DEA-C01 Practice Test 22 — 15 Questions

Question 1

A company needs to ingest data from an on-premises Oracle database into Amazon Redshift for analytics. The data volume is 500 GB and the network bandwidth is limited. Which AWS service should be used for the initial one-time data migration?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS Snowball. AWS Snowball is the correct choice for the initial one-time migration of 500 GB of data from an on-premises Oracle database to Amazon Redshift when network bandwidth is limited. Snowball provides a physical storage device that bypasses network constraints entirely, allowing you to transfer large volumes of data securely and quickly by shipping the device to AWS for ingestion into Amazon S3, which can then be loaded into Redshift. This approach avoids the prolonged transfer times and potential bottlenecks associated with limited bandwidth, making it ideal for a one-time, large-scale data migration.

Answer

AWS Direct Connect

Answer

Amazon S3 Transfer Acceleration

Answer

AWS Database Migration Service (DMS)

Question 2

A data engineer is setting up Amazon S3 bucket policies for a data lake. The security team requires that all objects uploaded to the bucket be encrypted at rest using server-side encryption. Which TWO methods can enforce encryption at upload time?

Accepted Answer

Enable S3 default encryption on the bucket.. Enabling S3 default encryption on the bucket automatically applies server-side encryption (SSE-S3 or SSE-KMS) to all objects uploaded without an encryption header, ensuring encryption at rest. Option E is correct because a bucket policy with a Deny effect on PutObject when the x-amz-server-side-encryption header is missing enforces encryption at upload time by rejecting unencrypted uploads, providing a complementary enforcement mechanism.

Answer

Enable S3 Transfer Acceleration.

Answer

Enable AWS CloudTrail to monitor uploads.

Answer

Enable AWS KMS automatic key rotation.

Question 3

A company is using Amazon S3 to store log files. The security team wants to ensure that any object uploaded to the S3 bucket is automatically scanned for malware before being processed by downstream applications. The data engineer needs to implement a solution that integrates with AWS services and minimizes latency. The bucket receives thousands of objects per day. Which solution should the data engineer use?

Accepted Answer

Enable Amazon GuardDuty with malware protection for S3.. Amazon GuardDuty has a malware protection feature that can scan S3 objects for malware upon upload. It integrates with S3 events and minimizes latency. Option A is incorrect because Amazon Macie is for sensitive data discovery, not malware. Option C is incorrect because AWS WAF is for web application firewall, not S3 scanning. Option D is incorrect because running a custom scanning solution on EC2 adds operational overhead and latency.

Answer

Deploy an EC2 instance with antivirus software that triggers on S3 events.

Answer

Use AWS WAF to inspect objects as they are uploaded.

Answer

Enable Amazon Macie on the S3 bucket to detect malware.

Question 4

A gaming company uses Amazon DynamoDB to store player profiles and game state. The table has a partition key of 'player_id' and no sort key. The table is provisioned with 5,000 RCUs and 5,000 WCUs. The application performs frequent reads and writes to update player scores. Recently, the company introduced a new feature that allows players to form guilds. The guild data is stored in a separate DynamoDB table with a partition key of 'guild_id'. The application often needs to retrieve all members of a guild. The data engineer is encountering high latency when querying the guild table because the guilds can have up to 100 members. The engineer wants to reduce latency without changing the application architecture. What should the data engineer do?

Accepted Answer

Create a global secondary index (GSI) on the guild table with partition key guild_id and sort key member_id.. Adding a global secondary index (GSI) on the guild table with guild_id as the partition key and member_id as the sort key allows efficient queries for all members of a guild. Option A is wrong because increasing capacity may not solve the access pattern issue. Option C is wrong because DynamoDB Streams are for change data capture, not for query optimization. Option D is wrong because DAX caches read results; if the query pattern is inefficient, DAX won't help much.

Answer

Increase the provisioned read and write capacity for the guild table to 10,000 RCUs and 10,000 WCUs.

Answer

Enable DynamoDB Streams on the guild table and process the stream to populate a separate read table.

Answer

Use DynamoDB Accelerator (DAX) to cache the results of the guild queries.

Question 5

Refer to the exhibit. A data engineer has attached this IAM policy to an AWS Glue job role. The Glue job fails when trying to write transformed data to an S3 bucket located in a different AWS account. What is the most likely reason?

Accepted Answer

The policy does not grant s3:ListBucket, and the bucket policy may not allow cross-account access. The IAM policy shown does not include the s3:ListBucket permission, which is required for the Glue job to list objects in the S3 bucket before writing. Additionally, cross-account access requires both the source account's IAM policy (this one) to grant write permissions and the target account's S3 bucket policy to explicitly allow the source account's role, which may not be configured. Without s3:ListBucket, the Glue job cannot verify the bucket's existence or structure, causing the write operation to fail.

Answer

The policy does not allow lambda:InvokeAsync

Answer

The Glue job role does not have permissions to write to S3

Answer

The policy does not include kinesis:DescribeStream

Question 6

A data engineer applies the bucket policy shown in the exhibit to an S3 bucket. The bucket contains sensitive data that must be encrypted at rest and accessed only over HTTPS. Which of the following statements is true?

