DEA-C01 Practice Exam 2 — 20 Questions

Question 1

A data engineer needs to monitor the number of Amazon S3 PUT requests that result in a 403 AccessDenied error. Which AWS service should be used to capture the necessary data?

Accepted Answer

AWS CloudTrail data events. S3 request metrics do not provide filtering by status code; the 4xxErrors metric aggregates all 4xx errors. To monitor specific 403 AccessDenied errors, you should use AWS CloudTrail data events, which capture API call details including error codes. You can create a CloudWatch metric filter on the CloudTrail log group to emit a custom metric for 403 errors, enabling monitoring and alarming.

Answer

Amazon CloudWatch S3 request metrics

Answer

Amazon S3 server access logs

Answer

AWS Config

Question 2

A company runs a data pipeline that uses Amazon EMR to process large datasets. The pipeline reads data from S3, processes it using Spark, and writes results back to S3. Recently, the pipeline has been failing with 'OutOfMemoryError' in the Spark executors. The EMR cluster is configured with 5 core nodes of type m5.xlarge (4 vCPU, 16 GB memory each). The Spark application uses dynamic allocation and default Spark configurations. The input data size is approximately 500 GB in Parquet format. What is the most cost-effective way to resolve the out-of-memory errors?

Accepted Answer

Change the core node instance type to r5.xlarge (32 GB memory) and keep 5 nodes.. The current cluster has limited memory per node (16 GB). By switching to memory-optimized instances like r5.xlarge (32 GB), each node has double the memory, reducing the chance of OOM. This is more cost-effective than adding more nodes because the total memory per node increases without increasing the number of instances. Option A is wrong because increasing the number of nodes adds more memory but also more cost; it might be more expensive than using fewer, larger nodes. Option C is wrong because it's generally not recommended to increase spark.executor.memory beyond the physical memory; it could cause YARN to kill containers. Option D is wrong because Parquet is already efficient; changing to a different format may not solve memory issues.

Answer

Increase the spark.executor.memory setting to 8 GB in the Spark configuration.

Answer

Increase the number of core nodes to 10 to distribute the data across more executors.

Answer

Change the input data format from Parquet to ORC to reduce memory footprint.

Question 3

A data engineer needs to transform CSV files arriving in S3 into Parquet format and partition them by date. The transformation should be event-driven and run immediately after each file is uploaded. Which approach is most efficient?

Accepted Answer

Use S3 event notification to trigger an AWS Glue job. AWS Glue jobs can be triggered directly by S3 event notifications, enabling event-driven, serverless transformation of CSV to Parquet with partitioning by date. Glue is optimized for this batch ETL workload, handling schema inference and partitioning efficiently without managing infrastructure, making it the most efficient choice for immediate, per-file transformation.

Answer

Use an S3 event notification to invoke a Lambda function that converts the file

Answer

Use an Amazon EMR cluster running Spark to process files as they arrive

Answer

Use Amazon Athena CREATE TABLE AS SELECT (CTAS) on a schedule

Question 4

A company has an S3 bucket with millions of objects. The data engineer needs to identify which objects are not accessed for 90 days to move them to a lower-cost storage class. Which feature should be used?

Accepted Answer

S3 Storage Class Analysis. S3 Storage Class Analysis (SCA) is the correct feature because it monitors access patterns across objects and provides recommendations for transitioning data to lower-cost storage classes based on last-access dates. SCA can analyze objects that have not been accessed for 90 days and generate a report to inform lifecycle policy creation, directly addressing the requirement to identify objects for cost optimization.

Answer

S3 Inventory

Answer

S3 Server Access Logs

Answer

S3 Event Notifications

Question 5

A company uses Amazon RDS for MySQL with Multi-AZ deployment. The primary instance fails, and automatic failover occurs. After failover, the data engineer notices that the new primary instance has a different DNS endpoint. Which TWO statements are true about this scenario? (Choose TWO.)

Accepted Answer

The DNS CNAME record is updated to point to the new primary.. When Amazon RDS performs automatic failover in a Multi-AZ deployment, it updates the DNS CNAME record for the primary DB instance to point to the new primary (formerly the standby). This ensures that applications using the original endpoint are transparently redirected to the new primary without manual intervention.

