DEA-C01 Practice Test 18 — 15 Questions

Question 1

A company runs an Apache Spark job on Amazon EMR that writes output to an S3 bucket. The job fails with the error 'S3AccessDeniedException' when writing the final output, but earlier stages succeed. The EMR cluster uses a service role and an instance profile. The S3 bucket policy allows access from the VPC only. What is the MOST likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The EMR cluster is not using a VPC endpoint for S3, so requests are denied by the bucket policy's VPC condition.. The bucket policy restricts access to requests originating from the VPC, typically using a condition like `aws:SourceVpc`. If the EMR cluster does not use a VPC endpoint for S3 (either Gateway or Interface endpoint), traffic from the cluster to S3 traverses the public internet and does not match the VPC condition, causing the `S3AccessDeniedException`. Earlier stages may succeed if they use cached data or different paths, but the final write fails because it hits the bucket policy check.

Answer

The S3 bucket uses SSE-C encryption, and the EMR cluster does not have the encryption key.

Answer

The EMR service role does not have permissions to write to the S3 bucket.

Answer

The S3 bucket is configured with 'Bucket owner enforced' setting for ACLs, and the EMR cluster's account is not the bucket owner.

Question 2

A data pipeline ingests streaming data from thousands of IoT devices into Kinesis Data Streams. The data must be transformed using a simple field mapping before being stored in S3. Which service should be used to perform the transformation with minimal operational overhead?

Accepted Answer

Kinesis Data Firehose with a Lambda transformation. Kinesis Data Firehose can invoke a Lambda function to perform simple field mapping transformations before delivering data to S3, minimizing operational overhead. Option A is wrong because AWS Lambda invoked directly by the Kinesis stream requires custom logic for S3 delivery and stream management, increasing overhead. Option B is wrong because AWS Glue ETL jobs are designed for batch processing and are more complex to set up for streaming transformations. Option C is wrong because Kinesis Data Analytics is used for real-time analytics with SQL or Flink, not simple field mapping transformations.

Answer

AWS Lambda function invoked by the Kinesis stream

Answer

AWS Glue ETL job

Answer

Kinesis Data Analytics

Question 3

A data engineer is troubleshooting an AWS Glue ETL job that fails with an access denied error when writing to an S3 bucket. The Glue job uses an IAM role that has an S3 bucket policy attached. The bucket policy denies access to any principal that does not use server-side encryption. What is the most likely cause of the failure?

Accepted Answer

The Glue job is not using server-side encryption when writing to S3.. If the Glue job does not set the encryption header (or the role does not have the kms:GenerateDataKey permission for SSE-KMS), the bucket policy will deny the request. Option A is wrong because Glue requires permissions on the S3 bucket and KMS key. Option B is wrong because VPC endpoints do not cause access denied errors for encryption. Option D is wrong because S3 Block Public Access does not deny write access to authorized roles.

Answer

The VPC endpoint policy for S3 is too restrictive.

Answer

The IAM role does not have s3:PutObject permission.

Answer

The S3 bucket uses S3 Block Public Access which denies all writes.

Question 4

A company is migrating an on-premises Hadoop cluster to AWS. The cluster processes large files in CSV format using Apache Spark. Which data store should be used as the primary storage for the data lake to optimize cost and performance?

Accepted Answer

Amazon S3. Amazon S3 is the optimal primary storage for a data lake on AWS because it offers high durability, scalability, and cost-effectiveness. It integrates seamlessly with Apache Spark on Amazon EMR, allowing direct access to data without moving it. S3 also supports various file formats and decouples storage from compute, enabling independent scaling.

Answer

Amazon EMR File System (EMRFS) backed by HDFS

Answer

Amazon RDS for MySQL

Answer

Amazon EBS volumes attached to the EMR cluster

Question 5

A company is using an Amazon RDS for PostgreSQL database to store personally identifiable information (PII). The security team wants to ensure that database administrators cannot view the plaintext PII data. Which solution should a data engineer implement?

