DEA-C01 Practice Test 20 — 15 Questions

Question 1

A company has a data lake in Amazon S3 with millions of objects. The security team wants to enforce that all objects are encrypted with a specific customer-managed KMS key. The data engineer configures an S3 bucket policy to deny PutObject if the encryption is not set to that key. However, some existing objects are not encrypted with that key. What is the most efficient way to remediate the existing objects?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use S3 Batch Operations to copy objects in the same bucket with the new encryption settings.. S3 Batch Operations is designed to perform bulk actions (like copying objects) across millions of objects efficiently, and it supports specifying new encryption settings during the copy. By copying objects in the same bucket with the desired KMS key, the existing objects are re-encrypted with the customer-managed key, satisfying the bucket policy requirement. This is the most efficient, server-side, managed approach for large-scale remediation.

Answer

Use S3 Cross-Region Replication to replicate objects to a new bucket with the correct encryption.

Answer

Write a script using the AWS SDK to iterate over all objects and re-upload them with the correct encryption.

Answer

Use S3 Object Lambda to dynamically encrypt objects on read.

Question 2

A company runs a nightly batch ETL job using AWS Glue to transform data from Amazon RDS for MySQL to Amazon S3. The job reads 100 tables and writes Parquet files partitioned by date. Recently, the job started failing with 'ThrottlingException' from the RDS database. The data volume has increased, and the Glue job is reading large tables without any filtering. The job uses a single Glue job with multiple Spark executors. The engineer needs to reduce the load on the RDS database while maintaining the same processing time. What should the engineer do?

Accepted Answer

Modify the Glue job to use a JDBC connection with a WHERE clause to read only the latest partition.. The ThrottlingException originates from RDS because the Glue job issues full-table JDBC reads across 100 tables with no predicate pushdown. Adding a WHERE clause to read only the latest partition (D) reduces the number of rows scanned and transferred per run, directly lowering the query load on RDS while keeping the same nightly processing window. This is the least disruptive change that preserves the existing architecture and processing time.

Answer

Use AWS DMS to continuously replicate data to S3 and then run Glue on the S3 data.

Answer

Change the job to read all data from RDS into a staging table in S3 first, then transform.

Answer

Increase the number of DPUs to process data faster.

Question 3

A company runs a data ingestion pipeline that uses AWS Glue to read 500 GB of JSON files from an S3 bucket (s3://raw-data/) every hour. The Glue ETL job transforms the data and writes Parquet files to another S3 bucket (s3://processed-data/). The job is triggered by a time-based CloudWatch Events rule. Recently, the job has started taking over 2 hours to complete, causing delays in downstream processes. The data volume has been consistent, and no changes have been made to the job code or infrastructure. The S3 bucket 's3://raw-data/' receives new files continuously, but the Glue job reads all files in the bucket each run (no incremental processing). The engineer suspects that the job is reprocessing old data. Which action should the engineer take FIRST to reduce the job duration?

Accepted Answer

Enable Glue job bookmarking and configure the job to process only new data.. The Glue job is reprocessing all 500 GB of data every hour because it lacks job bookmarking, which tracks previously processed data. Enabling job bookmarking allows Glue to persist state about which files have already been processed, so subsequent runs only read new files. This directly reduces the input volume and thus the job duration without changing the job logic or infrastructure. Since the data volume is consistent and no code changes were made, the issue is purely due to reprocessing old data, making bookmarking the correct first step.

Answer

Increase the parallelism of the Spark job by repartitioning the data.

Answer

Add partition pruning by modifying the S3 path to include date-based partitions.

Answer

Increase the number of DPUs for the Glue job to 100.

Question 4

A data engineer is designing a data ingestion pipeline to load data from an on-premises Oracle database to Amazon S3. The pipeline should capture changes in near real-time (within minutes) and minimize impact on the source database. The source table has a 'last_modified' timestamp column. Which service combination would meet these requirements?

Accepted Answer

AWS DMS with a replication task in CDC mode, writing to S3 in Parquet format.. AWS DMS with a replication task in CDC (Change Data Capture) mode is the correct choice because it continuously reads the Oracle redo logs to capture near real-time changes (within seconds to minutes) with minimal impact on the source database. It can directly write to S3 in Parquet format, meeting the requirement for low-latency ingestion without full table scans.

Answer

Amazon Kinesis Data Firehose with a Lambda function that queries Oracle.

Answer

AWS Data Pipeline with a periodic SQL query activity to copy full table snapshots.

Answer

AWS Glue with a JDBC connection to Oracle, running a crawler every 5 minutes.

Question 5

A company uses AWS Glue to process sensitive data stored in Amazon S3. The security team requires that all data in transit between AWS Glue and S3 be encrypted. Which configuration should be used to meet this requirement?