Answer

The standby instance is created in the same Availability Zone as the failed primary.

Answer

A manual DNS update is required to connect to the new primary.

Answer

The endpoint changes to the standby instance's endpoint.

Question 6

Match each AWS security service to its purpose in data protection.

Accepted Answer

AWS KMS: Manage encryption keys for data at rest and in transit. The correct matches are: AWS KMS for encryption key management, AWS IAM for access control, and AWS CloudTrail for API auditing. Common confusions include swapping these services' purposes.

Answer

AWS KMS: Control access to AWS resources through users, groups, and roles

Answer

AWS IAM: Manage encryption keys for data at rest and in transit

Answer

AWS CloudTrail: Manage encryption keys for data at rest and in transit

Question 7

A data engineer is troubleshooting a failed AWS Glue ETL job that reads from and writes to the S3 bucket 'example-bucket'. The job's IAM role has the policy shown in the exhibit. The job fails with an Access Denied error when writing to a prefix 'output/'. Which permission is MISSING?

Accepted Answer

s3:DeleteObject. The IAM policy grants s3:GetObject and s3:PutObject on 'example-bucket/*', which includes the 'output/' prefix, so write access is sufficient. However, AWS Glue ETL jobs often create temporary files or need to clean up staging data, requiring s3:DeleteObject permission. Without it, the job may fail with an Access Denied error when attempting to delete objects during the write process or when cleaning up after a failure. Option D (s3:DeleteObject) is the missing permission.

Answer

s3:PutObjectAcl

Answer

s3:GetBucketAcl

Answer

s3:ListBucket on the output prefix

Question 8

A company uses AWS Glue to process streaming data from Amazon Kinesis Data Streams. The data is JSON formatted and includes a timestamp field. The company wants to partition the output in Amazon S3 by date and hour, and ensure exactly-once processing semantics. Which combination of configurations should be used?

Accepted Answer

Enable checkpointing in the AWS Glue streaming job and specify an S3 location for checkpoint data.. AWS Glue streaming jobs require checkpointing to track the progress of data consumption from Kinesis Data Streams and to ensure exactly-once processing semantics. By enabling checkpointing and specifying an S3 location, Glue periodically saves the state of processed records, allowing it to resume from the last committed offset in case of failures, thus preventing duplicates or data loss.

Answer

Disable checkpointing and use the 'exactly_once' delivery option in Kinesis Data Streams.

Answer

Use Amazon DynamoDB as a checkpoint store by configuring the Glue job with a DynamoDB connection.

Answer

Use Kinesis Client Library (KCL) checkpointing with a DynamoDB table.

Question 9

A company is using AWS Glue ETL jobs to process data from Amazon S3 and write results back to S3. The jobs are failing intermittently with 'ThrottlingException' errors. Which TWO configurations would help reduce these errors?

Accepted Answer

Add retry logic with exponential backoff in the job script.. Adding retry logic with exponential backoff in the job script directly addresses transient 'ThrottlingException' errors by automatically retrying failed API calls after increasing delays. This is a standard best practice for handling service throttling in AWS Glue, as it reduces the request rate to stay within service limits without requiring infrastructure changes.

Answer

Decrease the number of DPUs for the job.

Answer

Enable GZIP compression on the output data.

Answer

Change the job type from Spark to Python shell.

Question 10

A CloudFormation template includes this IAM policy for a cross-account S3 upload use case. What is the purpose of the condition?

Accepted Answer

To ensure that uploaded objects grant full control to the bucket owner.. The condition in the IAM policy uses the `s3:x-amz-acl` key with a value of `bucket-owner-full-control`. This ensures that any object uploaded to the S3 bucket explicitly grants the bucket owner full control over the object, overriding the default behavior where the uploading account retains ownership. This is critical in cross-account uploads to prevent the uploading account from retaining exclusive access to the objects.

Answer

To enforce server-side encryption with KMS.

Answer

To limit the size of objects that can be uploaded.

Answer

To restrict uploads to only a specific AWS account.

