DEA-C01 Practice Test 2 — 25 Questions

Question 1

Refer to the exhibit. A data engineer runs the above CLI command to find files smaller than 1000 bytes in a bucket. The command returns an empty array, but the engineer knows there are small files. What is the issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The Size is compared as a string, not an integer; remove quotes around '1000'.. In the AWS CLI `list-objects-v2` command with `--query`, the `Size` field is a numeric value, but the query string `Size < '1000'` compares it as a string. This causes a lexicographic comparison, so files with sizes like '900' would be correctly matched, but any size with more digits (e.g., '1000' itself or '999') may fail due to string ordering. Removing the quotes around `1000` treats it as an integer, enabling proper numeric comparison.

Answer

The prefix is incorrect; it should be 'logs/2023/01/01/'.

Answer

The bucket policy does not allow listing objects.

Answer

The query syntax is invalid; use a filter instead.

Question 2

A company runs a time-series forecasting model that writes results to an S3 bucket every 5 minutes. A downstream ETL job reads this data, but sometimes fails because it encounters incomplete files (zero bytes). What is the MOST reliable way to ensure the ETL job only processes complete files?

Accepted Answer

Use S3 Event Notifications to trigger a Lambda function that checks file size and then moves the file to a 'ready' prefix.. S3 Event Notifications can trigger a Lambda function upon object creation, which can check the file size (e.g., > zero bytes) and then copy the file to a 'ready' prefix, ensuring the ETL job only processes complete files. Option A is wrong because an S3 Lifecycle policy can delete small files but does not prevent the ETL from reading incomplete files. Option B is wrong because S3 Copy does not verify completeness. Option C is wrong because S3 Select still reads the file even if it is incomplete; it doesn't guarantee completeness.

Answer

Set an S3 Lifecycle policy to delete files smaller than 1 MB.

Answer

Use S3 Copy to move files to a 'processed' folder after the ETL job reads them.

Answer

Configure S3 Select to query the files and only return rows if the file is complete.

Question 3

Which TWO actions should a data engineer take to optimize Amazon S3 query performance for Amazon Athena when dealing with large Parquet files? (Choose 2.)

Accepted Answer

Optimize file sizes to be around 64 MB to 256 MB. Option D is correct because Athena's performance degrades with very large Parquet files since a single file can only be read by one split; targeting roughly 64 MB to 256 MB per file allows Athena's split-based parallel reads to distribute work across more nodes. Option E is correct because partitioning data by frequently filtered columns (e.g., date, region) enables partition pruning, so Athena scans only the relevant S3 prefixes instead of the entire dataset, drastically reducing bytes scanned and query time. Option A is wrong because a single large unpartitioned file forces full-table scans and prevents parallelism. Option B is wrong because Parquet already uses columnar compression internally, and GZIP is not splittable, which can actually hurt parallelism for large files. Option C is wrong because splitting into many tiny files creates excessive per-file overhead (metadata, open/close costs) and degrades Athena performance rather than improving it.

Answer

Store data in a single large file without partitioning

Answer

Use GZIP compression on the Parquet files

Answer

Split large files into many small files

Question 4

A data engineer is designing a real-time streaming pipeline to ingest clickstream data from a website into Amazon S3. The data must be transformed before storage. Which TWO AWS services can be used together to build this pipeline? (Choose TWO.)

Accepted Answer

Amazon Kinesis Data Firehose. The correct combination is Amazon Kinesis Data Streams to ingest the streaming clickstream data, and Amazon Kinesis Data Firehose to read from the stream, perform transformations (e.g., via Lambda), and deliver the transformed data to Amazon S3. Kinesis Data Streams provides the durable ingestion layer, while Kinesis Data Firehose handles the delivery and transformation without managing servers.

Answer

AWS Glue

Answer

Amazon S3 Transfer Acceleration

Answer

AWS Database Migration Service (DMS)

Question 5

Which TWO AWS services can be used to ingest streaming data into Amazon S3? (Choose two.)

Accepted Answer

Amazon Managed Streaming for Apache Kafka (Amazon MSK). Amazon Kinesis Data Firehose is the easiest way to reliably load streaming data into Amazon S3. It can capture, transform, and deliver streaming data to S3 destinations in near real-time with no code required. Amazon MSK (Managed Streaming for Apache Kafka) can also ingest streaming data into S3 by using Kafka Connect with an S3 sink connector, which writes data from Kafka topics directly to S3.

