likely cause?

Accepted Answer

The downloaded file has restrictive permissions that the python process cannot read.. The file is downloaded with root ownership and non-root user cannot read it. CodeBuild by default runs as root, but the process.py might be running as a non-root user. However, common cause is that the file was downloaded with restrictive permissions. But more plausible: the file download succeeded but the python script may be running as a different user, or the file permissions are wrong. In CodeBuild, the default user is root, but if the buildspec runs commands as different user, permissions may be an issue. However, a typical cause is that the file permissions are 600 owned by root, and the python process runs as a non-root user. Alternatively, the file might be corrupted. The most likely cause is that the file permissions do not allow read by the user running python. Given the context, option B is correct.

Answer

The S3 bucket policy denies access to the object.

Answer

The python script is not in the PATH.

Answer

The file is encrypted and cannot be decrypted.

Question 11

A company uses Amazon Redshift for its data warehouse. The data engineering team notices that queries against a large fact table are slow. The table is distributed using DISTSTYLE EVEN and has multiple sort keys. After analyzing the query plans, they find that most queries filter on a specific column, 'customer_id'. Which change would most likely improve query performance for these filter operations?

Accepted Answer

Change to DISTSTYLE KEY on the 'customer_id' column.. Option C is correct because using DISTSTYLE KEY on 'customer_id' collocates rows with the same customer_id on the same slice, reducing data shuffling for queries filtering on that column. Option A (EVEN distribution) does not help with filtering. Option B (ALL distribution) is for small dimension tables. Option D (compound sort key with other columns) may not help if the filter is only on 'customer_id'.

Answer

Add a secondary sort key on 'customer_id'.

Answer

Change to DISTSTYLE EVEN with a different sort key.

Answer

Change to DISTSTYLE ALL for the fact table.

Question 12

An IAM policy is attached to a role assumed by authenticated users via Amazon Cognito. What does this policy allow?

Accepted Answer

Users can read items in the Orders table only if the partition key matches their Cognito identity ID.. Option A is correct because the policy uses 'dynamodb:LeadingKeys' condition to restrict access to items where the partition key equals the Cognito identity ID (sub). This provides fine-grained access control. Option B is wrong because it allows only GetItem and Query, not Scan. Option C is wrong because it restricts to a specific table. Option D is wrong because it does not allow writes.

Answer

Users can read and write items in the Orders table where the partition key matches their Cognito identity ID.

Answer

Users can read any item in the Orders table using GetItem and Query.

Answer

Users can scan the entire Orders table but only if they use a filter expression.

Question 13

A financial services company stores sensitive transaction data in an Amazon S3 bucket. Compliance requires that all objects be encrypted using SSE-KMS and that the bucket be protected from accidental deletion. Which combination of actions meets these requirements? (Select TWO.)

Accepted Answer

Add a bucket policy that denies PutObject if the object is not encrypted with SSE-KMS. Options A and C are correct because enabling versioning protects against accidental deletion and a bucket policy denying unencrypted uploads enforces SSE-KMS. Option B (default encryption) does not enforce encryption on existing objects. Option D (MFA delete) is an additional protection but not required by the scenario. Option E (block public access) addresses public access, not deletion.

Answer

Enable MFA Delete on the bucket

Answer

Enable S3 Block Public Access

Answer

Set default encryption to SSE-S3

Question 14

A data engineer is designing a data lake on Amazon S3. Which feature should be used to manage the lifecycle of objects and move them to cheaper storage classes automatically?

Accepted Answer

S3 Lifecycle policies. S3 Lifecycle policies automate transitioning objects between storage classes and can also expire objects. S3 Inventory is for reporting, S3 Analytics for analysis, and Object Lock for compliance.

Answer

S3 Object Lock

Answer

S3 Storage Class Analysis

Answer

S3 Inventory

Question 15

A company is running a production database on Amazon RDS for PostgreSQL. The database experiences high read traffic from multiple application servers. Which data store management strategy would reduce the load on the primary database instance?

Accepted Answer

Create an RDS Read Replica in the same region.. Option B is correct because using RDS Read Replicas offloads read queries from the primary instance. Option A is incorrect because Multi-AZ is for high availability, not read scaling. Option C is incorrect because ElastiCache is a caching layer, not a replica. Option D is incorrect because DynamoDB Accelerator is for DynamoDB, not RDS.

Answer

Enable DynamoDB Accelerator (DAX) for the database.

Answer

Enable Multi-AZ deployment for automatic failover.

Answer

Use Amazon ElastiCache to cache query results.