DEA-C01 Practice Test 22 — 15 Questions

Question 1

Refer to the exhibit. A Lambda function named 'IngestionProcessor' is failing. The engineer checks CloudWatch Logs and sees the log group exists but storedBytes is 0. Why might the logs show no data?

Accepted Answer

The Lambda execution role does not have permission to write logs to CloudWatch. The Lambda execution role must have the `logs:CreateLogStream` and `logs:PutLogEvents` permissions to write logs to CloudWatch Logs. If the role lacks these permissions, the log group will be created (if it doesn't exist) but no log events will be written, resulting in `storedBytes` being 0. This is a common misconfiguration when the IAM policy does not include the necessary CloudWatch Logs actions.

Answer

The Lambda function is configured with a dead letter queue

Answer

The Lambda function has not been invoked yet

Answer

The log group is encrypted with a KMS key and the Lambda function lacks decrypt permission

Question 2

A company uses AWS DMS to replicate data from an on-premises Oracle database to Amazon RDS for MySQL. The full load completes successfully, but ongoing replication (CDC) is failing with a 'Failed to add supplemental logging' error. What should the data engineer do to resolve this issue?

Accepted Answer

Enable supplemental logging on the source Oracle database manually.. AWS DMS requires supplemental logging to be enabled on the source Oracle database to capture change data for CDC replication. The 'Failed to add supplemental logging' error occurs because DMS cannot automatically enable this at the database level when the user lacks the necessary privileges (e.g., ALTER DATABASE). The data engineer must manually enable supplemental logging on the source Oracle database, typically by executing ALTER DATABASE ADD SUPPLEMENTAL LOG DATA; and ensuring table-level supplemental logging is also configured.

Answer

Recreate the DMS endpoint for the source database with a new connection.

Answer

Modify the target MySQL database to use a different engine version.

Answer

Increase the task log interval in the DMS task settings.

Question 3

A company is ingesting streaming data from multiple sources using Amazon Kinesis Data Streams. The data is then processed by an AWS Lambda function that transforms the records and writes them to an Amazon S3 bucket. The Lambda function is failing intermittently with timeout errors. The average record size is 5 KB, and the shard count is 2. What is the MOST likely cause of the timeout errors?

Accepted Answer

The Lambda function timeout is set too low for the processing time required.. The Lambda function is timing out, indicating that the configured timeout is insufficient for the actual processing time. Lambda has a default timeout of 3 seconds, but it can be set from 1 second to 15 minutes. If the transformation logic or S3 write operation takes longer than the configured timeout, the function will fail with a timeout error. Option B is incorrect because the Kinesis data retention period (default 24 hours) affects data availability, not Lambda execution time. Option C is incorrect because reserved concurrency controls the number of concurrent invocations and can cause throttling, not timeouts. Option D is incorrect because with an average record size of 5 KB, even the default batch size of 100 records results in only 500 KB per invocation, well below the 6 MB payload limit.

Answer

The Kinesis data retention period is too short, causing data to be lost before processing.

Answer

The Lambda function's reserved concurrency is set too low, causing throttling.

Answer

The Lambda function is receiving too many records per invocation, exceeding the 6 MB payload limit.

Question 4

A company uses Amazon S3 to store raw data and needs to transform it into Parquet format for analytics. The transformation job runs daily on a schedule. Which AWS service is BEST suited for this task?

Accepted Answer

AWS Glue. AWS Glue is a fully managed, serverless ETL service that can automatically convert data formats (e.g., from CSV to Parquet) and run on a schedule (e.g., daily). It is ideal for this use case because it is purpose-built for ETL transformations and handles schema discovery, data cataloging, and job scheduling without managing infrastructure. Option A (Amazon Redshift) is wrong because Redshift is a data warehouse for querying, not a transformation service; it could load Parquet but not convert raw data to Parquet directly. Option B (Amazon EMR) is wrong because EMR requires provisioning and managing clusters, adding operational overhead. Option C (AWS Lambda) is wrong because Lambda has a maximum execution timeout of 15 minutes, which is too short for daily large-scale data transformation jobs.

Answer

Amazon Redshift

Answer

Amazon EMR

Answer

AWS Lambda

Question 5

Refer to the exhibit. A data engineer is troubleshooting an AWS Lambda function that reads from an S3 bucket and writes to a Kinesis Data Stream. The Lambda function fails with an AccessDeniedException when calling the kinesis:PutRecords API. Which change is needed to the IAM policy?