Accepted Answer

Use an S3 bucket policy that denies requests not using HTTPS.. Requiring HTTPS for all requests to the S3 bucket ensures that data in transit between AWS Glue and S3 is encrypted using TLS. By using an S3 bucket policy with a condition that denies requests where `aws:SecureTransport` is false, the company enforces encryption for all connections, including those from AWS Glue. This meets the security requirement without needing to modify Glue or S3 configurations beyond the bucket policy.

Answer

Use an AWS KMS key to encrypt the data before uploading to S3.

Answer

Configure AWS Glue to use SSL by setting the 'ssl' parameter to 'true'.

Answer

Enable default encryption on the S3 bucket using SSE-S3.

Question 6

A data engineer needs to audit all AWS KMS key usage in the account. Which AWS service should be used to record KMS API calls?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records API calls for KMS. Option B (AWS Config) is wrong because it records resource changes, not API calls. Option C (Amazon CloudWatch Logs) is wrong because it stores logs but does not record API calls. Option D (Amazon GuardDuty) is wrong because it is for threat detection.

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Answer

Amazon GuardDuty

Question 7

A company uses AWS Glue ETL jobs to process data from an S3 data lake. The job reads data in CSV format, transforms it, and writes to Parquet. The job runs daily and takes 2 hours to complete. The data volume is increasing by 20% each month. The engineer wants to reduce the job runtime. Which action is most effective?

Accepted Answer

Partition the input data in S3 by date and use partition pruning in the job. Most effective because partitioning the input data by date and using partition pruning allows the Glue ETL job to read only the relevant partitions instead of scanning the entire S3 data lake. This drastically reduces the amount of data processed, which directly addresses the growing data volume and shortens job runtime. Partition pruning is a core optimization for Spark-based Glue jobs, as it leverages Hive-style partitioning to skip unnecessary files.

Answer

Increase the number of DPUs for the Glue job

Answer

Enable compression on the input CSV files

Answer

Switch from Python Shell to Spark ETL

Question 8

A company wants to audit all changes to IAM policies in their AWS account. Which combination of services should be used to achieve this?

Accepted Answer

AWS CloudTrail and Amazon CloudWatch Logs. AWS CloudTrail records all API calls, including IAM policy changes, and can deliver logs to Amazon CloudWatch Logs for monitoring and alerting. This combination provides a comprehensive audit trail and real-time analysis capability.

Answer

AWS Config and Amazon SNS

Answer

Amazon CloudWatch Logs and Amazon SNS

Answer

AWS CloudTrail and Amazon DynamoDB

Question 9

A company wants to centrally manage encryption keys for multiple AWS services and automatically rotate them every year. Which AWS service should be used?

Accepted Answer

AWS Key Management Service (KMS). AWS Key Management Service (KMS) is designed to centrally manage encryption keys for multiple AWS services and supports automatic annual rotation of customer master keys. It integrates with services like S3, EBS, and RDS, making it the correct choice.

Answer

AWS CloudHSM

Answer

AWS Certificate Manager (ACM)

Answer

AWS Secrets Manager

Question 10

A data engineer is setting up a data pipeline using AWS DMS to migrate data from an on-premises database to Amazon RDS for MySQL. The data must be encrypted in transit. Which TWO options can the engineer use? (Choose TWO.)

Accepted Answer

Enable SSL encryption on the DMS endpoint. Option B is correct because AWS DMS endpoints for MySQL support SSL/TLS, and enabling the SSL encryption setting on the source and target endpoints causes DMS to negotiate an encrypted connection to the database, satisfying the in-transit encryption requirement. Option C is correct because a VPN connection (AWS Site-to-Site VPN) creates an IPsec-encrypted tunnel between the on-premises network and the AWS VPC, protecting data in transit as it crosses the public internet to reach Amazon RDS for MySQL. Option A is not correct because VPC peering only connects AWS VPCs to each other and does not extend to an on-premises network, so it cannot secure this migration path. Option D is not correct because AWS KMS provides encryption at rest for stored data and keys, not encryption of the DMS network connection in transit. Option E is not correct because a VPC endpoint (AWS PrivateLink) provides private connectivity to AWS services within AWS, not an encrypted path from an on-premises database to RDS.

Answer

Use VPC peering between on-premises and AWS

Answer

Use KMS to encrypt the DMS connection

Answer

Use a VPC endpoint for DMS

Question 11

A company runs a data processing pipeline using Amazon EMR with Spark. The pipeline reads from S3, processes data, and writes to S3. Recently, the job started failing with 'S3AccessDeniedException' even though the EMR role has appropriate S3 permissions. Which TWO actions should the data engineer take to resolve this issue? (Choose TWO.)

