DEA-C01 Practice Test 2 — 25 Questions

Question 1

Match each AWS security service to its purpose in data protection.

Accepted Answer

AWS KMS: Manage encryption keys for data at rest and in transit. The correct matches are: AWS KMS for encryption key management, AWS IAM for access control, and AWS CloudTrail for API auditing. Common confusions include swapping these services' purposes.

Answer

AWS KMS: Control access to AWS resources through users, groups, and roles

Answer

AWS IAM: Manage encryption keys for data at rest and in transit

Answer

AWS CloudTrail: Manage encryption keys for data at rest and in transit

Question 2

A data engineer is troubleshooting a failed AWS Glue ETL job that reads from and writes to the S3 bucket 'example-bucket'. The job's IAM role has the policy shown in the exhibit. The job fails with an Access Denied error when writing to a prefix 'output/'. Which permission is MISSING?

Accepted Answer

s3:DeleteObject. The IAM policy grants s3:GetObject and s3:PutObject on 'example-bucket/*', which includes the 'output/' prefix, so write access is sufficient. However, AWS Glue ETL jobs often create temporary files or need to clean up staging data, requiring s3:DeleteObject permission. Without it, the job may fail with an Access Denied error when attempting to delete objects during the write process or when cleaning up after a failure. Option D (s3:DeleteObject) is the missing permission.

Answer

s3:PutObjectAcl

Answer

s3:GetBucketAcl

Answer

s3:ListBucket on the output prefix

Question 3

A company uses AWS Glue to process streaming data from Amazon Kinesis Data Streams. The data is JSON formatted and includes a timestamp field. The company wants to partition the output in Amazon S3 by date and hour, and ensure exactly-once processing semantics. Which combination of configurations should be used?

Accepted Answer

Enable checkpointing in the AWS Glue streaming job and specify an S3 location for checkpoint data.. AWS Glue streaming jobs require checkpointing to track the progress of data consumption from Kinesis Data Streams and to ensure exactly-once processing semantics. By enabling checkpointing and specifying an S3 location, Glue periodically saves the state of processed records, allowing it to resume from the last committed offset in case of failures, thus preventing duplicates or data loss.

Answer

Disable checkpointing and use the 'exactly_once' delivery option in Kinesis Data Streams.

Answer

Use Amazon DynamoDB as a checkpoint store by configuring the Glue job with a DynamoDB connection.

Answer

Use Kinesis Client Library (KCL) checkpointing with a DynamoDB table.

Question 4

A company is using AWS Glue ETL jobs to process data from Amazon S3 and write results back to S3. The jobs are failing intermittently with 'ThrottlingException' errors. Which TWO configurations would help reduce these errors?

Accepted Answer

Add retry logic with exponential backoff in the job script.. Adding retry logic with exponential backoff in the job script directly addresses transient 'ThrottlingException' errors by automatically retrying failed API calls after increasing delays. This is a standard best practice for handling service throttling in AWS Glue, as it reduces the request rate to stay within service limits without requiring infrastructure changes.

Answer

Decrease the number of DPUs for the job.

Answer

Enable GZIP compression on the output data.

Answer

Change the job type from Spark to Python shell.

Question 5

A CloudFormation template includes this IAM policy for a cross-account S3 upload use case. What is the purpose of the condition?

Accepted Answer

To ensure that uploaded objects grant full control to the bucket owner.. The condition in the IAM policy uses the `s3:x-amz-acl` key with a value of `bucket-owner-full-control`. This ensures that any object uploaded to the S3 bucket explicitly grants the bucket owner full control over the object, overriding the default behavior where the uploading account retains ownership. This is critical in cross-account uploads to prevent the uploading account from retaining exclusive access to the objects.

Answer

To enforce server-side encryption with KMS.

Answer

To limit the size of objects that can be uploaded.

Answer

To restrict uploads to only a specific AWS account.

Question 6

A data engineer is designing a data lake on Amazon S3. The data is accessed frequently for the first 30 days, then rarely after that. The engineer needs to minimize storage costs while ensuring data is available within minutes for the first 30 days and can be retrieved within 12 hours after that. Which lifecycle policy should be applied?