Accepted Answer

Change the resource ARN for Kinesis to include the correct stream name. The Lambda function's IAM policy grants kinesis:PutRecords permission but the resource ARN does not match the target Kinesis Data Stream. The AccessDeniedException occurs because IAM evaluates the resource ARN against the stream's ARN and denies access on mismatch. The correct fix is to change the resource ARN to include the correct stream name (option C). While using a wildcard (option B) would also resolve the error, it is not the recommended approach because it violates the principle of least privilege. Option A is incorrect because the error is from Kinesis, not S3. Option D is incorrect because the kinesis:PutRecords action is already present in the policy.

Answer

Add s3:PutObject permission to the policy

Answer

Change the resource ARN for Kinesis to a wildcard

Answer

Add kinesis:PutRecords permission to the policy

Question 6

A data engineer is designing a data lake on Amazon S3. The data lake will store raw data, transformed data, and curated datasets. The engineer needs to ensure that raw data is immutable (never overwritten or deleted) and that only authorized users can access the transformed data. Which combination of S3 features should the engineer use?

Accepted Answer

Enable S3 Object Lock in compliance mode on the raw data prefix and use bucket policies to restrict access to transformed data prefix.. S3 Object Lock in compliance mode enforces a write-once-read-many (WORM) model, preventing any user—including the root user—from overwriting or deleting raw data. Bucket policies then provide granular access control to restrict the transformed data prefix to authorized users only, meeting both immutability and access control requirements.

Answer

Use S3 Lifecycle policies to archive raw data to S3 Glacier and set bucket policies for transformed data.

Answer

Enable S3 Versioning and use S3 Access Points for each prefix.

Answer

Enable default encryption with SSE-KMS and use S3 bucket policies to restrict access.

Question 7

A data engineer is configuring AWS Glue jobs to access data stored in Amazon S3. The data is encrypted using server-side encryption with AWS KMS (SSE-KMS). The Glue job needs to read and write data to the S3 bucket. Which IAM policy statement should be added to the Glue job's IAM role to allow it to use the KMS key?

Accepted Answer

{"Effect":"Allow","Action":["kms:Decrypt","kms:GenerateDataKey"],"Resource":"*"}. To read and write data encrypted with SSE-KMS, AWS Glue needs both `kms:Decrypt` (to read existing encrypted data) and `kms:GenerateDataKey` (to create a new data key for writing encrypted data). `kms:GenerateDataKey` is required because S3 uses a data key to encrypt objects, and the caller must generate that key via KMS. Option B correctly includes both actions, allowing the Glue job to perform read and write operations on the SSE-KMS encrypted bucket.

Answer

{"Effect":"Allow","Action":["kms:Decrypt"],"Resource":"*"}

Answer

{"Effect":"Allow","Action":["kms:Decrypt","kms:ReEncrypt"],"Resource":"*"}

Answer

{"Effect":"Allow","Action":["kms:Decrypt","kms:Encrypt"],"Resource":"*"}

Question 8

A data engineer is designing a data pipeline that ingests streaming data from an IoT device fleet. The data must be processed in near real-time and stored in Amazon S3 for long-term analytics. Which TWO AWS services should the engineer use together to achieve this?

Accepted Answer

Amazon Kinesis Data Firehose. Amazon Kinesis Data Streams (D) is correct because it provides a highly scalable, low-latency ingestion service for real-time streaming data from thousands of IoT devices, allowing custom consumers to process records in near real-time. Amazon Kinesis Data Firehose (C) is correct because it can consume that stream (or receive data directly) and reliably deliver it in near real-time to Amazon S3 for long-term analytics, handling batching, compression, and format conversion. Together they form the canonical AWS pattern for real-time IoT ingestion plus durable S3 storage. Amazon Athena (A) is only a query service over S3 and does not ingest or process streaming data. AWS Glue (B) is a serverless ETL/catalog service, not a real-time streaming ingestion or delivery mechanism. Amazon SQS (E) is a message queue for decoupling applications, not designed for high-throughput real-time streaming ingestion into S3.

Answer

Amazon Athena

Answer

AWS Glue

Answer

Amazon Simple Queue Service (SQS)

Question 9

Which TWO options are valid ways to reduce storage costs for an Amazon S3 data lake that stores historical data rarely accessed after 30 days? (Choose TWO.)

Accepted Answer

Create a lifecycle policy to transition objects to S3 Standard-IA after 30 days.. S3 Standard-IA (Infrequent Access) is designed for data accessed less frequently but requires rapid access when needed. Transitioning objects to Standard-IA after 30 days reduces storage costs compared to S3 Standard while maintaining low-latency retrieval, making it ideal for a data lake where historical data is rarely accessed after the first month.