Answer

Amazon S3 Transfer Acceleration

Answer

Amazon Elastic Block Store (Amazon EBS)

Answer

AWS Snowball

Question 6

A company uses AWS Glue ETL jobs to transform data from Amazon S3 to Amazon Redshift. The job reads JSON files, applies schema mapping, and writes to a Redshift table. Recently, the job started failing with memory errors. The data volume has increased tenfold. Which approach should a data engineer take to resolve this issue with minimal code changes?

Accepted Answer

Increase the number of DPUs allocated to the Glue job.. Increasing the number of DPUs (Data Processing Units) allocated to the AWS Glue job directly addresses the memory constraint caused by a tenfold increase in data volume. Glue ETL jobs run on Apache Spark, which distributes data processing across executors; more DPUs provide more memory and compute capacity, allowing the job to handle larger datasets without code changes.

Answer

Switch from Spark to Python Shell job type.

Answer

Implement batch processing with smaller file sizes.

Answer

Use Redshift Spectrum to query data directly from S3.

Question 7

A company is building a data lake on AWS and must encrypt data at rest. Which services can provide server-side encryption for data stored in Amazon S3? (Choose TWO.)

Accepted Answer

SSE-S3. SSE-S3 (Option A) is correct because Amazon S3 server-side encryption with S3-managed keys (AES-256) encrypts objects at rest automatically, with AWS managing the key material and rotation. SSE-KMS (Option E) is also correct because it performs server-side encryption at rest using AWS KMS customer master keys (CMKs), giving you control over key policies, auditing, and rotation. Both are S3 server-side encryption modes applied after data reaches S3, satisfying the data-at-rest requirement. SSL/TLS (Option B) is wrong because it only encrypts data in transit between the client and S3, not at rest. AWS SDK client-side encryption (Option C) is wrong because it encrypts data before it is sent to S3, so it is client-side, not server-side. AWS CloudHSM (Option D) is wrong because it is a dedicated hardware security module service for key storage and cryptographic operations, not an S3 server-side encryption option by itself.

Answer

SSL/TLS

Answer

AWS SDK client-side encryption

Answer

AWS CloudHSM

Question 8

A CloudFormation template includes this IAM policy for a cross-account S3 upload use case. What is the purpose of the condition?

Accepted Answer

To ensure that uploaded objects grant full control to the bucket owner.. The condition in the IAM policy uses the `s3:x-amz-acl` key with a value of `bucket-owner-full-control`. This ensures that any object uploaded to the S3 bucket explicitly grants the bucket owner full control over the object, overriding the default behavior where the uploading account retains ownership. This is critical in cross-account uploads to prevent the uploading account from retaining exclusive access to the objects.

Answer

To enforce server-side encryption with KMS.

Answer

To limit the size of objects that can be uploaded.

Answer

To restrict uploads to only a specific AWS account.

Question 9

A company uses Amazon Redshift for data warehousing. The security team requires that all data loading into Redshift be encrypted in transit. Which configuration ensures this requirement is met?

Accepted Answer

Configure the Redshift cluster to require SSL connections. Configuring the Redshift cluster to require SSL connections (require_ssl = true in the parameter group) enforces TLS for all client connections, ensuring data is encrypted in transit during loads. This is the direct configuration that satisfies the in-transit encryption requirement.

Answer

Use a VPC security group to restrict access

Answer

Use client-side encryption before loading data

Answer

Enable server-side encryption on the Redshift cluster

Question 10

A data engineer is troubleshooting an access denied error when an AWS Lambda function tries to decrypt an object encrypted with the KMS key 'abc123'. The Lambda function's execution role has the above policy attached. What is the likely cause of the error?

Accepted Answer

The KMS key policy does not grant the Lambda role decrypt permission. The error occurs because KMS requires both the IAM policy and the key policy to grant the necessary permissions. While the IAM policy attached to the Lambda execution role includes kms:Decrypt, the KMS key policy for 'abc123' does not explicitly grant the Lambda role permission to call kms:Decrypt. Since KMS key policies act as a resource-based policy, they must allow the principal (the Lambda role) to perform the action; otherwise, the request is denied even if the IAM policy allows it.