Accepted Answer

Transition to S3 Glacier Deep Archive after 30 days.. S3 Glacier Deep Archive offers the lowest storage cost for data that is rarely accessed after 30 days, and its retrieval time (within 12 hours) matches the requirement. The lifecycle policy transitions objects from S3 Standard (or S3 Intelligent-Tiering) to S3 Glacier Deep Archive after 30 days, minimizing costs while meeting the 12-hour retrieval window.

Answer

Transition to S3 One Zone-IA after 30 days.

Answer

Transition to S3 Standard-IA after 30 days.

Answer

Transition to S3 Glacier Flexible Retrieval after 30 days.

Question 7

A data engineer needs to ingest data from multiple SaaS applications (Salesforce, Marketo) into Amazon S3 for a data lake. The data volumes are moderate and the sync needs to be scheduled daily. Which AWS service is most appropriate for this task?

Accepted Answer

Amazon AppFlow. Amazon AppFlow is purpose-built for securely transferring data between SaaS applications (like Salesforce and Marketo) and AWS services (like S3). It supports scheduled, incremental data syncs with built-in connectors, making it the most appropriate choice for moderate-volume daily ingestion into a data lake.

Answer

AWS Glue

Answer

AWS Database Migration Service (DMS)

Answer

Amazon Kinesis Data Firehose

Question 8

A data engineer is troubleshooting a Kinesis Data Firehose delivery stream that is experiencing high error rates when writing to an S3 bucket. The error logs indicate 'AccessDenied' errors. The S3 bucket policy allows access from the Firehose service, but the errors persist. What is the most likely cause?

Accepted Answer

The IAM role assumed by Firehose does not have the s3:PutObject permission. The most likely cause is that the IAM role assumed by Kinesis Data Firehose lacks the `s3:PutObject` permission. Even if the S3 bucket policy allows access from the Firehose service, the IAM role must explicitly grant the necessary S3 write permissions for Firehose to deliver data. Without this permission, Firehose receives 'AccessDenied' errors when attempting to write objects to the bucket.

Answer

The S3 bucket has a lifecycle policy that is deleting objects too quickly

Answer

The S3 bucket has default encryption enabled

Answer

The S3 bucket uses an AWS KMS key for encryption and Firehose does not have kms:Decrypt permission

Question 9

A company stores sensitive data in Amazon S3. The data engineer needs to implement a solution that automatically detects and redacts PII in new objects as they are uploaded. Which TWO AWS services should be used together?

Accepted Answer

Amazon Macie. Amazon Macie is a fully managed data security and data privacy service that uses machine learning and pattern matching to discover and protect sensitive data in Amazon S3. Amazon Comprehend is a natural language processing (NLP) service that can be used to detect and redact PII entities from text. Together, they enable automated detection and redaction of PII in newly uploaded S3 objects by triggering Macie to identify sensitive data and then using Comprehend to redact the PII.

Answer

AWS Glue ETL

Answer

Amazon DynamoDB

Answer

AWS Glue Data Catalog

Question 10

A data engineer is designing a data lake on Amazon S3 for analytics. The data includes sensitive PII that must be encrypted at rest. The company requires that the encryption keys be managed by the company's own hardware security module (HSM) and rotated every 90 days. Which TWO options meet these requirements? (Choose TWO.)

Accepted Answer

Use S3 server-side encryption with customer-provided keys (SSE-C). SSE-C allows you to provide your own encryption keys, which can be managed and rotated from your own HSM. The keys are used server-side by S3 to encrypt objects at rest, but S3 does not store the keys—you manage them entirely, meeting the requirement for key management on your own HSM with 90-day rotation.

Answer

Use S3 server-side encryption with AWS KMS and an AWS managed key

Answer

Use client-side encryption with keys stored in AWS Secrets Manager

Answer

Use S3 server-side encryption with S3 managed keys (SSE-S3)

Question 11

Which THREE factors should a data engineer consider when choosing between Amazon S3 and Amazon DynamoDB for storing time-series data? (Choose three.)

