DEA-C01 Practice Test 23 — 15 Questions

Question 1

A company is ingesting streaming data into Kinesis Data Streams. The consumer application experiences high latency due to a single shard bottleneck. What is the most effective way to reduce latency?

Accepted Answer

Increase the number of shards in the data stream.. Increasing the number of shards in the Kinesis data stream distributes the incoming records across more shards, allowing the consumer application to process them in parallel and reducing the per-shard bottleneck that causes high latency. Each shard supports up to 1 MB/s or 1,000 records/s ingress, so adding shards directly increases throughput capacity. This is the most direct and effective way to address a single-shard bottleneck.

Answer

Wait for automatic scaling to add shards.

Answer

Use the Kinesis Client Library (KCL) to process records.

Answer

Switch to Amazon Kinesis Data Firehose.

Question 2

A data engineer sees this AWS Glue table definition in the Data Catalog. The engineer wants to query this table with Amazon Athena, but the query returns zero rows. What is the MOST likely cause?

Accepted Answer

The data files are not in the specified S3 location.. The most likely cause is that the data files are not in the specified S3 location. When an AWS Glue table is defined in the Data Catalog, Athena reads the table's metadata (including the S3 location) and then attempts to read the underlying data files from that exact path. If the files are missing, misnamed, or in a different prefix, Athena returns zero rows because there is no data to scan. This is a common misconfiguration when the S3 path in the table definition does not match the actual data storage.

Answer

The SerDe library is incorrect for CSV files.

Answer

The table format CSV is not supported by Athena.

Answer

Athena cannot read tables from the Glue Data Catalog.

Question 3

Refer to the exhibit. The S3 bucket policy above is applied to the bucket "example-bucket". An IAM user attempts to upload an object to the bucket without specifying any encryption header. What is the outcome?

Accepted Answer

The upload fails with an Access Denied error. The bucket policy shown requires that any PutObject request include server-side encryption headers (e.g., x-amz-server-side-encryption). Since the IAM user uploads without specifying an encryption header, the condition in the policy is not met, and the request is denied with an Access Denied error. This is the standard behavior of a deny-by-default encryption-enforcement policy.

Answer

The upload succeeds but the object is not encrypted

Answer

The upload fails because GetObject requires encryption

Answer

The object is uploaded successfully with SSE-S3 encryption by default

Question 4

A data engineer reviews the Glue job configuration. The job fails when processing large datasets. The error message indicates out-of-memory in the executors. Which change to the job configuration will most directly address this issue?

Accepted Answer

Change the worker type from Standard to G.2X.. The job fails due to out-of-memory errors in the executors. The current configuration uses 5 Standard workers, each with 16 GB of memory. Changing the worker type to G.2X provides 32 GB per worker, doubling the memory per executor and directly addressing the OOM issue. Increasing the number of workers (option C) adds more executors but does not increase memory per executor, which may not resolve the issue if each executor still runs out of memory. Options B and D do not affect memory.

Answer

Increase the timeout from 30 to 60 minutes.

Answer

Increase the number of workers from 5 to 10.

Answer

Set MaxRetries to 3.

Question 5

A company is using Amazon S3 for data lake storage. They need to query the data directly using SQL without loading it into a database. Which AWS service should be used?

Accepted Answer

Amazon Athena. Amazon Athena is the correct choice because it is a serverless, interactive query service that allows you to analyze data directly in Amazon S3 using standard SQL, without needing to load or transform the data into a database. Athena uses Presto under the hood and supports querying structured, semi-structured, and unstructured data formats (e.g., CSV, JSON, Parquet, ORC) stored in S3, making it ideal for ad-hoc SQL queries on a data lake.

Answer

Amazon Redshift Spectrum

Answer

Amazon EMR

Answer

AWS Glue

Question 6

A company uses AWS Glue to run ETL jobs on data stored in S3. The data is encrypted with SSE-KMS. The Glue job fails with an 'AccessDenied' error when trying to read the data. What is the MOST likely cause?

Accepted Answer

The IAM role used by Glue does not have kms:Decrypt permission on the KMS key.. When S3 data is encrypted with SSE-KMS, any principal reading the object must have both s3:GetObject on the bucket and kms:Decrypt on the KMS key. The Glue job's IAM role is the principal making the read, so if it lacks kms:Decrypt, S3 returns AccessDenied even though the bucket policy may allow access. This is the most common cause of this specific error pattern.