Answer

The Deny statement blocks all decrypt requests

Answer

The Lambda function does not have permission to call kms:GenerateDataKey

Answer

The IAM policy does not include kms:Decrypt permission

Question 11

A data engineer uses AWS Glue to process data from S3. The Glue job frequently fails with 'Out of Memory' errors. The job reads several large compressed files. What is the MOST effective way to resolve this issue without changing the code?

Accepted Answer

Increase the number of G.1X workers or use G.2X workers. Increasing the number of G.1X workers or switching to G.2X workers directly addresses the 'Out of Memory' errors by allocating more memory per Spark executor. G.1X provides 16 GB of memory per worker, while G.2X provides 32 GB, which is critical when processing large compressed files because decompression and transformation require additional heap space. This approach resolves the issue without modifying the job code, as it only changes the resource configuration.

Answer

Convert the compressed files to uncompressed format before processing

Answer

Repartition the data to fewer partitions

Answer

Increase the job timeout setting

Question 12

A data engineer is building a data ingestion pipeline using AWS Glue. The source is an Amazon DynamoDB table, and the target is an Amazon S3 data lake in Parquet format. The pipeline must handle large volumes and ensure exactly-once processing. Which THREE features should the engineer use together to achieve this? (Choose THREE.)

Accepted Answer

Configure the Glue job to convert data to Parquet format.. Converting data to Parquet format is a core requirement for an S3 data lake, as Parquet offers columnar storage, compression, and efficient querying via services like Amazon Athena and Amazon Redshift Spectrum. AWS Glue natively supports Parquet as an output format, enabling the engineer to specify it in the job's output schema or transformation logic.

Answer

Use Amazon Kinesis Data Streams to capture DynamoDB Streams changes.

Answer

Use Amazon S3 Object Lambda to transform data on the fly.

Question 13

A company wants to enforce that all data in an S3 bucket is encrypted at rest using AWS KMS. Which bucket policy condition key should be used?

Accepted Answer

s3:x-amz-server-side-encryption with value aws:kms. The condition key `s3:x-amz-server-side-encryption` with value `aws:kms` enforces that objects uploaded to the S3 bucket must be encrypted using AWS KMS (SSE-KMS). This bucket policy condition ensures that any PUT request includes the `x-amz-server-side-encryption` header set to `aws:kms`, thereby enforcing encryption at rest with KMS-managed keys.

Answer

s3:x-amz-acl with value bucket-owner-full-control

Answer

s3:x-amz-server-side-encryption with value AES256

Answer

aws:SourceIp with value 10.0.0.0/8

Question 14

A company runs an AWS Glue ETL job that reads data from Amazon S3, transforms it, and writes back to S3 in a different partition structure. The job uses the 'spark.sql.shuffle.partitions' option set to 200. After the job completes, the output has many small files. The data engineer wants to minimize the number of output files while maintaining job performance. Which action should the engineer take?

Accepted Answer

Use 'coalesce(n)' with n based on target file size (e.g., 128 MB) before writing.. 'coalesce(n)' reduces the number of partitions without triggering a full shuffle, allowing you to control the number of output files based on a target file size (e.g., 128 MB). This minimizes small files while preserving job performance, as coalesce is a narrow transformation that avoids the overhead of a shuffle. In contrast, 'repartition(n)' would cause a full shuffle, degrading performance.

Answer

Enable S3 multipart upload for the Glue job.

Answer

Increase the 'spark.sql.shuffle.partitions' to 500.

Answer

Reduce the 'spark.sql.shuffle.partitions' to 50.

Question 15

A company uses AWS Glue to run ETL jobs that process data from Amazon S3 and load into Amazon Redshift. The jobs have recently started failing with 'Out of Memory' errors. The data volume has increased 3x in the past month. Which is the MOST effective solution to resolve this issue without redesigning the job?

Accepted Answer

Increase the number of Glue workers (DPUs) for the job.. Glue ETL jobs run on a Spark cluster sized by the number of DPUs (workers). Out-of-memory errors during a 3x data volume increase indicate the existing worker count cannot hold the partitions and shuffle data in memory. Increasing the number of Glue workers adds executor memory and parallelism, which is the most direct fix without redesigning the job.