Question 11

A data engineer is designing a data lake on Amazon S3. The data is accessed frequently for the first 30 days, then rarely after that. The engineer needs to minimize storage costs while ensuring data is available within minutes for the first 30 days and can be retrieved within 12 hours after that. Which lifecycle policy should be applied?

Accepted Answer

Transition to S3 Glacier Deep Archive after 30 days.. S3 Glacier Deep Archive offers the lowest storage cost for data that is rarely accessed after 30 days, and its retrieval time (within 12 hours) matches the requirement. The lifecycle policy transitions objects from S3 Standard (or S3 Intelligent-Tiering) to S3 Glacier Deep Archive after 30 days, minimizing costs while meeting the 12-hour retrieval window.

Answer

Transition to S3 One Zone-IA after 30 days.

Answer

Transition to S3 Standard-IA after 30 days.

Answer

Transition to S3 Glacier Flexible Retrieval after 30 days.

Question 12

A data engineer needs to ingest data from multiple SaaS applications (Salesforce, Marketo) into Amazon S3 for a data lake. The data volumes are moderate and the sync needs to be scheduled daily. Which AWS service is most appropriate for this task?

Accepted Answer

Amazon AppFlow. Amazon AppFlow is purpose-built for securely transferring data between SaaS applications (like Salesforce and Marketo) and AWS services (like S3). It supports scheduled, incremental data syncs with built-in connectors, making it the most appropriate choice for moderate-volume daily ingestion into a data lake.

Answer

AWS Glue

Answer

AWS Database Migration Service (DMS)

Answer

Amazon Kinesis Data Firehose

Question 13

A data engineer is troubleshooting a Kinesis Data Firehose delivery stream that is experiencing high error rates when writing to an S3 bucket. The error logs indicate 'AccessDenied' errors. The S3 bucket policy allows access from the Firehose service, but the errors persist. What is the most likely cause?

Accepted Answer

The IAM role assumed by Firehose does not have the s3:PutObject permission. The most likely cause is that the IAM role assumed by Kinesis Data Firehose lacks the `s3:PutObject` permission. Even if the S3 bucket policy allows access from the Firehose service, the IAM role must explicitly grant the necessary S3 write permissions for Firehose to deliver data. Without this permission, Firehose receives 'AccessDenied' errors when attempting to write objects to the bucket.

Answer

The S3 bucket has a lifecycle policy that is deleting objects too quickly

Answer

The S3 bucket has default encryption enabled

Answer

The S3 bucket uses an AWS KMS key for encryption and Firehose does not have kms:Decrypt permission

Question 14

A company stores sensitive data in Amazon S3. The data engineer needs to implement a solution that automatically detects and redacts PII in new objects as they are uploaded. Which TWO AWS services should be used together?

Accepted Answer

Amazon Macie. Amazon Macie is a fully managed data security and data privacy service that uses machine learning and pattern matching to discover and protect sensitive data in Amazon S3. Amazon Comprehend is a natural language processing (NLP) service that can be used to detect and redact PII entities from text. Together, they enable automated detection and redaction of PII in newly uploaded S3 objects by triggering Macie to identify sensitive data and then using Comprehend to redact the PII.

Answer

AWS Glue ETL

Answer

Amazon DynamoDB

Answer

AWS Glue Data Catalog

Question 15

A data engineer is designing a data lake on Amazon S3 for analytics. The data includes sensitive PII that must be encrypted at rest. The company requires that the encryption keys be managed by the company's own hardware security module (HSM) and rotated every 90 days. Which TWO options meet these requirements? (Choose TWO.)

Accepted Answer

Use S3 server-side encryption with customer-provided keys (SSE-C). SSE-C allows you to provide your own encryption keys, which can be managed and rotated from your own HSM. The keys are used server-side by S3 to encrypt objects at rest, but S3 does not store the keys—you manage them entirely, meeting the requirement for key management on your own HSM with 90-day rotation.

Answer

Use S3 server-side encryption with AWS KMS and an AWS managed key

Answer

Use client-side encryption with keys stored in AWS Secrets Manager

Answer

Use S3 server-side encryption with S3 managed keys (SSE-S3)

Question 16

Which THREE factors should a data engineer consider when choosing between Amazon S3 and Amazon DynamoDB for storing time-series data? (Choose three.)