Accepted Answer

Use client-side encryption with AWS KMS to encrypt PII before inserting into the database. Using AWS KMS with client-side encryption ensures that data is encrypted before being sent to RDS, so database administrators cannot read the plaintext. Dynamic data masking in RDS is not natively supported; application-level masking would be needed. RDS encryption at rest protects data on disk but DBAs with access can still query plaintext. Using IAM policies to restrict access does not prevent DBAs with database credentials from viewing data.

Answer

Use IAM policies to restrict DBA access to the RDS instance

Answer

Enable Dynamic Data Masking in RDS to obfuscate PII for all users

Answer

Enable encryption at rest for the RDS instance using AWS KMS

Question 6

A data engineer is troubleshooting an AWS Glue ETL job that fails intermittently with the error 'Rate exceeded.' The job reads from an Amazon RDS for MySQL source and writes to Amazon S3. What is the MOST likely cause of this error?

Accepted Answer

The number of Glue job workers or parallel queries is exceeding the maximum connections or IOPS of the RDS instance.. The 'Rate exceeded' error in AWS Glue typically occurs when the job opens too many concurrent connections to the source database. With RDS for MySQL, each Glue worker or parallel read task establishes a connection, and exceeding the instance's max_connections or IOPS limits triggers throttling. This is the most likely cause when reading from RDS and writing to S3.

Answer

The Glue job is using Amazon Kinesis Data Streams as a source, which has a shard throughput limit.

Answer

The Amazon S3 bucket has a bucket policy that limits the number of objects written per second.

Answer

The IAM role attached to the Glue job does not have sufficient permissions to read from RDS.

Question 7

A data engineer is troubleshooting a Lambda function that reads from a Kinesis Data Stream, processes records, and writes to a Kinesis Data Firehose delivery stream. The Firehose delivery stream is configured to deliver data to an S3 bucket. The Lambda function is failing with an access denied error. The IAM policy attached to the Lambda execution role is shown in the exhibit. Which permission is missing?

Accepted Answer

firehose:PutRecord on the Firehose delivery stream. The Lambda function is failing due to a missing permission to write to the Kinesis Data Firehose delivery stream. The required permission is firehose:PutRecord (or firehose:PutRecordBatch). The IAM policy likely lacks this permission, causing an access denied error when the Lambda attempts to write records. Option A correctly identifies this missing permission.

Answer

firehose:DescribeDeliveryStream on the Firehose delivery stream

Answer

logs:CreateLogGroup and logs:CreateLogStream on the CloudWatch log group

Answer

s3:PutObjectAcl on the S3 bucket

Question 8

A data engineer needs to share a dataset stored in Amazon S3 with another AWS account. The bucket policy currently grants access only to the owning account. What is the simplest way to grant cross-account access?

Accepted Answer

Add a bucket policy that grants access to the other account's IAM role. A bucket policy is the simplest and most direct way to grant cross-account access because it is a resource-based policy attached to the S3 bucket that can explicitly name the other account's IAM role or account ID as a principal. This avoids the need to create roles or modify ACLs, and it works even when ACLs are disabled (the default for new buckets).

Answer

Set the object ACL to public-read

Answer

Use an S3 access control list (ACL) to grant access to the other account

Answer

Create an IAM role in the other account and attach a policy to it

Question 9

A data engineer needs to audit all changes to IAM policies in an AWS account. Which AWS service should be used?

Accepted Answer

AWS CloudTrail. WS CloudTrail because it records API calls made in the account, including changes to IAM policies. AWS Config tracks resource configuration changes, not API calls. AWS Organizations is for multi-account management. Amazon CloudWatch Logs is for log storage and monitoring, not auditing API calls.

Answer

AWS Config

Answer

AWS Organizations

Answer

Amazon CloudWatch Logs

Question 10

Match each AWS service to its primary purpose in data engineering.

Accepted Answer

Amazon S3: Object storage for data lakes. The correct matches are: Amazon S3 → object storage for data lakes (A), AWS Glue → serverless ETL (B), Amazon Athena → interactive SQL queries on S3 (C), and Amazon Redshift → data warehousing (D). Common confusions involve mixing up services like Kinesis (streaming) with Glue (ETL) or Data Pipeline (orchestration) with Kinesis (ingestion).

