DEA-C01 Practice Test 5 — 25 Questions

Question 1

Refer to the exhibit. An IAM policy is attached to a user who needs to read objects from the 'example-bucket' S3 bucket. The user reports being unable to read any object under the 'confidential/' prefix. What is the reason for this access issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The explicit deny statement overrides the allow statement. An explicit deny statement overrides any allow statement, regardless of the order in which they appear. In this policy, there is an allow for GetObject on all objects in example-bucket, but there is an explicit deny for GetObject on the 'confidential/' prefix. Since explicit deny takes precedence, the user cannot read objects under that prefix. Option A is incorrect because the order of evaluation does not matter; explicit deny always wins. Option B is incorrect because the deny statement does not need an explicit allow; the deny itself is effective. Option D is incorrect because the resource ARN in the deny statement is correctly specified as 'arn:aws:s3:::example-bucket/confidential/*'.

Answer

The allow statement is evaluated before the deny statement

Answer

The deny statement is missing an explicit allow for the confidential prefix

Answer

The resource ARN in the deny statement is incorrect

Question 2

A company uses AWS Glue to run ETL jobs that process data from Amazon RDS to Amazon S3. The jobs run nightly and take 3 hours to complete. The data volume is growing by 20% each month. The engineer needs to reduce job runtime and cost. The source RDS is a db.r5.large instance. Which approach would be MOST effective?

Accepted Answer

Increase the number of Glue workers and choose a G.1X or G.2X worker type.. Increasing the number of Glue workers and choosing a G.1X or G.2X worker type directly increases parallelism and provides more memory per worker, reducing job runtime at a manageable cost increase. Option A is wrong; reducing DPUs would increase runtime, not reduce it. Option C is wrong because a read replica does not improve Glue processing speed; the bottleneck is Glue's processing capacity, not the source database's read capacity. Option D is wrong because S3 Transfer Acceleration improves upload speed to S3, not Glue job processing.

Answer

Reduce the number of DPUs to lower cost and accept longer runtime.

Answer

Create a read replica of the RDS instance and point the Glue job to the replica.

Answer

Enable S3 Transfer Acceleration on the destination bucket.

Question 3

A company runs a data warehouse on Amazon Redshift. Queries are slow, and the team suspects data distribution is skewed. Which approach would best help identify distribution skew?

Accepted Answer

Query the SVV_DISKUSAGE table to examine data distribution across slices. The SVV_DISKUSAGE table provides per-slice data distribution information, allowing you to identify skew by comparing the number of blocks allocated to each slice for a given table. In Amazon Redshift, data is distributed across slices based on the distribution key, and significant variation in block counts across slices indicates distribution skew, which can cause query performance degradation due to uneven workload distribution.

Answer

Check the STL_LOAD_ERRORS table for load failures

Answer

Query the SVV_TABLE_INFO table to see table size

Answer

Review the WLM configuration in the parameter group

Question 4

A company uses Amazon DynamoDB for a gaming application. They need to store player session data that expires after 24 hours. Which DynamoDB feature should they use to automatically delete expired items?

Accepted Answer

Time to Live (TTL). DynamoDB Time to Live (TTL) is the correct feature because it allows you to define a per-item timestamp attribute (e.g., `expireAt`) that DynamoDB automatically deletes once that timestamp is reached. This is ideal for expiring session data after 24 hours without requiring custom code or scheduled jobs to scan and delete items, reducing cost and operational overhead.

Answer

DynamoDB auto scaling

Answer

DynamoDB Streams

Answer

Point-in-time recovery

Question 5

A data engineer is setting up a data pipeline using AWS Glue. The engineer wants to monitor job failures and receive notifications. Which TWO services can be used together for this purpose?

