DEA-C01 Practice Test 25 — 15 Questions

Question 1

A data engineer is designing a data lake on Amazon S3. Data is ingested from multiple sources in JSON format. The engineer needs to optimize query performance for Amazon Athena while minimizing storage costs. Which storage strategy should the engineer use?

Accepted Answer

Convert data to Parquet format and partition by date.. Parquet is a columnar format that reduces storage size and improves query performance in Athena. Partitioning by date further optimizes queries that filter by date. Option B is correct. Option A: storing as raw JSON with no partitioning leads to higher costs and slower queries. Option C: using Glacier for hot data adds retrieval latency and is not suitable for frequent queries. Option D: storing in a single bucket with no structure causes full scans.

Answer

Store data as CSV files in a single S3 bucket without prefixes.

Answer

Store data as JSON files in a single prefix without partitioning.

Answer

Store compressed JSON files in Amazon S3 Glacier.

Question 2

A company stores its application logs in an Amazon S3 bucket. The logs are accessed frequently for the first 30 days, after which they are rarely accessed but must be retained for 7 years for compliance. The company wants to optimize storage costs while maintaining immediate retrieval availability for the first 30 days and the ability to retrieve logs within 12 hours after that. Which lifecycle policy should the data engineer configure?

Accepted Answer

Transition objects to S3 Standard-IA after 30 days and then to S3 Glacier Deep Archive after 1 year.. Option B is correct because S3 Standard-IA is for infrequently accessed data but with immediate retrieval; after 30 days, transition to S3 Glacier Deep Archive for long-term retention with retrieval within 12 hours. Option A is incorrect because S3 One Zone-IA is not durable enough for compliance. Option C is incorrect because S3 Glacier Flexible Retrieval has retrieval times of minutes to hours, not up to 12 hours; Deep Archive is cheaper. Option D is incorrect because deleting after 30 days violates retention requirement.

Answer

Delete objects after 30 days to minimize storage costs.

Answer

Transition objects to S3 One Zone-IA after 30 days and delete after 7 years.

Answer

Transition objects to S3 Glacier Flexible Retrieval after 30 days and delete after 7 years.

Question 3

A company stores sensitive customer data in an Amazon S3 bucket. The security team requires that all data be encrypted at rest using a key that is automatically rotated every year. Which encryption solution should the data engineer use?

Accepted Answer

SSE-KMS with a customer managed key. SSE-KMS with a customer managed CMK allows automatic annual key rotation (when enabled). Option C is correct. Option A: SSE-S3 uses S3-managed keys, rotation is not customer-controlled. Option B: SSE-C requires customer-provided keys, rotation is manual. Option D: client-side encryption does not use AWS KMS for key rotation.

Answer

SSE-S3

Answer

SSE-C

Answer

Client-side encryption

Question 4

A company runs a production Amazon RDS for MySQL database with Multi-AZ deployment. The database experiences high read latency during peak hours. The company wants to improve read performance with minimal application changes. Which solution should a data engineer recommend?

Accepted Answer

Create one or more read replicas in a different Availability Zone.. Option B is correct because creating a read replica reduces load on the primary instance and improves read performance; Multi-AZ handles failover but does not offload reads. Option A is wrong because Multi-AZ does not offload reads. Option C is wrong because increasing instance size may help but is more expensive and may require downtime. Option D is wrong because DynamoDB Accelerator (DAX) is for DynamoDB, not RDS.

Answer

Use Amazon DynamoDB Accelerator (DAX) as a caching layer.

Answer

Increase the DB instance size to a larger instance class.

Answer

Enable Multi-AZ on the existing instance.

Question 5

A company is migrating an on-premises MySQL database to Amazon RDS for MySQL. The database is 500 GB in size. The migration must have minimal downtime and must be completed within a week. Which AWS service should the data engineer use to perform the migration?

Accepted Answer

AWS Database Migration Service (DMS).. Option A is correct because AWS Database Migration Service (DMS) supports minimal downtime migration with ongoing replication from on-premises to RDS. Option B is incorrect because S3 is object storage, not for database migration. Option C is incorrect because Snowball is for large data transfer but involves shipping and is not suitable for minimal downtime. Option D is incorrect because DataSync is for file storage, not databases.

Answer

Amazon S3 Transfer Acceleration.

Answer

AWS Snowball Edge.

Answer

AWS DataSync.

Question 6

A company is using Amazon S3 as a data lake. Data is ingested hourly from multiple sources. The data engineer needs to ensure that once an object is written to S3, it cannot be overwritten or deleted for 30 days. Which S3 feature should be used?