Answer

The S3 bucket policy denies access to the Glue service role.

Answer

The AWS Glue Data Catalog does not have permission to the table.

Answer

The Glue job's connection does not have the necessary permissions.

Question 7

A data engineer is troubleshooting a failed AWS Glue ETL job that reads from an S3 bucket and writes to an Amazon Redshift table. The job fails with a permission error. Which IAM policy addition is MOST likely required for the Glue job's role?

Accepted Answer

Add redshift:GetClusterCredentials. AWS Glue jobs that write to Amazon Redshift using the native Redshift connection (not the Redshift Data API) authenticate by calling redshift:GetClusterCredentials to obtain temporary database credentials for the job role. Without that permission, the Glue connection cannot obtain a username/password and the job fails with an access-denied error even though the S3 read side works.

Answer

Add redshift:DataAPI

Answer

Add redshift:ModifyCluster

Answer

Add redshift:DescribeStatement

Question 8

Refer to the exhibit. A data engineer has configured an S3 event notification to send an event to an SQS queue when objects are created in the 'incoming/' prefix. The engineer wants to trigger an AWS Lambda function to process the object. However, the Lambda function is not being invoked. What is the most likely cause?

Accepted Answer

Lambda is not configured as an event source for the SQS queue.. The Lambda function is not being invoked because the SQS queue is not configured as an event source for Lambda. Even though S3 sends events to SQS, Lambda will only poll and process messages from the queue if an event source mapping (e.g., via CreateEventSourceMapping) is established. Without this mapping, the messages sit in the queue and Lambda remains idle.

Answer

The Lambda function lacks permission to read from the S3 bucket.

Answer

The SQS queue does not exist or is in a different account.

Answer

The S3 event notification filter prefix is incorrect.

Question 9

A data engineer needs to back up an Amazon DynamoDB table daily. The backup must be restorable to a specific point in time within the last 24 hours. Which solution meets these requirements with the LEAST operational overhead?

Accepted Answer

Enable point-in-time recovery (PITR) on the table.. DynamoDB point-in-time recovery (PITR) provides continuous backups of your table data with a restore granularity of one second, allowing you to restore to any point within the last 35 days. It requires no manual intervention, thus offering the least operational overhead. Enabling PITR meets the requirement to restore to a specific point in time within the last 24 hours.

Answer

Create an on-demand backup of the table every 24 hours.

Answer

Use DynamoDB Streams to replicate data to another table.

Answer

Export the table data to Amazon S3 every 6 hours using a Lambda function.

Question 10

A media company stores video files in an S3 bucket. The files are processed by a fleet of EC2 instances that read the files, add watermarks, and write the output back to the same bucket. Recently, the processing jobs have been failing with '500 Internal Server Error' and '503 Slow Down' errors. The data engineer checks the S3 bucket metrics and sees that the PUT/GET request rate is consistently above 5,500 requests per second for a single prefix. The engineer needs to resolve the errors with minimal changes to the application code. Which course of action should the engineer take?

Accepted Answer

Modify the application to add a random hash prefix to the object keys to distribute load across multiple prefixes.. S3 automatically partitions request traffic by key prefix, and each partition supports roughly 3,500 PUT/COPY/POST/DELETE or 5,500 GET/HEAD requests per second. When a single prefix exceeds these limits, S3 returns 503 Slow Down errors. Adding a random hash prefix to object keys distributes the load across many prefixes, each with its own request rate limit, thereby eliminating throttling without changing the core application logic. This is the recommended best practice for high-throughput workloads.

Answer

Use S3 Batch Operations to process the files.

Answer

Increase the number of EC2 instances to process files in parallel.

Answer

Enable S3 Transfer Acceleration on the bucket to improve throughput.

Question 11

Refer to the exhibit. A data engineer runs this AWS CLI command to execute an Athena query. What is the purpose of the EncryptionConfiguration parameter?

Accepted Answer

It encrypts the query results stored in Amazon S3 at rest. The EncryptionConfiguration parameter in Athena specifies how the query results stored in S3 are encrypted at rest. SSE_S3 means server-side encryption with S3-managed keys. It does not encrypt the query itself, data in transit, or the source data.

Answer

It encrypts the query string in transit

Answer

It encrypts the data in the source table

Answer

It enables client-side encryption for the query output

Question 12

Refer to the exhibit. A data engineer applies this S3 bucket policy to an S3 bucket. What is the effect of this policy?

