DEA-C01 Practice Test 4 — 25 Questions

Question 1

A company uses Amazon Kinesis Data Streams to ingest clickstream data. The data is consumed by a custom consumer application that writes to Amazon S3 every 5 minutes. The consumer is falling behind and processing lag is increasing. Which action is MOST effective to reduce the lag?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Increase the number of shards in the Kinesis stream. The consumer is falling behind because the stream's throughput capacity is insufficient for the incoming data volume. Increasing the number of shards in the Kinesis stream directly increases the total read capacity (each shard provides 2 MB/s read throughput and 5 transactions/second), allowing the consumer to process more data in parallel and reduce lag.

Answer

Switch to Amazon Kinesis Data Firehose to deliver data directly to S3

Answer

Increase the batch size of records written to S3

Answer

Reduce the retention period of the stream

Question 2

A company runs an Amazon RDS for PostgreSQL database. To meet disaster recovery requirements, they set up a cross-Region read replica. The replica has been lagging by several minutes. Which action is MOST effective to reduce the replica lag?

Accepted Answer

Increase the instance size (memory and CPU) of the replica.. Increasing the instance size (memory and CPU) of the cross-Region read replica is the most effective action because replica lag in Amazon RDS for PostgreSQL is often caused by the replica being unable to keep up with the volume of write-ahead log (WAL) data arriving from the primary. A larger replica instance provides more compute and memory resources to apply WAL changes faster, reducing the replay lag. This directly addresses the bottleneck at the replica side without impacting the primary database.

Answer

Enable Multi-AZ on the primary database.

Answer

Increase the instance size of the primary database.

Answer

Decrease the instance size of the replica to reduce cost.

Question 3

A company uses AWS Lake Formation to manage access to data in S3. A data analyst reports being unable to query a table in Amazon Athena, receiving an 'Access Denied' error. The analyst has SELECT permission on the table in Lake Formation. What additional configuration is MOST likely causing the issue?

Accepted Answer

The IAM role used by Athena does not have S3 GetObject permission on the underlying data. In AWS Lake Formation, even when a user has SELECT permission on a table, the IAM role that Athena uses must have S3 GetObject permission on the underlying data files. Lake Formation manages permissions at the metadata level, but the actual data access is enforced by S3 bucket policies and IAM. Without GetObject permission, Athena fails with 'Access Denied'. Option A is incorrect because Athena typically has access to the Glue Data Catalog if the table is visible; the error is about data access. Option C is incorrect because SELECT permission usually includes DESCRIBE, and the error message is about access denied, not missing describe. Option D is incorrect because the table is registered with Lake Formation since the analyst has SELECT permission.

Answer

Athena does not have permission to access the Glue Data Catalog

Answer

The analyst does not have DESCRIBE permission

Answer

The table is not registered with Lake Formation

Question 4

A company stores sensitive user data in an Amazon RDS for PostgreSQL DB instance. A security audit requires that all data be encrypted at rest. The database is currently unencrypted. What is the MOST operationally efficient way to enable encryption at rest?

Accepted Answer

Take a snapshot of the DB instance, copy it with encryption enabled, and restore the snapshot to a new DB instance.. RDS for PostgreSQL does not support enabling encryption at rest on an existing unencrypted DB instance directly. The only way to achieve this is by taking a snapshot of the unencrypted instance, creating an encrypted copy of that snapshot, and then restoring it to a new encrypted DB instance. This method is operationally efficient as it uses native RDS snapshot copy and restore capabilities without requiring additional infrastructure or manual data migration.

Answer

Create a read replica with encryption enabled and promote it.

Answer

Modify the DB instance and enable encryption in the console.

Answer

Modify the DB parameter group to include encryption parameters and reboot the instance.

Question 5

Which THREE are valid considerations when troubleshooting data loss in an AWS Glue ETL job? (Choose three.)