Accepted Answer

Enable S3 Object Lock with a retention period of 30 days.. Option B is correct because S3 Object Lock with retention mode prevents overwrites and deletes. Option A is wrong because it only prevents accidental deletion. Option C is wrong because it only protects against delete, not overwrite. Option D is wrong because it manages lifecycle, not immutability.

Answer

Use S3 Lifecycle policies to transition objects to Glacier after 30 days.

Answer

Enable S3 Versioning and MFA Delete.

Answer

Configure a bucket policy that denies s3:DeleteObject for all principals.

Question 7

Refer to the exhibit. A data engineer is troubleshooting an IAM policy attached to a user. The user reports that they cannot upload objects to the S3 bucket 'data-lake-bucket' unless they explicitly specify the 'x-amz-server-side-encryption' header with value 'AES256'. The engineer wants to modify the policy to allow uploads without requiring encryption headers, but still enforce encryption on the bucket itself. Which change should the engineer make?

Accepted Answer

Remove the entire Deny statement.. Option B is correct. The Deny statement with condition StringNotEquals requires encryption header to be exactly AES256; removing the Deny statement allows uploads without encryption header, and bucket policy can enforce encryption. Option A is wrong because removing the condition from Allow still requires encryption header due to Deny. Option C is wrong because setting default encryption on bucket does not override explicit Deny. Option D is wrong because changing to aws:kms still requires encryption header.

Answer

Remove the Condition block from the Allow statement.

Answer

Change the Condition in the Allow statement to use aws:kms instead of AES256.

Answer

Set the bucket's default encryption to AES256 and keep the policy unchanged.

Question 8

A data engineer is designing a data store for a real-time analytics application that requires sub-millisecond read and write latency for time-series data. The data volume is expected to grow to hundreds of terabytes. Which TWO AWS services should the engineer consider? (Choose TWO.)

Accepted Answer

Amazon DynamoDB with Time-to-Live (TTL). Options A and D are correct. Amazon Timestream is a time-series database with fast query performance; Amazon DynamoDB with TTL can handle time-series data, but for sub-millisecond latency, DynamoDB is suitable. Option B (Redshift) is for analytics, not sub-millisecond; Option C (RDS) is relational and slower for time-series; Option E (ElastiCache) is in-memory but limited by memory size for hundreds of terabytes.

Answer

Amazon Redshift

Answer

Amazon ElastiCache for Redis

Answer

Amazon RDS for PostgreSQL

Question 9

A company stores sensitive data in an Amazon S3 bucket. A compliance requirement mandates that all data must be encrypted at rest with a key that is automatically rotated every year. The company also needs to maintain an audit trail of who used the key. Which solution meets these requirements?

Accepted Answer

Use AWS KMS customer managed keys (SSE-KMS) with automatic key rotation enabled.. Option C is correct because SSE-KMS uses AWS KMS customer managed keys which support automatic annual rotation and provide CloudTrail audit logs for key usage. Option A is wrong because SSE-S3 does not provide key usage audit trail. Option B is wrong because SSE-C requires customer to manage keys and rotation. Option D is wrong because bucket policies do not encrypt data.

Answer

Use customer-provided encryption keys (SSE-C) and rotate keys manually.

Answer

Use S3 managed keys (SSE-S3) and enable S3 server access logs.

Answer

Configure a bucket policy to enforce encryption using the 'aws:SecureTransport' condition.

Question 10

A data engineer is designing a data lake on Amazon S3 that will store sensitive financial data. The engineer needs to implement encryption at rest and ensure that only authorized users can access the data. Which TWO actions should the engineer take to meet these requirements? (Choose TWO.)

Accepted Answer

Configure a bucket policy that denies writes if the object is not encrypted.. Option A is correct because S3 bucket policies can be used to enforce encryption and control access. Option C is correct because IAM policies define user permissions. Option B is incorrect because SSE-C is not recommended as it requires managing your own keys. Option D is incorrect because S3 Transfer Acceleration is for speed, not security. Option E is incorrect because ACLs are legacy and not recommended for access control.

Answer

Use server-side encryption with customer-provided keys (SSE-C).

Answer

Enable S3 Transfer Acceleration for the bucket.

Answer

Enable object-level access control lists (ACLs).

Question 11

A data engineer is designing a data lake on Amazon S3. The data lake will store raw data, transformed data, and curated datasets. The engineer needs to ensure that raw data is immutable (never overwritten or deleted) and that only authorized users can access the transformed data. Which combination of S3 features should the engineer use?