Accepted Answer

The policy enforces that all PutObject requests must include the x-amz-server-side-encryption header with value AES256.. The bucket policy includes a condition that denies PutObject requests unless the `s3:x-amz-server-side-encryption` header is present and set to `AES256`. This enforces server-side encryption with S3-managed keys (SSE-S3) for all uploads, ensuring data at rest is encrypted.

Answer

The policy allows both HTTP and HTTPS access.

Answer

The policy allows anonymous access to list objects in the bucket.

Answer

The policy requires the use of AWS KMS for server-side encryption.

Question 7

A company is migrating its on-premises PostgreSQL database to Amazon RDS for PostgreSQL. The database is 5 TB in size and supports a critical application that requires less than 30 minutes of downtime. The company has a 1 Gbps network connection to AWS. The data engineering team plans to use AWS Database Migration Service (DMS) with change data capture (CDC) to keep the target in sync. During the full load phase, DMS is taking longer than expected, and the team is concerned about meeting the downtime window. Which action should the team take to speed up the full load?

Accepted Answer

Create multiple DMS tasks to load different tables in parallel.. Creating multiple DMS tasks to load different tables in parallel (Option D) is the correct action because DMS performs full load sequentially within a single task. By splitting tables across multiple tasks, the team can parallelize the data transfer, utilizing the 1 Gbps network more efficiently and reducing the overall full load time to meet the 30-minute downtime window.

Answer

Increase the compute capacity of the target RDS instance.

Answer

Enable DMS validation to ensure data integrity.

Answer

Use AWS Snowball Edge to transfer the data offline.

Question 8

A company uses Amazon Kinesis Data Firehose to deliver streaming data to an Amazon S3 bucket. The data is then processed by a scheduled AWS Glue ETL job that loads it into an Amazon Redshift table. Recently, the Glue job has been failing with the error: 'S3ServiceException: Access Denied'. The Firehose delivery stream is configured with a prefix and error logging to the same S3 bucket. The Glue job uses the same IAM role that has s3:GetObject and s3:ListBucket permissions on the bucket. What is the most likely cause?

Accepted Answer

The S3 bucket has default encryption enabled with AWS KMS (SSE-KMS), and the Glue job's IAM role lacks kms:Decrypt permission.. Firehose uses SSE-S3 by default unless configured otherwise. If the S3 bucket has default encryption enabled with SSE-KMS, Firehose will use that encryption, but the Glue job's IAM role may lack kms:Decrypt permission for the KMS key. The error 'Access Denied' when reading from S3 often indicates encryption permission issues. Option A is wrong because the Glue job can read from S3 with the current permissions if no encryption is involved. Option B is wrong because the error is about access, not schema. Option C is wrong because the Glue job can use the same role as Firehose, but the role may not have KMS permissions.

Answer

The Glue job expects a different data format than what Firehose writes.

Answer

The Glue job's IAM role does not have s3:GetObjectVersion permission.

Answer

The Glue job is using the wrong IAM role that does not have permissions to the S3 bucket.

Question 9

A company uses Amazon EMR to process large datasets stored in Amazon S3. The data is encrypted at rest using SSE-S3. The security team now requires that all data at rest be encrypted with customer-managed KMS keys (SSE-KMS). The data engineer needs to migrate existing data to use SSE-KMS without downtime. The engineer plans to use S3 Batch Operations to copy objects in place. However, the Batch Operations job fails with a KMS access denied error. The engineer has confirmed that the Batch Operations service role has the necessary KMS permissions. What is the most likely cause?

Accepted Answer

The Batch Operations service role is missing the kms:GenerateDataKey permission for the destination KMS key.. Batch Operations uses a service role that must have kms:Decrypt permission for the source objects and kms:GenerateDataKey for the destination. The source objects are encrypted with SSE-S3, which does not use KMS, so the service role does not need kms:Decrypt for source. However, the error indicates KMS access denied, likely because the service role does not have kms:GenerateDataKey for the destination KMS key. Option A is wrong because the service role is used. Option B is wrong because the source objects are SSE-S3. Option C is wrong because KMS key policy is for the destination key.

Answer

The KMS key policy does not allow the S3 service to use the key.

Answer

The Batch Operations job is using the wrong IAM role.

Answer

The source objects are encrypted with SSE-S3, which cannot be copied to SSE-KMS.

Question 10

A company is using Amazon Kinesis Data Streams to ingest real-time clickstream data from a website. The data is consumed by an Amazon Kinesis Data Analytics for Apache Flink application that performs real-time analytics. The Flink application writes its results to an Amazon S3 bucket. The company has noticed that the Flink application is experiencing high checkpoint failure rates, causing delays. The CloudWatch metrics show that the checkpoint size is large and increasing. The data engineer needs to reduce the checkpoint size. Which action should the data engineer take?