Accepted Answer

Job bookmarks may be skipping new data if not configured properly.. Options A, D, and E are correct. Job bookmarks may skip new data if not configured properly (A). Dynamic frame transformations can drop rows if errors occur during processing (D). Incorrect mapping of source columns to target columns can cause data loss (E). Option B is incorrect because disabling server-side encryption on S3 does not cause data loss; it affects data at rest encryption but not data integrity during ETL. Option C is incorrect because setting the job timeout too low may cause the job to fail prematurely, but it does not directly cause data loss; data can be reprocessed after adjusting the timeout.

Answer

Server-side encryption is disabled on the S3 bucket.

Answer

The job timeout is set too low.

Question 6

A company stores IoT sensor data in an Amazon S3 bucket. The data is ingested every minute and each object is about 10 KB. The data must be stored for at least 7 years for compliance. Which lifecycle policy configuration minimizes storage costs?

Accepted Answer

Transition to S3 Glacier Deep Archive after 30 days and expire after 2555 days.. S3 Glacier Deep Archive is the lowest-cost storage class for long-term archival data, and transitioning directly after 30 days minimizes costs for 10 KB objects that are accessed infrequently. The 2555-day expiration (7 years) meets the compliance requirement. Other options incur higher costs by using more expensive intermediate tiers or by delaying the transition to the cheapest storage class.

Answer

Transition to S3 One Zone-IA after 30 days, then to S3 Glacier Deep Archive after 365 days, and expire after 2555 days.

Answer

Transition to S3 Glacier Flexible Retrieval after 90 days and expire after 2555 days.

Answer

Transition to S3 Standard-IA after 30 days, then to S3 Glacier Deep Archive after 365 days, and expire after 2555 days.

Question 7

Refer to the exhibit. A data engineer sees this error log from an Amazon EC2 instance that is trying to access an S3 bucket in the us-west-2 region. The EC2 instance is in a VPC with a private subnet and no internet gateway. What is the MOST likely cause of this error?

Accepted Answer

The VPC does not have a VPC endpoint for S3.. The EC2 instance is in a private subnet without an internet gateway, so it cannot reach S3 over the internet. A VPC endpoint (Gateway or Interface) for S3 is required for private connectivity. The error log shows a connection timeout, which is consistent with the lack of a VPC endpoint. Option A is incorrect because the bucket's region is us-west-2 as specified, and the bucket exists (DNS resolves). Option C is incorrect because the error is a timeout, not a 404 (bucket not found). Option D is incorrect because the error is a connection timeout, not an access denied (403), so IAM permissions are not the issue.

Answer

The S3 bucket is in a different region than us-west-2.

Answer

The S3 bucket does not exist.

Answer

The IAM role attached to the EC2 instance does not have s3:GetObject permission.

Question 8

An IAM policy is attached to an IAM role used by an EC2 instance in the 10.0.0.0/8 VPC. The EC2 instance cannot read objects from the S3 bucket. What is the most likely cause?

Accepted Answer

The S3 bucket has a bucket policy that denies public access, and the IAM policy alone is insufficient.. The most likely cause is that the S3 bucket has a bucket policy that denies access or does not explicitly grant access to the IAM role. Even if the IAM policy attached to the role allows S3 actions, a bucket policy can override it with an explicit deny or by not granting access to the role. Option A is incorrect because the s3:GetObject operation does not require s3:ListBucket permission. Option C is incorrect because SSE-KMS is not mentioned and would require specific kms:Decrypt permission, but it is not the most likely cause. Option D is incorrect because the EC2 instance's private IP is within the 10.0.0.0/8 VPC range, and the public IP is irrelevant for in-VPC communication.

Answer

The policy does not grant s3:ListBucket permission.

Answer

The bucket is encrypted with SSE-KMS and the role does not have kms:Decrypt permission.

Answer

The EC2 instance's public IP is not in the 10.0.0.0/8 range.

Question 9

A company uses DynamoDB with global tables in two AWS Regions. The data engineer observes that a write to the table in us-east-1 is not immediately visible in a read from eu-west-1. What is the most likely reason?

