DEA-C01 Practice Test 19 — 15 Questions

Question 1

A data engineer needs to audit data access events in Amazon S3. Which AWS service should be used to record and monitor API calls for S3 buckets?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records API activity across AWS services, including S3 data-plane and management-plane events, capturing who made each request, from where, and when. For auditing data access to S3 buckets, CloudTrail (with S3 data events enabled) is the authoritative service. It integrates with CloudWatch Logs and S3 for long-term retention and analysis.

Answer

AWS Config

Answer

Amazon Macie

Answer

Amazon GuardDuty

Question 2

A data engineer needs to set up a disaster recovery solution for an Amazon RDS for MySQL database. The database must be available in another AWS Region with minimal data loss. What is the simplest approach?

Accepted Answer

Create a cross-Region read replica of the database.. A cross-Region read replica of an RDS for MySQL database asynchronously replicates data to another AWS Region, providing a warm standby with minimal data loss (typically seconds of lag) and the ability to promote the replica during a regional failure. It is the simplest native RDS feature for cross-Region DR without building custom replication pipelines.

Answer

Enable Multi-AZ deployment in the same Region.

Answer

Set up AWS Database Migration Service (DMS) for continuous replication.

Answer

Take a manual snapshot and copy it to the other Region daily.

Question 3

A data engineer is using Amazon Athena to query data stored in an S3 bucket. The queries are running slowly. Which THREE actions can improve query performance?

Accepted Answer

Partition the data on commonly filtered columns.. Partitioning data on commonly filtered columns (Option A) improves Athena query performance by reducing the amount of data scanned. Athena uses Hive-style partitioning (e.g., `s3://bucket/table/year=2023/month=01/`), and when a query includes a filter on the partition column, Athena prunes partitions and only reads the relevant S3 prefixes. This directly reduces I/O and query cost, as Athena charges per TB of data scanned.

Answer

Convert the data to JSON format for better schema evolution.

Answer

Move the data to S3 Standard-IA storage class.

Question 4

A company's Amazon Redshift cluster is running slowly. The data engineer suspects that table design is the cause. Which TWO design practices can improve query performance? (Choose TWO.)

Accepted Answer

Define appropriate sort keys on frequently filtered columns.. Option A is correct because defining an appropriate sort key on columns that are frequently used in WHERE filters (especially range and equality predicates) lets Redshift use zone maps to skip scanning irrelevant blocks, dramatically reducing I/O and improving query performance. Option C is correct because choosing an appropriate distribution key (for example, DISTRIBUTING BY the join column) collocates matching rows on the same slice, enabling collocated joins that avoid expensive data redistribution (broadcast or shuffle) across nodes during query execution. Option B is not a table design practice and, while DISTINCT and GROUP BY can differ in execution, it does not address the suspected table-design cause. Option D is incorrect because the number of slices per node is determined by the node type and cannot be changed by resizing; resizing changes node count or type, not slices per node. Option E is incorrect because CHAR and VARCHAR have essentially equivalent performance in Redshift, and CHAR is not a cause of the reported slowness.

Answer

Use GROUP BY instead of DISTINCT in queries.

Answer

Increase the number of slices per node by resizing the cluster.

Answer

Use VARCHAR instead of CHAR for fixed-length strings.

Question 5

A company wants to enforce that all data written to an S3 bucket is encrypted with a customer-managed AWS KMS key. The data engineer has created the KMS key and attached an S3 bucket policy. However, users are still able to upload objects without specifying the KMS key. What is the most likely cause?

Accepted Answer

The S3 bucket policy does not include a condition that denies s3:PutObject without the correct encryption. The most likely cause is that the S3 bucket policy does not include a condition that denies s3:PutObject requests unless the correct encryption (e.g., aws:kms with the specific key) is specified. Without an explicit deny condition, users can still upload objects using the default encryption or no encryption if their IAM permissions allow it. The bucket policy must enforce the encryption requirement by denying non-compliant uploads.

Answer

The S3 bucket has default encryption enabled with SSE-S3

Answer

The KMS key policy does not grant the users kms:Encrypt permission

Answer

The IAM role for the users does not have s3:PutObject permission

Question 6

A data engineer needs to migrate an on-premises PostgreSQL database to Amazon RDS for PostgreSQL. The database is 2 TB and has a continuous stream of write operations. The migration should minimize downtime. Which AWS service should be used?

