DEA-C01 Practice Test 21 — 15 Questions

Question 1

A data engineer needs to transfer 50 TB of data from an on-premises data center to Amazon S3 over a 1 Gbps network. The transfer must be completed within one week. Which TWO AWS services can be used for this task? (Choose TWO.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS DataSync. AWS DataSync is correct because it is designed to efficiently transfer large datasets over the network using a purpose-built agent that parallelizes data transfer and optimizes network utilization. With a 1 Gbps link, DataSync can transfer 50 TB within a week by leveraging its built-in compression, encryption, and incremental transfer capabilities, making it suitable for this time-constrained migration.

Answer

AWS Glue

Answer

Amazon S3 Transfer Acceleration

Answer

AWS Direct Connect

Question 2

A company is designing a data ingestion pipeline for real-time clickstream data. The data must be ingested with low latency (< 1 second) and then processed for real-time analytics. The processed data should be stored in Amazon S3 for batch analytics. Which THREE services should be used together?

Accepted Answer

Amazon Kinesis Data Analytics. Amazon Kinesis Data Analytics is correct because it enables real-time processing of streaming data using SQL or Apache Flink, allowing the company to perform real-time analytics on clickstream data with sub-second latency. It directly consumes data from Kinesis Data Streams and can output results to Kinesis Data Firehose for storage in Amazon S3, fulfilling the requirement for both real-time analytics and batch analytics storage.

Answer

Amazon Managed Streaming for Apache Kafka (MSK)

Answer

AWS Glue ETL job

Question 3

A company is using Amazon S3 to store sensitive data. They need to ensure that all objects are encrypted at rest. Which combination of actions should be taken? (Choose TWO.)

Accepted Answer

Use a bucket policy to deny PutObject requests that do not include the x-amz-server-side-encryption header.. A bucket policy that denies PutObject requests lacking the `x-amz-server-side-encryption` header enforces encryption at the time of upload, ensuring that any object written without explicit encryption headers is rejected. Option E is correct because enabling default encryption on the S3 bucket automatically applies server-side encryption (SSE-S3 or SSE-KMS) to any object uploaded without specifying encryption headers, providing a fallback that covers all objects. Together, these actions ensure that every object stored in the bucket is encrypted at rest, either by explicit client request or by default bucket settings.

Answer

Enable S3 Versioning on the bucket.

Answer

Enable MFA Delete on the bucket.

Answer

Configure S3 Access Points with network policies.

Question 4

A data engineer is tasked with implementing data masking for a non-production environment. The source data contains credit card numbers stored in an Amazon RDS for PostgreSQL database. The engineer wants to automatically mask the credit card numbers when copying data to the non-production database. Which AWS service can be used to achieve this?

Accepted Answer

AWS Database Migration Service (DMS). AWS DMS can transform data during migration using transformation rules. It can mask data by replacing columns with predefined values. Glue is for ETL, but DMS is purpose-built for database migrations with transformations. Lake Formation is for data lake permissions. Athena is for querying S3 data.

Answer

AWS Glue

Answer

AWS Lake Formation

Answer

Amazon Athena

Question 5

A company is running a MySQL database on Amazon RDS. The database size is 2 TB, and the company needs to migrate it to Amazon Aurora MySQL with minimal downtime. Which migration strategy is most appropriate?

Accepted Answer

Create an Aurora MySQL read replica from the RDS instance, then promote it.. Creating an Aurora MySQL read replica from the existing RDS MySQL instance allows the Aurora cluster to stay synchronized with the source using MySQL’s native binlog replication. Once the replica lag reaches zero, you can promote it to a standalone Aurora cluster with minimal downtime, typically just a few seconds to stop writes and redirect traffic. This approach avoids the lengthy export/import process and leverages Amazon’s managed replication for near-zero-downtime migration.

Answer

Use mysqldump to export the database and import it into Aurora.