Answer

Use Amazon Athena instead of Glue for the transformation.

Answer

Rewrite the job to use Spark SQL instead of PySpark.

Answer

Increase the number of partitions in the input S3 data.

Question 16

A company is migrating its on-premises Oracle database to Amazon Aurora PostgreSQL. The migration must have minimal downtime. The source database is 2 TB and runs on a single server. Which AWS service should be used for the migration?

Accepted Answer

AWS Database Migration Service (DMS). AWS Database Migration Service (DMS) is the correct choice because it supports homogeneous migrations from Oracle to Amazon Aurora PostgreSQL with minimal downtime using ongoing replication (change data capture). DMS can handle a 2 TB source database by performing a full load followed by continuous replication of changes from the Oracle redo logs, allowing the target Aurora database to stay nearly in sync until cutover.

Answer

AWS DataSync

Answer

Amazon S3 Transfer Acceleration

Answer

AWS Snowball Edge

Question 17

A company uses AWS Glue to process streaming data from Amazon Kinesis Data Streams. The data is JSON formatted and includes a timestamp field. The company wants to partition the output in Amazon S3 by date and hour, and ensure exactly-once processing semantics. Which combination of configurations should be used?

Accepted Answer

Enable checkpointing in the AWS Glue streaming job and specify an S3 location for checkpoint data.. AWS Glue streaming jobs require checkpointing to track the progress of data consumption from Kinesis Data Streams and to ensure exactly-once processing semantics. By enabling checkpointing and specifying an S3 location, Glue periodically saves the state of processed records, allowing it to resume from the last committed offset in case of failures, thus preventing duplicates or data loss.

Answer

Disable checkpointing and use the 'exactly_once' delivery option in Kinesis Data Streams.

Answer

Use Amazon DynamoDB as a checkpoint store by configuring the Glue job with a DynamoDB connection.

Answer

Use Kinesis Client Library (KCL) checkpointing with a DynamoDB table.

Question 18

A company needs to migrate an on-premises 10 TB PostgreSQL database to Amazon RDS for PostgreSQL with minimal downtime. Which AWS service should be used for the migration?

Accepted Answer

AWS Database Migration Service (DMS). AWS Database Migration Service (DMS) is the correct choice because it is specifically designed for migrating databases to AWS with minimal downtime. It supports continuous replication from an on-premises PostgreSQL source to Amazon RDS for PostgreSQL using change data capture (CDC), allowing the source database to remain operational during the migration.

Answer

AWS Storage Gateway

Answer

AWS Snowball Edge

Answer

AWS DataSync

Question 19

A company uses AWS DMS to migrate an on-premises PostgreSQL database to Amazon RDS for PostgreSQL. After initial load, ongoing replication is set up. The replication task shows 'Task status: failed with error: The specified LSN is not available in the source database logs.' What is the most likely cause?

Accepted Answer

The source database's WAL retention period is too short, and required logs have been purged.. The error 'The specified LSN is not available in the source database logs' indicates that AWS DMS is trying to read a Write-Ahead Log (WAL) position that has already been purged. PostgreSQL sources require sufficient WAL retention to allow DMS to catch up during ongoing replication (CDC). If the WAL segments are recycled or removed before DMS reads them, the replication task fails with this specific LSN error.

Answer

DMS does not support PostgreSQL as a source for ongoing replication.

Answer

The source database's network security group blocks outbound traffic to DMS.

Answer

The full load was incomplete, preventing CDC from starting.

Question 20

A data engineer is troubleshooting a failed AWS Glue Crawler. The crawler logs show 'Insufficient permissions to access S3 bucket'. What should the engineer do to resolve this?

Accepted Answer

Update the IAM role used by the crawler to include S3 read permissions. The AWS Glue Crawler uses an IAM role to access data sources. The error 'Insufficient permissions to access S3 bucket' indicates that the IAM role attached to the crawler lacks the necessary S3 read permissions (e.g., s3:GetObject, s3:ListBucket). Updating the IAM role's policy to include these permissions resolves the issue, as the crawler operates under that role, not under a specific IAM user.

Answer

Grant the crawler's IAM user access to the bucket

Answer

Attach a VPC endpoint to the S3 bucket

Answer

Enable S3 default encryption on the bucket