Accepted Answer

AWS Database Migration Service (DMS). AWS Database Migration Service (DMS) is the correct choice because it supports ongoing replication (change data capture) from an on-premises PostgreSQL source to Amazon RDS for PostgreSQL, enabling a near-zero downtime migration. DMS can handle the 2 TB dataset and continuous write stream by performing a full load followed by continuous replication of changes until the cutover. Other services lack the ability to perform live, transactional replication with minimal interruption.

Answer

AWS DataSync

Answer

AWS Snowball Edge

Answer

AWS Glue

Question 7

A data engineer needs to restrict access to an S3 bucket so that only users from a specific AWS account can read objects. Which S3 bucket policy element should be used?

Accepted Answer

Principal. The Principal element in an S3 bucket policy specifies the AWS account, user, or role that the policy applies to. By setting the Principal to a specific AWS account ID, only users from that account can read objects. Option A is wrong because the Action element specifies the allowed or denied operations (e.g., s3:GetObject), not the account. Option C is wrong because the Resource element identifies the bucket or objects, not the requester. Option D is wrong because the Condition element adds additional constraints (e.g., IP address), but it is not the primary element for specifying the allowed account; Principal is the correct element for that purpose.

Answer

Action

Answer

Resource

Answer

Condition

Question 8

A team uses Amazon Kinesis Data Analytics to process streaming data. They notice that the application's output is delayed. Which AWS service can be used to monitor the application's performance and identify bottlenecks?

Accepted Answer

Amazon CloudWatch. Amazon CloudWatch is the native monitoring service for AWS resources and applications, and Kinesis Data Analytics (now Amazon Managed Service for Apache Flink) publishes metrics such as millisBehindLatest, KPU utilization, and input/output throughput directly to CloudWatch. These metrics let the team pinpoint whether the delay stems from input backlog, insufficient KPUs, or downstream sink throttling. CloudWatch alarms and dashboards then provide the operational visibility needed to remediate the bottleneck.

Answer

AWS CloudTrail

Answer

Amazon Athena

Answer

AWS X-Ray

Question 9

A company uses AWS Lake Formation to manage access to data in a data lake. A new data engineer has been granted SELECT permission on a table but receives an 'AccessDeniedException' when querying via Amazon Athena. The table is registered in Lake Formation and the data is encrypted with SSE-KMS. Which of the following is the MOST likely cause?

Accepted Answer

The IAM role used by Athena does not have kms:Decrypt permission on the KMS key.. The IAM role used by Athena does not have kms:Decrypt permission on the KMS key. When data is encrypted with SSE-KMS, Athena's IAM role requires kms:Decrypt to read the data from S3. Even if Lake Formation grants SELECT permission, the query fails without KMS access. Option A is incorrect because Lake Formation does not use resource-based policies on tables; it uses LF-Tags or resource links to grant permissions. Option B is incorrect because while an S3 bucket policy could block access, the most likely issue with encrypted data is missing KMS permissions. Option C is incorrect because the Glue Data Catalog does not enforce data access; Lake Formation is the service that manages fine-grained access.

Answer

The table's resource-based policy does not include the engineer's IAM role.

Answer

The S3 bucket policy denies access to the engineer's IAM role.

Answer

The AWS Glue Data Catalog has not been granted permission to the engineer's role.

Question 10

A company uses Amazon S3 to store log files from multiple applications. The logs are written in JSON format. A data engineer wants to use Amazon Athena to query these logs. The logs are stored in a bucket with the following structure: 's3://logs/app1/date=2021-01-01/'. The engineer creates an Athena table with partitions. However, when querying, Athena returns zero results for partitions that exist. The engineer has run MSCK REPAIR TABLE to add partitions. What is the most likely cause of the issue?

Accepted Answer

The partition key name in the table definition does not match the S3 folder naming convention.. The most likely cause is that the partition key name in the Athena table definition does not match the S3 folder naming convention. When using MSCK REPAIR TABLE, Athena relies on the partition folder structure (e.g., 'date=2021-01-01') to automatically add partitions. If the table's partition key is named differently (e.g., 'dt' instead of 'date'), MSCK REPAIR will not recognize the folders and will not register the partitions, resulting in zero results. Option A is incorrect because MSCK REPAIR does not fail silently; it either adds partitions or reports none if the structure doesn't match. Option C is incorrect because Athena fully supports JSON format. Option D is incorrect because the bucket location does not affect partition registration; data can be queried in any bucket as long as the table points to it.

Answer

The MSCK REPAIR TABLE command failed silently.

Answer

The log files are in JSON format and Athena does not support JSON.

Answer

The log files need to be copied to a different bucket in the same region.