Accepted Answer

Verify that the EMR service role has the necessary S3 permissions in IAM.. Option B is correct because even when the EMR role appears to have S3 permissions, the actual attached IAM service role (EMR_DefaultRole or a custom EC2 instance profile for EMR) must explicitly allow the required s3:GetObject, s3:PutObject, s3:ListBucket, and related actions on the specific bucket and object ARNs; a missing or mis-scoped policy on the role produces exactly the S3AccessDeniedException seen here. Option D is correct because an explicit Deny in the S3 bucket policy always overrides any Allow granted through the IAM role, so a deny statement (for example, one enforcing TLS, VPC endpoint, or encryption conditions) would cause access failures despite the role having appropriate permissions. Option A is incorrect because S3 versioning only affects object version retention and does not grant or alter access permissions. Option C is incorrect because disabling Block Public Access would only matter for public/anonymous access and would not fix a role-based access denial; it would also weaken security. Option E is incorrect because a missing S3 VPC endpoint causes connectivity/timeout issues, not an S3AccessDeniedException, and the error indicates the request reached S3 and was explicitly denied by permissions.

Answer

Enable S3 versioning on the bucket to allow multiple access methods.

Answer

Disable S3 Block Public Access settings on the bucket.

Answer

Ensure the EMR cluster is launched in a VPC with an S3 VPC endpoint.

Question 12

A company uses Amazon DynamoDB with provisioned capacity. During a sales event, write traffic spikes and some requests receive ProvisionedThroughputExceeded exceptions. The reads are within limits. The data engineer needs to minimize latency for the spike without manual intervention. Which solution is MOST cost-effective?

Accepted Answer

Enable DynamoDB auto scaling for write capacity with a target utilization of 70%.. DynamoDB auto scaling for write capacity automatically adjusts the provisioned write capacity units (WCUs) based on the actual traffic pattern, using a target utilization of 70% to balance cost and performance. This eliminates manual intervention and handles spikes efficiently by scaling up before throttling occurs, while remaining cost-effective since capacity scales down when traffic subsides.

Answer

Use Amazon SQS to buffer write requests and process them in batches.

Answer

Disable auto scaling and set write capacity to the peak observed value.

Answer

Enable DynamoDB Accelerator (DAX) to cache write operations.

Question 13

A company is designing a data lake on Amazon S3. The data includes CSV files, Parquet files, and images. The data engineering team needs to catalog the metadata and enable SQL queries. Which TWO AWS services should be used together?

Accepted Answer

Amazon Athena. Amazon Athena is correct because it is a serverless interactive query service that can directly query data stored in Amazon S3 using standard SQL, without needing to load or transform data. AWS Glue is correct because it provides a fully managed data catalog (AWS Glue Data Catalog) that stores metadata about the data lake's schema, partitions, and locations, which Athena can use to discover and query the data efficiently.

Answer

Amazon EMR

Answer

Amazon Redshift Spectrum

Answer

Amazon QuickSight

Question 14

A data engineer runs a Spark job on Amazon EMR that reads data from Amazon S3 and writes results back to S3. The job fails with an 'S3AccessDenied' error. The engineer verifies that the IAM role attached to the EMR cluster has s3:GetObject and s3:PutObject permissions on the relevant buckets. What is the MOST likely cause of the error?

Accepted Answer

The IAM role does not have s3:ListBucket permission on the bucket.. The IAM role attached to the EMR cluster must have the s3:ListBucket permission on the bucket to allow the Spark job to enumerate objects when reading from S3. Without this permission, even with s3:GetObject and s3:PutObject, the job fails with an 'S3AccessDenied' error because the S3 list operation is required for directory listing and file discovery.

Answer

S3 Transfer Acceleration is not enabled on the bucket.

Answer

EMRFS consistent view is not configured.

Answer

The S3 bucket is in a different AWS Region than the EMR cluster.

Question 15

A data engineering team is troubleshooting a failing AWS Glue ETL job that processes data from an S3 bucket. The job writes output to another S3 bucket. The job fails with an AccessDenied error when writing to the output bucket. The IAM role used by the job has the following policy attached: {"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":["s3:GetObject","s3:ListBucket"],"Resource":["arn:aws:s3:::input-bucket/*","arn:aws:s3:::input-bucket"]}]}. What is the most likely cause of the failure?

Accepted Answer

The IAM role does not have s3:PutObject permission on the output bucket.. The IAM policy attached to the Glue job role only grants s3:GetObject and s3:ListBucket on the input bucket. There is no s3:PutObject (or any write) permission on the output bucket, so when Glue attempts to write results, S3 returns AccessDenied. The most likely cause is therefore the missing write permission on the output bucket.

Answer

The ETL job is processing more than 10 TB of data.

Answer

The output bucket has a bucket policy that denies access to the IAM role.

Answer

The IAM role used by the job does not exist.