Accepted Answer

Replication between regions is eventually consistent.. DynamoDB global tables use asynchronous replication between regions. When a write occurs in us-east-1, the change is propagated to eu-west-1 with a replication lag that is typically sub-second but not instantaneous. Reads in eu-west-1 are eventually consistent by default, meaning they may not reflect the most recent write until replication completes. This is the expected behavior of DynamoDB global tables, which prioritize availability and partition tolerance over immediate consistency across regions.

Answer

The read is using strongly consistent reads.

Answer

There is a write conflict that needs to be resolved.

Answer

DynamoDB Streams is not enabled on the table.

Question 10

A data engineer is troubleshooting a Kinesis Data Analytics application that processes streaming data. The application is falling behind, and the metric 'MillisBehindLatest' is consistently above 60000. The source Kinesis stream has 10 shards, and the application uses a Flink application with default parallelism. What is the MOST likely cause of the lag?

Accepted Answer

The Flink application parallelism is set to 1.. In Kinesis Data Analytics with Flink, the default parallelism is 1. With 10 shards in the source Kinesis stream, a single parallel task must read from all shards, creating a bottleneck and causing the 'MillisBehindLatest' metric to be consistently high (above 60000). Option A is wrong because while a throttling sink can cause backpressure, the question specifically states the application is falling behind and the metric is high, which is more directly explained by insufficient parallelism. Option C is wrong because 10 shards is typically sufficient; the issue is how they are consumed. Option D is wrong because the retention period does not affect the lag metric; it only controls how long data is stored.

Answer

The sink (destination) is throttling writes.

Answer

The Kinesis stream has too few shards.

Answer

The retention period of the Kinesis stream is too short.

Question 11

Which TWO actions are effective ways to monitor the health of an Amazon DynamoDB table? (Choose two.)

Accepted Answer

Enable DynamoDB Streams and process with Lambda to detect failures.. Options C and D are correct. DynamoDB Streams with Lambda can detect failures by processing change events, and CloudWatch alarms on ConsumedReadCapacityUnits help monitor throughput and potential throttling. Option A is wrong because S3 inventory tracks S3 objects, not DynamoDB. Option B is wrong because EC2 instance status checks are for EC2 instances, not DynamoDB tables. Option E is wrong because there is no 'TableHealth' metric in CloudWatch; DynamoDB health is monitored via metrics like ConsumedReadCapacityUnits, ThrottledRequests, and SystemErrors.

Answer

Use AWS S3 inventory to track table size.

Answer

Use EC2 instance status checks.

Answer

Monitor the 'TableHealth' metric in CloudWatch.

Question 12

A company is using Amazon S3 to store sensitive data. To meet compliance requirements, they need to automatically transition objects to S3 Glacier Deep Archive after 90 days and delete them after 7 years. What is the MOST cost-effective way to configure this?

Accepted Answer

Configure an S3 Lifecycle policy to transition objects to Glacier Deep Archive after 90 days and expire them after 7 years.. An S3 Lifecycle policy can automate both the transition of objects to S3 Glacier Deep Archive after 90 days and their expiration (permanent deletion) after 7 years. This is the most cost-effective approach as it eliminates manual effort and leverages S3's native, serverless lifecycle management, which incurs no additional cost beyond the storage and transition fees.

Answer

Manually move objects to Glacier Deep Archive and delete them using a script.

Answer

Use S3 Intelligent-Tiering to automatically move objects to Glacier Deep Archive and set expiration.

Answer

Enable S3 Object Lock with a retention period of 7 years and use a lifecycle policy to transition to Glacier Deep Archive.

Question 13

A data engineer is troubleshooting a failed AWS Glue ETL job that reads from an S3 bucket and writes to an Amazon Redshift table. The job logs show a permission error. Which IAM policy change would resolve the issue?