Accepted Answer

Required query complexity (simple key lookups vs. range scans). Amazon S3 supports range scans via its ListObjectsV2 API with prefix and delimiter parameters, but it is not optimized for complex queries like filtering on non-key attributes or aggregations. DynamoDB, on the other hand, excels at simple key lookups and range scans on its sort key, but lacks native support for complex query patterns such as multi-attribute filtering or joins. Therefore, the required query complexity directly influences the choice: S3 is better for simple prefix-based scans, while DynamoDB is better for key-value lookups and sort-key range queries.

Answer

Cost per GB of storage

Answer

Total data volume

Question 12

A company runs a nightly AWS Glue ETL job that writes results to an Amazon Redshift table using the JDBC connector. Recently, the job has been failing with the error 'ERROR:  connection to server at ... failed: server closed the connection unexpectedly'. The Redshift cluster is in a private subnet with a VPC endpoint for S3. The Glue job runs in the same VPC with enhanced VPC routing enabled. Which is the most likely cause?

Accepted Answer

SSL is not enabled on the Redshift cluster.. The error 'server closed the connection unexpectedly' typically indicates that the Redshift cluster rejected the connection, often because SSL is required but not enabled in the Glue JDBC connection. Redshift clusters can be configured with the `require_ssl` parameter set to true, forcing all connections to use SSL. Option B is correct because without SSL, the server terminates the connection. Option A is incorrect because the 'redshift' compatibility mode is not a standard requirement; the JDBC driver works without it. Option C is incorrect because security group issues would cause a timeout or 'connection refused', not a server-side close. Option D is incorrect because Glue supports Redshift as a data source.

Answer

The JDBC driver is missing the 'redshift' compatibility mode setting.

Answer

The Glue job's security group does not allow outbound traffic to the Redshift cluster.

Answer

AWS Glue does not support Redshift as a data source.

Question 13

A data engineer needs to ensure that data in an Amazon S3 bucket is not publicly accessible. Which TWO measures should the engineer implement? (Choose TWO.)

Accepted Answer

Attach a bucket policy that denies access to 'Principal': '*' unless specific conditions are met.. To prevent public access to an S3 bucket, you can use bucket policies that explicitly deny access to anonymous principals (option A) or enable S3 Block Public Access settings (option C). Option B is incorrect because lifecycle policies manage object retention and deletion, not access control. Option D is incorrect because versioning protects against accidental deletion/overwrites but does not control access. Option E is incorrect because default encryption secures data at rest but does not restrict public access.

Answer

Create a lifecycle policy to delete objects after 30 days.

Answer

Enable S3 Versioning on the bucket.

Answer

Enable default encryption on the bucket.

Question 14

A data engineer needs to store time-series data from IoT devices. The data is write-heavy and requires low-latency queries by device ID and timestamp. The data volume is expected to grow to terabytes. Which AWS database service is most suitable?

Accepted Answer

Amazon Timestream. Amazon Timestream is purpose-built for time-series data, offering automatic tiered storage (in-memory for recent data and magnetic for historical) to handle write-heavy IoT workloads at scale. It supports low-latency queries by device ID and timestamp via its SQL-compatible query engine, making it the most suitable choice for terabytes of time-series data.

Answer

Amazon RDS for MySQL

Answer

Amazon ElastiCache for Redis

Answer

Amazon DynamoDB

Question 15

A company has an Amazon RDS for MySQL database that is experiencing performance issues due to a large number of read requests. The application is read-heavy and can tolerate eventually consistent reads. Which action will reduce the load on the primary database with the least operational overhead?

Accepted Answer

Create a read replica in the same region. Creating a read replica in the same region offloads read traffic from the primary RDS instance to a read-only copy, which directly addresses the read-heavy workload. Since the application can tolerate eventually consistent reads, the slight replication lag is acceptable, and this solution requires minimal operational overhead—just a few clicks in the AWS console or a single API call—without any application code changes.

Answer

Use Amazon ElastiCache for caching

Answer

Enable Multi-AZ deployment

Answer

Increase the instance size of the primary DB

Question 16

A data engineer is designing a data pipeline that ingests data from an on-premises database into Amazon S3 using AWS Database Migration Service (DMS). The data must be encrypted at rest in S3 using SSE-S3. The engineer also needs to track changes to the source database in real time. Which DMS configuration should the engineer use?