Answer

Take a snapshot of the RDS instance and restore it as an Aurora cluster.

Answer

Use AWS Database Migration Service (DMS) with full load and ongoing replication.

Question 6

A data engineer needs to store semi-structured JSON logs from multiple sources in a centralized data store for querying using SQL. The logs are immutable and need to be retained for 90 days. Which AWS service should be used?

Accepted Answer

Amazon S3 with Amazon Athena.. Amazon S3 with Amazon Athena is the correct choice because S3 provides durable, cost-effective storage for immutable semi-structured JSON logs, and Athena enables serverless SQL querying directly against the data in S3 without needing to load or transform it. This combination meets the 90-day retention requirement and supports querying semi-structured data using standard SQL via Athena's built-in JSON SerDe.

Answer

Amazon RDS for MySQL.

Answer

Amazon DynamoDB.

Answer

Amazon ElastiCache for Redis.

Question 7

A company wants to import data from an external FTP server into Amazon S3 on a daily basis. The data volumes are moderate. Which AWS service is MOST suitable for this task?

Accepted Answer

AWS Transfer Family. AWS Transfer Family is the most suitable service because it provides fully managed support for SFTP, FTPS, and FTP protocols, enabling direct, secure file transfers from an external FTP server to Amazon S3 without needing to manage any infrastructure. It integrates natively with S3, so files are automatically stored in the specified bucket upon transfer completion, making it ideal for daily imports of moderate data volumes.

Answer

Amazon S3 Transfer Acceleration

Answer

AWS DataSync

Answer

AWS Glue with a JDBC connection

Question 8

A data engineer notices that an AWS Glue job writing to Amazon S3 in Parquet format creates many small files (less than 1 MB each). This leads to poor query performance in Amazon Athena. What is the BEST way to reduce the number of output files?

Accepted Answer

Enable 'groupFiles' in the Glue job's S3 target configuration.. Enabling 'groupFiles' in the AWS Glue job's S3 target configuration instructs Glue to coalesce small files into larger ones (default target size ~128 MB) during the write phase. This directly reduces the number of small Parquet files written to S3, improving Athena query performance by minimizing S3 LIST and GET overhead.

Answer

Use 'coalesce(1)' at the end of the ETL script.

Answer

Use 'repartition(100)' to increase parallelism.

Answer

Configure an S3 lifecycle policy to delete small files.

Question 9

The IAM policy shown in the exhibit is attached to a user. The user tries to upload an object to my-bucket using the AWS CLI without specifying encryption. What will happen?

Accepted Answer

The upload will fail with an access denied error. The IAM policy allows s3:PutObject only if the request includes the encryption header x-amz-server-side-encryption with value AES256. Since the user does not specify any encryption, the condition is not met, and the request is denied with an access denied error. Option A is wrong because the condition is not optional. Option B is wrong because default encryption applies only when the policy does not explicitly require a header; here the policy enforces the header. Option C is wrong because the policy does not require a KMS key; it requires AES256 encryption, which is SSE-S3.

Answer

The upload will succeed because the bucket has default encryption

Answer

The upload will succeed but the object will not be encrypted

Answer

The upload will fail because a KMS key is required

Question 10

Which TWO of the following are features of Amazon RDS Multi-AZ deployments? (Choose 2.)

Accepted Answer

Automatic failover to a standby instance in case of an AZ failure.. Amazon RDS Multi-AZ deployments automatically handle failover to a standby instance in a different Availability Zone when the primary instance fails or the AZ becomes unavailable. This synchronous replication ensures zero data loss and minimal downtime, with the standby instance automatically promoted to primary without manual intervention.

Answer

Read replicas in the same region for offloading read traffic.

Answer

Automatic storage scaling based on usage.

Answer

Synchronous replication across AWS Regions.

Question 11

A data engineer notices that an AWS Glue ETL job is running slower than expected. The job reads from Amazon S3, joins two datasets, and writes the result back to S3. The job uses the default worker type (G.1X) and 10 DPUs. Which action is most likely to improve performance?