Answer

AWS Kinesis: Serverless ETL service

Answer

AWS Data Pipeline: Real-time data ingestion

Question 11

A data engineer needs to transform JSON data from Amazon S3 into Parquet format using AWS Glue. The source files are in a bucket with thousands of small files. What is the best practice to optimize the Glue job performance?

Accepted Answer

Enable 'Group small files' in the Glue job or use a DynamicFrame with coalesce.. Enabling 'Group small files' in AWS Glue automatically coalesces thousands of small input files into larger partitions, reducing the number of tasks and minimizing overhead from task scheduling and S3 list operations. This is the recommended best practice for handling small files in Glue ETL jobs, as it optimizes read performance without requiring manual coalesce or repartitioning.

Answer

Convert the JSON files to CSV before processing with Glue.

Answer

Use an AWS Lambda function to pre-process the files.

Answer

Increase the number of DPUs to the maximum.

Question 12

A data engineer needs to monitor the number of records processed by a Kinesis Data Firehose delivery stream and set an alarm if the count drops below a threshold. Which CloudWatch metric should be used?

Accepted Answer

IncomingRecords. IncomingRecords is the CloudWatch metric that specifically counts the number of records successfully ingested into a Kinesis Data Firehose delivery stream. It is emitted per delivery stream and directly reflects the volume of data being processed, making it the correct choice for monitoring record count and setting threshold alarms. Other metrics either measure API call success, delivery outcomes, or byte volume, not record count.

Answer

PutRecord.Success

Answer

DeliveryToS3.Success

Answer

IncomingBytes

Question 13

A data engineer is troubleshooting an ETL job that reads from an S3 bucket encrypted with SSE-KMS. The job is failing with an error indicating that the IAM role does not have permission to decrypt the data. What is the most likely missing permission?

Accepted Answer

kms:Decrypt. When an S3 object is encrypted with SSE-KMS, reading the object requires two sets of permissions: s3:GetObject on the object and kms:Decrypt on the KMS key used to encrypt it. The error explicitly states the IAM role lacks permission to decrypt, so the missing permission is kms:Decrypt. Without it, S3 cannot call KMS to decrypt the data key, and the GetObject call fails with AccessDenied.

Answer

kms:GenerateDataKey

Answer

s3:ListBucket

Answer

s3:GetObject

Question 14

A company is designing a data pipeline using Amazon Kinesis Data Streams. The data includes personally identifiable information (PII). The security team requires that data be encrypted at rest using a customer-managed KMS key. How should the data engineer configure the Kinesis stream?

Accepted Answer

Enable server-side encryption on the Kinesis stream and specify the customer-managed KMS key.. Amazon Kinesis Data Streams supports server-side encryption (SSE) with AWS KMS, and you can choose either an AWS-managed key (aws/kinesis) or a customer-managed KMS key. To meet the requirement of encryption at rest with a customer-managed key, you enable SSE on the stream and specify the customer-managed KMS key, which Kinesis uses to encrypt data as it is written to storage.

Answer

Configure the Kinesis stream to use AWS CloudHSM for encryption.

Answer

Store the encrypted data in S3 and use Kinesis to stream the S3 object keys.

Answer

Use client-side encryption in the producer application to encrypt data before sending to Kinesis.

Question 15

A data engineer needs to store JSON documents that are accessed by a key-value pattern. The workload requires single-digit millisecond latency at any scale. Which AWS service is most appropriate?

Accepted Answer

Amazon DynamoDB. Amazon DynamoDB is a fully managed NoSQL key-value and document database that delivers single-digit millisecond latency at any scale. It is optimized for key-value access patterns, making it the ideal choice for storing and retrieving JSON documents by a primary key with consistent low latency.

Answer

Amazon DocumentDB (with MongoDB compatibility)

Answer

Amazon RDS for PostgreSQL

Answer

Amazon Neptune