Question 11

A data engineer needs to grant an IAM user read-only access to an S3 bucket named 'data-lake'. Which IAM policy statement should be used?

Accepted Answer

{"Effect":"Allow","Action":["s3:ListBucket","s3:GetObject"],"Resource":["arn:aws:s3:::data-lake","arn:aws:s3:::data-lake/*"]}. It allows ListBucket on the bucket and GetObject on objects, enabling read-only access. Option A is wrong because it grants write actions (PutObject, DeleteObject). Option B is wrong because it allows all S3 actions (s3:*). Option D is wrong because it only allows ListBucket, not GetObject.

Answer

{"Effect":"Allow","Action":["s3:PutObject","s3:DeleteObject"],"Resource":"arn:aws:s3:::data-lake/*"}

Answer

{"Effect":"Allow","Action":"s3:*","Resource":"*"}

Answer

{"Effect":"Allow","Action":"s3:ListBucket","Resource":"arn:aws:s3:::data-lake"}

Question 12

Which THREE actions can help improve read performance in Amazon DynamoDB? (Choose THREE.)

Accepted Answer

Use parallel scans to distribute read load across partitions.. Parallel scans in DynamoDB can improve read performance by dividing a scan operation into multiple segments that are processed concurrently across partitions. This reduces the overall latency of the scan by leveraging the distributed nature of DynamoDB's storage, though it consumes more read capacity units (RCUs) due to the parallel execution.

Answer

Use DynamoDB global tables to replicate data.

Answer

Use strongly consistent reads for all queries.

Question 13

A data engineer is designing a data ingestion pipeline to load clickstream data from an Amazon S3 bucket into an Amazon Redshift cluster. The data arrives in 5-minute batches. Which TWO actions should the engineer take to ensure data consistency and avoid duplicates? (Select TWO.)

Accepted Answer

Use the STL_LOAD_ERRORS system table to monitor and resolve load errors.. Option E is correct because loading each 5-minute batch into a staging table and then running a MERGE (or DELETE+INSERT) against the target table lets you match on a business key and update or insert rows idempotently, which prevents duplicate records when batches are retried or overlap. Option C is correct because monitoring STL_LOAD_ERRORS (and STL_LOAD_ERRORS is populated per load with err_code, err_reason, and raw_field_value) lets the engineer detect and resolve failed or partially loaded rows so the pipeline maintains consistent data. Option A is not correct because a SORTKEY only affects physical ordering and query performance; it does not deduplicate rows. Option B is not correct because disabling WLM removes query queue management and does not address duplicates or consistency. Option D is not correct because Redshift distributes data across slices automatically, and forcing data into a single slice would hurt performance without providing deduplication.

Answer

Define a SORTKEY on the target table to improve deduplication.

Answer

Disable workload management (WLM) to maximize resources.

Answer

Load data into a single slice to maintain order.

Question 14

A data engineer is designing a disaster recovery strategy for an Amazon RDS for PostgreSQL database. The primary database is in us-east-1. Which TWO approaches provide cross-region disaster recovery?

Accepted Answer

Configure cross-region automated backups to copy to us-west-2.. Amazon RDS supports cross-region automated backups, which automatically copy backup data (snapshots and transaction logs) from the primary region (us-east-1) to a secondary region (us-west-2). This provides a fully managed, automated disaster recovery solution that allows point-in-time recovery in the secondary region without manual intervention.

Answer

Take a manual snapshot and copy it to us-west-2 daily.

Answer

Use Amazon S3 cross-region replication for the database export.

Answer

Enable Multi-AZ in us-east-1.

Question 15

A company uses AWS Glue to process sensitive customer data stored in S3. The security team requires that all data be encrypted at rest using a customer-managed KMS key and that access to the key be auditable. Which solution meets these requirements?

Accepted Answer

Configure the S3 bucket to use SSE-KMS with a customer-managed KMS key and enable CloudTrail for KMS events.. SSE-KMS with a customer-managed KMS key provides encryption at rest and, when combined with CloudTrail logging for KMS events, offers full auditability of key usage. Option A (client-side encryption) does not encrypt data at rest within S3; it encrypts before upload. Option C (SSE-S3) uses AWS-managed keys, which do not allow customer audit of key access. Option D (SSE-C) relies on customer-provided keys that are not managed by KMS and cannot be audited via CloudTrail.

Answer

Encrypt the data client-side before uploading to S3.

Answer

Enable default SSE-S3 encryption on the S3 bucket.

Answer

Use SSE-C with a customer-provided key.