Answer

Enable S3 Transfer Acceleration for all uploads.

Answer

Create a lifecycle policy to delete objects after 30 days.

Answer

Enable S3 Versioning to preserve all object versions.

Question 10

A company is migrating an on-premises MongoDB database to Amazon DocumentDB. The data engineer needs to ensure minimal downtime during migration. Which AWS service should be used to facilitate the migration?

Accepted Answer

AWS Database Migration Service (DMS). AWS Database Migration Service (DMS) supports continuous replication from MongoDB to Amazon DocumentDB using change data capture (CDC), enabling near-zero downtime migration. DMS can perform a full load followed by ongoing replication to keep the target synchronized until cutover.

Answer

AWS Glue

Answer

AWS Snowball

Answer

Amazon S3 Transfer Acceleration

Question 11

A company uses AWS Glue ETL jobs to transform data in S3. The job runs successfully but takes longer than expected. The data is in Parquet format and partitioned by date. Which change would most improve performance without increasing cost?

Accepted Answer

Enable pushdown predicates to filter partitions early.. Pushdown predicates allow AWS Glue to filter data at the storage layer (e.g., S3 partition pruning) before reading it into memory. Since the data is partitioned by date, enabling pushdown predicates reduces the amount of data scanned, which directly decreases job runtime without requiring additional DPUs or changing the data format.

Answer

Repartition the data by a different column.

Answer

Convert Parquet to CSV for faster serialization.

Answer

Increase the number of DPUs for the job.

Question 12

A data engineer needs to audit all access to an Amazon S3 bucket containing sensitive data. The audit must capture who accessed the bucket, from which IP address, and what actions were performed. Which AWS service should be enabled?

Accepted Answer

Enable AWS CloudTrail with data events for the S3 bucket.. AWS CloudTrail data events capture object-level API activity on S3 buckets, including the identity of the caller, source IP address, timestamp, and the specific action (GetObject, PutObject, DeleteObject). Enabling data events on the bucket produces an auditable record of who accessed sensitive objects and from where, which is exactly what the requirement demands. Management events alone would only show bucket-level configuration changes, not object reads/writes.

Answer

Enable S3 server access logging for the bucket.

Answer

Use AWS Config to record S3 bucket-level changes.

Answer

Configure Amazon CloudWatch Logs to monitor S3 access.

Question 13

A data engineer needs to grant an IAM role read-only access to Amazon DynamoDB tables in a specific AWS account. Which IAM policy element should be used to restrict access to only the 'GetItem' and 'Query' actions?

Accepted Answer

Action. The Action element in an IAM policy specifies the AWS API operations that the policy allows or denies. To restrict access to only 'GetItem' and 'Query' on DynamoDB tables, you list these actions in the Action element, e.g., 'dynamodb:GetItem' and 'dynamodb:Query'. This directly controls which operations the role can perform, making it the correct choice for limiting permissions to specific actions.

Answer

Resource

Answer

Effect

Answer

Condition

Question 14

A company needs to store JSON documents that are frequently read and written by a web application. The data must be highly available and durable across multiple Availability Zones. Which AWS database service meets these requirements?

Accepted Answer

Amazon DynamoDB. Amazon DynamoDB is a fully managed NoSQL key-value and document database that provides single-digit millisecond performance at any scale. It stores JSON documents natively, supports frequent reads and writes, and offers built-in high availability and durability by automatically replicating data across multiple Availability Zones (AZs) in an AWS Region. This makes it the ideal choice for the described web application workload.

Answer

Amazon RDS for PostgreSQL

Answer

Amazon S3

Answer

Amazon ElastiCache for Redis

Question 15

A data engineer is configuring an S3 bucket to host sensitive data. The security policy requires that all objects be encrypted with a key that is generated and managed by the customer, and that the key be stored in AWS KMS. Which encryption option should be used?

Accepted Answer

Server-Side Encryption with AWS KMS-Managed Keys (SSE-KMS). SSE-KMS allows you to use customer-managed keys stored in AWS KMS, meeting the requirement for customer-generated and managed keys. Option A is incorrect because SSE-S3 uses AWS-managed keys, not customer-managed. Option B is incorrect because client-side encryption encrypts data outside S3, not using S3 server-side encryption. Option C is incorrect because SSE-C uses customer-provided keys that you manage yourself, but they are not stored in AWS KMS—you must provide them with each request.

Answer

Server-Side Encryption with S3-Managed Keys (SSE-S3)

Answer

Client-Side Encryption

Answer

Server-Side Encryption with Customer-Provided Keys (SSE-C)