Accepted Answer

Enable incremental checkpointing in the Flink application to only write changes since the last checkpoint.. Enabling incremental checkpointing in Flink reduces the amount of data written per checkpoint by only writing changes since the last checkpoint. Option A is wrong because reducing parallelism may increase load per operator. Option B is wrong because decreasing checkpoint interval increases frequency, not size. Option C is wrong because state TTL does not directly reduce checkpoint size.

Answer

Decrease the checkpoint interval to reduce the amount of state accumulated.

Answer

Reduce the parallelism of the Flink application.

Answer

Increase the state time-to-live (TTL) configuration to retain state longer.

Question 11

A company wants to ingest data from an on-premises Oracle database into Amazon S3 on a daily basis. The data volume is 500 GB per transfer. Which AWS service is most appropriate for this batch ingestion?

Accepted Answer

AWS Glue. AWS Glue is the most appropriate service for this batch ingestion because it is purpose-built for ETL (Extract, Transform, Load) workflows, including connecting to on-premises databases via JDBC, extracting large volumes of data (500 GB per day), and writing it to Amazon S3 in a scheduled, serverless manner. Glue's built-in crawlers and job scheduler handle daily batch runs efficiently without requiring manual infrastructure management, making it ideal for this use case.

Answer

AWS Database Migration Service (DMS)

Answer

AWS Data Pipeline

Answer

Amazon Kinesis Data Firehose

Question 12

A company uses AWS Glue ETL jobs to transform data in S3. The job runs successfully but takes longer than expected. The data is in Parquet format and partitioned by date. Which change would most improve performance without increasing cost?

Accepted Answer

Enable pushdown predicates to filter partitions early.. Pushdown predicates allow AWS Glue to filter data at the storage layer (e.g., S3 partition pruning) before reading it into memory. Since the data is partitioned by date, enabling pushdown predicates reduces the amount of data scanned, which directly decreases job runtime without requiring additional DPUs or changing the data format.

Answer

Repartition the data by a different column.

Answer

Convert Parquet to CSV for faster serialization.

Answer

Increase the number of DPUs for the job.

Question 13

A data engineer needs to store semi-structured JSON logs from an application for up to 30 days, with infrequent access. Which storage solution is the most cost-effective?

Accepted Answer

Amazon S3 Standard-Infrequent Access (S3 Standard-IA). Amazon S3 Standard-Infrequent Access (S3 Standard-IA) is the most cost-effective choice for storing semi-structured JSON logs for up to 30 days with infrequent access. It offers low storage cost (compared to S3 Standard) while providing low-latency retrieval and high durability (99.999999999%) across multiple Availability Zones, making it ideal for data that is accessed less frequently but needs immediate availability when requested.

Answer

Amazon S3 Glacier Deep Archive

Answer

Amazon S3 One Zone-Infrequent Access (S3 One Zone-IA)

Answer

Amazon S3 Standard

Question 14

A company stores its application logs in an Amazon S3 bucket. The logs are accessed frequently for the first 30 days, after which they are rarely accessed but must be retained for 7 years for compliance. The company wants to optimize storage costs while maintaining immediate retrieval availability for the first 30 days and the ability to retrieve logs within 12 hours after that. Which lifecycle policy should the data engineer configure?

Accepted Answer

Transition objects to S3 Standard-IA after 30 days and then to S3 Glacier Deep Archive after 1 year.. It uses S3 Standard-IA for the first 30 days (frequent access, immediate retrieval) and then transitions to S3 Glacier Deep Archive after 1 year, which provides retrieval within 12 hours at the lowest cost for long-term retention. This meets the compliance requirement of 7-year retention while optimizing costs by moving data to progressively cheaper storage classes based on access patterns.

Answer

Delete objects after 30 days to minimize storage costs.

Answer

Transition objects to S3 One Zone-IA after 30 days and delete after 7 years.

Answer

Transition objects to S3 Glacier Flexible Retrieval after 30 days and delete after 7 years.

Question 15

A company uses AWS Glue to run ETL jobs that process data from Amazon S3 and write results to Amazon Redshift. The Glue job uses the JDBC connection to Redshift. Recently, the job has been failing intermittently with the error: 'java.sql.SQLException: [Amazon](500310) Invalid operation: INSERT has more expressions than target columns;' The Glue job writes to a staging table in Redshift before performing a merge into the final table. The staging table schema matches the source data. The error occurs only on some days and affects different columns each time. The data engineer suspects that the source data occasionally contains extra columns due to a schema drift in the upstream data producer. Which approach should the data engineer take to handle this issue robustly?

Accepted Answer

Use a Glue DynamicFrame and apply the resolveChoice method to make the schema consistent.. Glue DynamicFrames can automatically handle schema drift using the `resolveChoice` method, which allows you to specify how to handle columns that appear inconsistently across records (e.g., making them null, casting to a common type, or dropping them). This directly addresses the intermittent error caused by extra columns in the source data without requiring manual schema updates or fragile conditional logic.

Answer

Skip any records that have extra columns by adding a conditional check in the Glue script.

Answer

Manually update the Redshift staging table schema whenever the source data changes.

Answer

Use a Glue DynamicFrame and apply the dropFields method to remove extra columns before writing.