Accepted Answer

Enable S3 Object Lock in compliance mode on the raw data prefix and use bucket policies to restrict access to transformed data prefix.. Option B is correct. S3 Object Lock prevents objects from being deleted or overwritten; S3 bucket policies control access to specific prefixes. Option A is wrong because versioning alone does not prevent deletion; delete markers can be placed. Option C is wrong because lifecycle policies can delete objects. Option D is wrong because SSE-KMS encrypts data but does not prevent deletion.

Answer

Use S3 Lifecycle policies to archive raw data to S3 Glacier and set bucket policies for transformed data.

Answer

Enable S3 Versioning and use S3 Access Points for each prefix.

Answer

Enable default encryption with SSE-KMS and use S3 bucket policies to restrict access.

Question 12

A company has an S3 bucket with versioning enabled that stores critical data. The security team requires that once an object is deleted, it cannot be recovered by anyone, including the root user. Additionally, the company wants to ensure that objects cannot be overwritten for a specified period. Which THREE actions should the data engineer take to meet these requirements? (Choose THREE.)

Accepted Answer

Enable S3 Object Lock in compliance mode.. Options A, B, and D are correct. S3 Object Lock in compliance mode prevents any user from deleting or overwriting objects; enabling versioning is required for Object Lock; a retention period enforces the protection for a specified time. Option C is wrong because MFA Delete can be bypassed by root; Option E is wrong because lifecycle policies can delete objects, which is not allowed.

Answer

Enable MFA Delete on the bucket.

Answer

Configure a lifecycle policy to expire noncurrent versions after 1 day.

Question 13

Refer to the exhibit. A data engineer is analyzing a query performance issue on an Amazon Redshift table. The table 'sales' has 100 million rows. The query is performing a full table scan. Which optimization should the engineer apply to improve query performance?

Accepted Answer

Use a compound sort key on (sale_date, region).. Option D is correct. The query filters on sale_date and aggregates by region. A compound sort key starting with sale_date enables Redshift to skip blocks that don't match the date range, reducing scan. Option A is wrong because DISTKEY product_id is fine for joins but not for this query. Option B is wrong because DISTSTYLE ALL would replicate data, increasing storage and not improving scan. Option C is wrong because interleaved sort key can be less efficient for range-restricted queries.

Answer

Change DISTKEY to region.

Answer

Use an interleaved sort key on (sale_date, region).

Answer

Change DISTSTYLE to ALL.

Question 14

A data engineer is designing a data lake on Amazon S3 for a healthcare organization that must comply with HIPAA regulations. The data includes protected health information (PHI) and must be encrypted at rest. The organization requires that all encryption keys be managed by AWS and rotated automatically every year. Additionally, the data must be replicated to another AWS Region for disaster recovery. Which combination of S3 features should the engineer use to meet these requirements?

Accepted Answer

Use SSE-S3 with S3 Cross-Region Replication (CRR).. Option C is correct because SSE-S3 uses AWS-managed keys that are automatically rotated, and S3 Cross-Region Replication (CRR) replicates objects to another region. Option A is incorrect because SSE-KMS uses customer-managed keys, not AWS-managed keys. Option B is incorrect because S3 Same-Region Replication does not replicate to another region. Option D is incorrect because SSE-C uses customer-provided keys, not AWS-managed.

Answer

Use SSE-S3 with S3 Same-Region Replication (SRR).

Answer

Use SSE-KMS with S3 Cross-Region Replication (CRR).

Answer

Use SSE-C with S3 Cross-Region Replication (CRR).

Question 15

A company uses Amazon S3 to store log files that are generated every hour. Each log file is about 1 GB. The logs must be stored for 5 years for compliance. The data engineer wants to minimize storage costs while ensuring that logs can be retrieved within 24 hours for the first year, and within 48 hours thereafter. Which THREE lifecycle actions should the engineer configure? (Choose THREE.)

Accepted Answer

Transition objects to S3 Glacier Deep Archive after 1 year.. Option B is correct because Standard-IA is suitable for infrequently accessed data with immediate retrieval. Option C is correct because Glacier Deep Archive provides low-cost storage with retrieval within 12 hours. Option D is correct because Deep Archive retrieval within 48 hours meets the requirement. Option A is incorrect because Standard is not cost-effective for long-term. Option E is incorrect because deletion before 5 years violates compliance.

Answer

Transition objects to S3 Standard after 30 days.

Answer

Delete objects after 2 years to reduce storage costs.