Accepted Answer

Required query complexity (simple key lookups vs. range scans). Amazon S3 supports range scans via its ListObjectsV2 API with prefix and delimiter parameters, but it is not optimized for complex queries like filtering on non-key attributes or aggregations. DynamoDB, on the other hand, excels at simple key lookups and range scans on its sort key, but lacks native support for complex query patterns such as multi-attribute filtering or joins. Therefore, the required query complexity directly influences the choice: S3 is better for simple prefix-based scans, while DynamoDB is better for key-value lookups and sort-key range queries.

Answer

Cost per GB of storage

Answer

Total data volume

Question 17

A company runs a nightly AWS Glue ETL job that writes results to an Amazon Redshift table using the JDBC connector. Recently, the job has been failing with the error 'ERROR:  connection to server at ... failed: server closed the connection unexpectedly'. The Redshift cluster is in a private subnet with a VPC endpoint for S3. The Glue job runs in the same VPC with enhanced VPC routing enabled. Which is the most likely cause?

Accepted Answer

SSL is not enabled on the Redshift cluster.. The error 'server closed the connection unexpectedly' typically indicates that the Redshift cluster rejected the connection, often because SSL is required but not enabled in the Glue JDBC connection. Redshift clusters can be configured with the `require_ssl` parameter set to true, forcing all connections to use SSL. Option B is correct because without SSL, the server terminates the connection. Option A is incorrect because the 'redshift' compatibility mode is not a standard requirement; the JDBC driver works without it. Option C is incorrect because security group issues would cause a timeout or 'connection refused', not a server-side close. Option D is incorrect because Glue supports Redshift as a data source.

Answer

The JDBC driver is missing the 'redshift' compatibility mode setting.

Answer

The Glue job's security group does not allow outbound traffic to the Redshift cluster.

Answer

AWS Glue does not support Redshift as a data source.

Question 18

A data engineer needs to ensure that data in an Amazon S3 bucket is not publicly accessible. Which TWO measures should the engineer implement? (Choose TWO.)

Accepted Answer

Attach a bucket policy that denies access to 'Principal': '*' unless specific conditions are met.. To prevent public access to an S3 bucket, you can use bucket policies that explicitly deny access to anonymous principals (option A) or enable S3 Block Public Access settings (option C). Option B is incorrect because lifecycle policies manage object retention and deletion, not access control. Option D is incorrect because versioning protects against accidental deletion/overwrites but does not control access. Option E is incorrect because default encryption secures data at rest but does not restrict public access.

Answer

Create a lifecycle policy to delete objects after 30 days.

Answer

Enable S3 Versioning on the bucket.

Answer

Enable default encryption on the bucket.

Question 19

A data engineer needs to store time-series data from IoT devices. The data is write-heavy and requires low-latency queries by device ID and timestamp. The data volume is expected to grow to terabytes. Which AWS database service is most suitable?

Accepted Answer

Amazon Timestream. Amazon Timestream is purpose-built for time-series data, offering automatic tiered storage (in-memory for recent data and magnetic for historical) to handle write-heavy IoT workloads at scale. It supports low-latency queries by device ID and timestamp via its SQL-compatible query engine, making it the most suitable choice for terabytes of time-series data.

Answer

Amazon RDS for MySQL

Answer

Amazon ElastiCache for Redis

Answer

Amazon DynamoDB

Question 20

A company has an Amazon RDS for MySQL database that is experiencing performance issues due to a large number of read requests. The application is read-heavy and can tolerate eventually consistent reads. Which action will reduce the load on the primary database with the least operational overhead?

Accepted Answer

Create a read replica in the same region. Creating a read replica in the same region offloads read traffic from the primary RDS instance to a read-only copy, which directly addresses the read-heavy workload. Since the application can tolerate eventually consistent reads, the slight replication lag is acceptable, and this solution requires minimal operational overhead—just a few clicks in the AWS console or a single API call—without any application code changes.

Answer

Use Amazon ElastiCache for caching

Answer

Enable Multi-AZ deployment

Answer

Increase the instance size of the primary DB