Accepted Answer

Add redshift:DataAPI access to the Glue job's IAM role. The Glue job's IAM role needs the redshift:DataAPI permission to write to the Redshift table via the Data API. Option A is irrelevant because enabling encryption on the S3 bucket does not resolve permission errors related to Redshift. Option B is incorrect because s3:GetObject is needed for reading from S3, but the error is about writing to Redshift, not reading. Option D is incorrect because attaching an IAM role to the Redshift cluster grants permissions to the cluster itself, not to the Glue job's role; the Glue job's role must have the redshift:DataAPI permission directly.

Answer

Enable encryption on the S3 bucket using AWS KMS

Answer

Add s3:GetObject permission to the Glue job's IAM role

Answer

Attach an IAM role with redshift:GetClusterCredentials to the Redshift cluster

Question 14

A data engineer is setting up Amazon CloudWatch alarms for an Amazon Redshift cluster. The engineer wants to be alerted when the disk space usage exceeds 80% for more than 5 minutes and when the CPU utilization exceeds 90% for more than 10 minutes. Which TWO CloudWatch metrics and conditions should the engineer use? (Choose two.)

Accepted Answer

Metric: CPUUtilization; Condition: > 90 for 10 minutes. The correct metrics and conditions are: for disk space usage exceeding 80% for more than 5 minutes, use PercentageDiskSpace with a threshold of 80 and a period of 5 minutes; for CPU utilization exceeding 90% for more than 10 minutes, use CPUUtilization with a threshold of 90 and a period of 10 minutes. These correspond to options A and E. Option B (DatabaseConnections) monitors connections, not disk or CPU. Option C (NetworkReceiveThroughput) measures network traffic. Option D (WLMQueueLength) tracks query queue length, not disk or CPU.

Answer

Metric: DatabaseConnections; Condition: > 500 for 5 minutes

Answer

Metric: NetworkReceiveThroughput; Condition: > 1 GB for 10 minutes

Answer

Metric: WLMQueueLength; Condition: > 100 for 5 minutes

Question 15

A company uses AWS Glue DataBrew to clean and normalize data. The data contains sensitive columns that must be masked before being written to the output. Which DataBrew action should be applied?

Accepted Answer

Apply a Mask transform to the sensitive columns.. DataBrew provides a built-in 'Mask' transform that obfuscates sensitive data by applying masking patterns. Option A is incorrect because the Hash transform produces a hash value, which is not true masking as it can be reversed via brute force. Option B is incorrect because Encrypt is not a DataBrew transform; encryption is handled at the storage layer (e.g., S3 SSE). Option C is incorrect because Delete removes the column entirely, which may not be desired if the column is needed for analysis but just needs sensitive data hidden.

Answer

Apply a Hash transform to the sensitive columns.

Answer

Apply an Encrypt transform to the sensitive columns.

Answer

Apply a Delete transform to remove the sensitive columns.

Question 16

A company uses AWS Lake Formation to manage permissions on a data lake stored in S3. A data analyst reports that they can see a table in the AWS Glue Data Catalog but cannot query it using Amazon Athena. The analyst has been granted 'SELECT' permission on the table in Lake Formation. The table's underlying S3 location is encrypted with AWS KMS. The IAM role used by Athena has the necessary S3 and KMS permissions. What is the most likely reason for the failure?

Accepted Answer

The analyst does not have 'DESCRIBE' permission on the table.. Lake Formation requires explicit grant of 'DESCRIBE' permission on the table for Athena to read metadata; SELECT alone is insufficient. Option B is incorrect because Athena can be integrated with Lake Formation. Option C is incorrect because KMS permissions are already in place. Option D is incorrect because the analyst can see the table, meaning DESCRIBE is not required at the database level.

Answer

Athena is not integrated with Lake Formation.

Answer

The KMS key policy does not allow the analyst's IAM role to decrypt.

Answer

The analyst does not have 'DESCRIBE' permission on the database.

Question 17

A data engineer needs to troubleshoot why an AWS Glue job is failing with a 'Insufficient Memory' error. The job processes a 10 GB dataset. Which step should the engineer take FIRST?