Accepted Answer

Allows only HTTPS requests to get and put objects, and denies HTTP requests.. The bucket policy allows GetObject and PutObject actions only when the request uses HTTPS, and explicitly denies all S3 actions when the request uses HTTP due to the condition `aws:SecureTransport=false`. Therefore, only HTTPS requests for Get and Put are permitted. Option A is incorrect because the policy does not restrict by IP addresses. Option C is incorrect because both Get and Put are allowed over HTTPS, not just Get. Option D is incorrect because the policy does not grant anonymous access; it requires secure transport and does not allow HTTP.

Answer

Allows access only from specific IP addresses.

Answer

Allows only GetObject actions over HTTPS.

Answer

Allows anonymous access to get and put objects over HTTP.

Question 13

A data engineer is using Amazon Kinesis Data Firehose to deliver streaming data to an S3 bucket. The data is delivered in 5-minute intervals. However, the engineer notices that the data in S3 is often delayed by up to 30 minutes. Which configuration change would most likely reduce the delay?

Accepted Answer

Decrease the 'Buffer interval' from 300 seconds to 60 seconds.. The buffer interval determines the maximum time Firehose will wait before delivering data, regardless of buffer size. Decreasing it from 300 to 60 seconds forces more frequent deliveries, reducing the delay. Option B (compression) reduces data size, which could slow buffer filling and potentially increase delay if the buffer size trigger is not met. Option C (increasing buffer size) would cause Firehose to wait longer for the buffer to fill, increasing delay. Option D (dynamic partitioning) affects data organization, not delivery frequency, so it does not reduce delay.

Answer

Enable compression (GZIP) on the Firehose delivery stream.

Answer

Increase the 'Buffer size' from 5 MB to 50 MB.

Answer

Enable 'Dynamic partitioning' on the Firehose stream.

Question 14

A data engineering team uses Amazon S3 to store raw data files. They have an AWS Glue ETL job that reads from an S3 bucket, transforms the data, and writes to a Redshift cluster. The job runs daily and has been failing intermittently with the error: 'An error occurred while calling o143.pyWriteDynamicFrame. S3 Access Denied'. The team has confirmed that the IAM role used by the Glue job has s3:GetObject and s3:PutObject permissions on the bucket and all objects. The Redshift cluster is in the same VPC and the Glue connection is configured correctly. What is the most likely cause of the failure?

Accepted Answer

The Glue job's IAM role lacks permission to write to the Glue temporary file bucket (aws-glue-*).. AWS Glue writes intermediate data to a temporary S3 bucket (aws-glue-* in the same region) before loading into Redshift. Even though the job has S3 permissions on the source bucket, the IAM role must also have s3:GetObject, s3:PutObject, and s3:DeleteObject on the Glue temporary bucket. The 'S3 Access Denied' error during pyWriteDynamicFrame indicates the write to this temp bucket is failing.

Answer

The Redshift cluster is not publicly accessible and the Glue job does not have a VPC endpoint to Redshift.

Answer

The Glue job has exceeded the maximum execution time and is being killed by AWS.

Answer

The Glue job is using the wrong JDBC driver version for Redshift.

Question 15

A data engineer is using Amazon EMR to process large datasets. The cluster uses a mix of Spot Instances and On-Demand Instances. The engineer wants to reduce costs while ensuring the job can complete even if Spot Instances are reclaimed. Which TWO actions should the engineer take? (Choose two.)

Accepted Answer

Enable Instance Fleets to use multiple instance types for Spot Instances.. Option A is correct because EMR Instance Fleets let you specify multiple instance types and subnets for Spot capacity, so if one Spot pool is reclaimed or unavailable, EMR can provision from another pool, improving the chance the job finishes despite Spot interruptions. Option E is correct because task nodes perform only data-processing work and hold no HDFS data, so placing them in a Spot-based task instance group lets you capture Spot savings while core nodes (which store HDFS data) remain protected and the job can still complete if task Spot capacity is reclaimed. Option B is wrong because using only On-Demand Instances eliminates Spot savings and does not address cost reduction. Option C is wrong because core nodes hold HDFS data; using Spot for core nodes risks data loss and job failure when Spot capacity is reclaimed. Option D is wrong because termination protection only prevents accidental cluster termination and does not help the job survive Spot reclamation or reduce costs.

Answer

Use only On-Demand Instances for all nodes.

Answer

Use Spot Instances for core nodes to reduce cost.

Answer

Enable termination protection for the cluster.