Accepted Answer

Repartition the data before the join operation. The default G.1X worker type provides 16 GB of memory and 4 vCPUs per DPU. With 10 DPUs, the job likely has sufficient compute but suffers from data skew or inefficient partitioning during the join. Repartitioning the data before the join ensures that keys are evenly distributed across partitions, reducing shuffle overhead and preventing straggler tasks, which directly improves performance.

Answer

Increase the number of DPUs to 20

Answer

Use coalesce to reduce the number of output files

Answer

Change the worker type to G.2X

Question 12

A company runs an Amazon EMR cluster with Spark jobs that process data from Amazon S3. The data engineer receives an alert that one of the Spark jobs failed with an OutOfMemoryError. The job processes large files and uses the default Spark configurations. Which configuration change is MOST likely to resolve the issue?

Accepted Answer

Increase the spark.executor.memory configuration.. Increasing spark.executor.memory allocates more memory per executor, directly addressing the OutOfMemoryError when processing large files. Option B (increasing executors) does not increase memory per executor, so each executor remains susceptible to OOM. Option C (disabling dynamic resource allocation) would prevent the cluster from adding resources dynamically, potentially worsening the situation. Option D (decreasing cores per executor) reduces parallelism but does not increase memory per executor; the OOM occurs because each executor lacks sufficient memory, not because of too many cores.

Answer

Increase the number of executors.

Answer

Disable dynamic resource allocation.

Answer

Decrease the number of cores per executor.

Question 13

A data engineer applies the above bucket policy to an S3 bucket containing sensitive data. The goal is to allow only encrypted (HTTPS) requests. However, a user reports being able to access an object using an HTTP (non-HTTPS) request. What is the most likely reason?

Accepted Answer

The condition key aws:SecureTransport is used with BoolIfExists instead of Bool. The policy uses "BoolIfExists" instead of "Bool" for the aws:SecureTransport condition. "BoolIfExists" evaluates to true if the key is absent (as in HTTP requests), thus the Deny effect is not triggered, allowing HTTP access. Option A is wrong because using Allow or Deny is not the issue; the condition key's evaluation is the problem. Option B is incorrect because the resource ARN must include the bucket itself when using bucket policies, but this is not relevant here. Option D is wrong because a principal of "*" includes all authenticated users (not anonymous).

Answer

The policy uses Allow instead of Deny

Answer

The resource ARN does not include the bucket itself

Answer

The principal is set to "*", which allows anonymous access

Question 14

A company uses Amazon RDS for MySQL to store financial data. A compliance requirement mandates that all database connections must be encrypted. Which configuration step is necessary?

Accepted Answer

Set the RDS parameter require_secure_transport to 1.. To enforce encrypted connections in transit for RDS MySQL, you need to configure the DB parameter group to require SSL/TLS. Setting the parameter 'require_secure_transport' to 1 forces all connections to use encryption. Option C is incorrect because enabling encryption at rest (at creation time) encrypts stored data, not connections in transit, which does not satisfy the compliance requirement for encrypted connections.

Answer

Create the RDS DB instance in a private subnet.

Answer

Enable encryption for the RDS DB instance at creation time.

Answer

Configure the VPC security group to only allow traffic from certain IPs.

Question 15

Which THREE steps are recommended for migrating an on-premises Oracle database to Amazon RDS for Oracle with minimal downtime? (Choose 3.)

Accepted Answer

Set up a VPN or Direct Connect between on-premises and AWS. Establishing a VPN or Direct Connect provides a secure, private, and low-latency network connection between the on-premises environment and AWS. This is essential for minimizing downtime during a migration, as it ensures reliable and fast data transfer for both the initial full load and ongoing replication, reducing the risk of network interruptions that could extend the migration window.

Answer

Disable archiving on the source database

Answer

Perform a full load migration without change data capture