Accepted Answer

Increase the number of DPUs allocated to the job.. The correct first step is to increase the number of DPUs allocated to the job. The 'Insufficient Memory' error indicates that the current memory per worker is insufficient for processing the 10 GB dataset. Increasing DPUs provides more memory and compute resources, directly addressing the issue. Option A is incorrect because Python shell jobs are single-threaded and cannot handle large datasets efficiently; Glue Spark jobs are designed for distributed processing. Option B (repartitioning) can improve performance but does not add memory; it may help after resource allocation is adequate. Option C is invalid because AWS Glue does not support Java jobs; it supports Python and Scala.

Answer

Switch from using Apache Spark to Python shell.

Answer

Repartition the data into more partitions within the job.

Answer

Change the job type from Python to Java.

Question 18

A company is designing a data lake on AWS using Amazon S3. The data includes sensitive customer information that must be encrypted at rest. The company requires that encryption keys be managed by AWS, but the keys must be rotated automatically every year. Which TWO options meet these requirements? (Choose TWO.)

Accepted Answer

Use Server-Side Encryption with Amazon S3-Managed Keys (SSE-S3).. SSE-S3 is correct because it provides server-side encryption where AWS manages the encryption keys entirely, including automatic annual rotation. This meets the requirement of encryption at rest with AWS-managed keys and automatic yearly rotation without any additional configuration.

Answer

Use client-side encryption with an AWS KMS key.

Answer

Use Server-Side Encryption with Customer-Provided Keys (SSE-C).

Answer

Use Server-Side Encryption with AWS KMS-Managed Keys (SSE-KMS) with manual key rotation.

Question 19

A data engineer uses AWS Database Migration Service (DMS) to migrate an on-premises Oracle database to Amazon Aurora MySQL. The migration is successful, but the engineer notices that the target Aurora cluster has a higher CPU utilization than expected during the full load phase. What is the MOST likely cause?

Accepted Answer

The DMS task is configured to use multiple parallel threads to load data, overwhelming the target instance.. During full load, DMS uses multiple parallel threads (by default up to 4 or more) to maximize throughput, which can overwhelm the target Aurora cluster's CPU. Option A is incorrect: 'Full LOB mode' affects how large objects are handled and may increase latency, but it is not the primary cause of high CPU utilization. Option B is incorrect: DMS performs data validation after the full load phase, not during it. Option C is incorrect: DMS reads from the source (on-premises Oracle), not from an Aurora read replica; moreover, read replicas are not used for writing.

Answer

The DMS task has LOB mode set to 'Full LOB mode', causing additional processing.

Answer

DMS is performing data validation during the full load phase.

Answer

DMS is reading from an Amazon Aurora read replica instead of the primary instance.

Question 20

A company runs an Amazon Redshift cluster for data warehousing. The data engineering team notices that the 'Amazon Redshift Data API' is timing out when executing long-running queries. The queries typically take more than 10 minutes to complete. The team wants to ensure that the queries can complete without timeout and that the results are retrievable. Which TWO steps should the team take? (Choose TWO.)

Accepted Answer

Use the 'GetStatementResult' operation to retrieve results after the query completes.. Options C and E are correct. The Amazon Redshift Data API has a default timeout of 10 minutes for a single API call. To handle queries that take longer, you can run the query asynchronously by using the StatementName parameter (option E). This allows the query to continue running even if the initial API call times out, and you can poll for completion using the DescribeStatement operation. Once the query completes, you can retrieve the results using the GetStatementResult operation (option C). Option A is incorrect because QueryExecutionTimeout is not a valid parameter for the Data API. Option B is incorrect because increasing the timeout parameter in the Redshift cluster configuration does not affect the Data API timeout. Option D is incorrect because there is no max_execution_time parameter in Redshift; the relevant parameter is statement_timeout, which controls how long a query can run before being canceled, but it does not address the Data API timeout.

Answer

Set the 'QueryExecutionTimeout' parameter in the Data API call to 30 minutes.

Answer

Increase the 'timeout' parameter in the Redshift cluster configuration.

Answer

Set the 'max_execution_time' parameter in the Redshift parameter group to 30 minutes.