Accepted Answer

Use DMS with ongoing replication (change data capture) enabled.. DMS with ongoing replication (change data capture) enables real-time tracking of changes from the source database. Option A is incorrect because using a snapshot only captures data at a point in time, not real-time changes. Option C is incorrect because a full load task only loads existing data without capturing ongoing changes. Option D is incorrect because streaming to Amazon Kinesis is unnecessary; DMS CDC can directly replicate changes to S3. Encryption at rest in S3 with SSE-S3 is automatically supported by DMS when writing to S3.

Answer

Use DMS with a snapshot of the source database.

Answer

Use DMS with a full load task only.

Answer

Use DMS with a full load task and then stream to Amazon Kinesis.

Question 17

Refer to the exhibit. An AWS Glue ETL job is failing with an OutOfMemoryError. The job reads from Amazon S3 and performs a GROUP BY on a large dataset. Which change should the data engineer make to resolve this error?

Accepted Answer

Increase the number of DPUs allocated to the Glue job.. The OutOfMemoryError in an AWS Glue ETL job performing a GROUP BY on a large dataset indicates that the executors do not have enough memory to handle the shuffle operations required for aggregation. Increasing the number of DPUs (Data Processing Units) allocated to the Glue job increases the total memory and compute resources available, allowing the job to process larger partitions without running out of memory.

Answer

Use coalesce to reduce the number of partitions.

Answer

Increase the number of partitions in the DataFrame.

Answer

Use repartition to increase the number of partitions.

Question 18

A data engineer needs to store semi-structured JSON logs from AWS CloudTrail. The logs are append-only and rarely accessed after 90 days. Which storage solution is MOST cost-effective?

Accepted Answer

Amazon S3 Glacier Deep Archive. Amazon S3 Glacier Deep Archive is the most cost-effective storage solution for CloudTrail logs that are append-only and rarely accessed after 90 days. It offers the lowest storage cost among AWS options (approximately $0.00099 per GB/month) and is designed for data that is accessed at most once or twice per year, with retrieval times of 12–48 hours. Since the logs are rarely accessed after 90 days, the retrieval latency is acceptable, and the cost savings over S3 Standard (which costs ~$0.023 per GB/month) are substantial.

Answer

Amazon S3 Standard

Answer

Amazon EBS with cold HDD volumes

Answer

Amazon DynamoDB with on-demand capacity

Question 19

A company uses Amazon DynamoDB to store session data for a web application. The application experiences occasional spikes in traffic, causing throttling on the table. The data engineer needs to implement a solution that handles traffic spikes without manual intervention and minimizes cost. What should the data engineer do?

Accepted Answer

Enable DynamoDB Auto Scaling for the table.. DynamoDB Auto Scaling (option D) automatically adjusts the provisioned read and write capacity based on actual traffic patterns, using CloudWatch alarms and the Application Auto Scaling service. This handles traffic spikes without manual intervention and minimizes cost by scaling down during low traffic periods, making it the ideal solution for variable workloads like session data.

Answer

Switch to provisioned capacity with a high fixed read/write capacity.

Answer

Implement DynamoDB Accelerator (DAX) to cache read requests.

Answer

Purchase DynamoDB reserved capacity.

Question 20

A data pipeline uses Amazon Kinesis Data Firehose to deliver data to Amazon S3. The delivery occasionally fails with 'Firehose is throttled'. What should be done to reduce throttling?

Accepted Answer

Increase the buffer size and buffer interval. Increasing the buffer size and buffer interval gives Kinesis Data Firehose more time and data volume to accumulate before delivering to S3, reducing the frequency of PutRecord.Batch calls to the underlying Kinesis stream. This directly mitigates throttling by lowering the request rate, as Firehose throttling typically occurs when the per-shard write throughput limit (1,000 records/second or 1 MB/second) is exceeded.

Answer

Enable compression on the Firehose delivery stream

Answer

Decrease the buffer size to flush more frequently

Answer

Increase the number of shards in the Kinesis stream