Accepted Answer

Amazon CloudWatch. Amazon CloudWatch (B) is correct because AWS Glue automatically publishes job metrics and logs to CloudWatch, and you can create CloudWatch alarms that trigger when a Glue job fails (for example, on the glue.driver.aggregate.numFailedTasks metric or a FAILED job run state). Amazon SNS (C) is correct because it is the notification service that CloudWatch alarms target via an SNS topic, delivering email, SMS, or HTTP notifications to subscribers when a Glue job failure alarm fires. Together, CloudWatch detects the failure and SNS delivers the alert, which is the standard AWS pattern for Glue job failure notifications. AWS Step Functions (A) can orchestrate Glue jobs but is not a monitoring/notification service, Amazon Kinesis Data Streams (D) is for real-time streaming ingestion, and Amazon SQS (E) is a message queue for decoupling applications, so none of these provide the alarm-and-notify capability required here.

Answer

AWS Step Functions

Answer

Amazon Kinesis Data Streams

Answer

Amazon SQS

Question 6

A data engineer needs to ingest data from a SaaS application that sends webhooks in JSON format. The data must be stored in S3 for batch analysis. Which AWS services can receive the webhooks and store the data in S3 with minimal custom code? (Choose TWO.)

Accepted Answer

Amazon API Gateway with S3 integration. Amazon API Gateway with S3 integration (Option D) allows you to create a REST API that directly writes incoming webhook payloads to an S3 bucket without any custom code, using a proxy integration with an AWS service. This minimizes custom code because the integration handles the mapping and storage automatically.

Answer

AWS Lambda with S3 SDK

Answer

AWS Glue with a Python shell job

Answer

Amazon Kinesis Data Streams

Question 7

A data engineer needs to store JSON documents that are frequently accessed by a low-latency web application. The data does not require complex queries, and the access pattern is primarily by a key. Which AWS service is most appropriate?

Accepted Answer

Amazon DynamoDB. Amazon DynamoDB is the most appropriate service because it is a fully managed NoSQL key-value and document database designed for single-digit millisecond latency at any scale. It natively supports JSON documents and provides fast, consistent access by primary key without requiring complex query capabilities, making it ideal for low-latency web applications.

Answer

Amazon ElastiCache for Redis

Answer

Amazon S3

Answer

Amazon RDS for MySQL

Question 8

A data engineer runs an AWS Glue job that reads from a JDBC connection to a PostgreSQL database. The job fails with a 'Connection timed out' error. The Glue job runs in a VPC with the appropriate security group. What is the most likely cause?

Accepted Answer

The network ACL associated with the Glue job's subnet is blocking outbound traffic.. A network ACL (NACL) is a stateless subnet-level firewall that can block outbound traffic. If the NACL associated with the Glue job's subnet does not allow outbound traffic to the PostgreSQL database's port (e.g., 5432), the connection times out. Since the security group is stated to be appropriate, the NACL is the most likely remaining network-layer cause.

Answer

The Glue job does not have permission to access the database.

Answer

The security group does not allow inbound traffic from the Glue job.

Answer

The database credentials are incorrect.

Question 9

A company uses Amazon Kinesis Data Streams to ingest clickstream data from a website. The data is consumed by an AWS Lambda function that writes to Amazon DynamoDB. The Lambda function is seeing high error rates due to DynamoDB write throttling. Which action should be taken to reduce throttling?

Accepted Answer

Enable auto scaling on the DynamoDB table. Enabling DynamoDB auto scaling increases write capacity automatically when needed. Using Kinesis Data Firehose would change the architecture but does not address throttling directly. Increasing Lambda memory does not help with DynamoDB throttling. Using SQS would add a queue but does not increase DynamoDB capacity.

Answer

Use Amazon Kinesis Data Firehose instead of Kinesis Data Streams

Answer

Add an Amazon SQS queue between Lambda and DynamoDB

Answer

Increase the Lambda function memory

Question 10

Refer to the exhibit. A data engineer runs two queries on an Athena table partitioned by 'ds'. Both queries scan the same amount of data. What does this indicate?

Accepted Answer

The partition column is not being used as a filter. If two queries that filter on different partition values scan the same amount of data, it means the partition column is not being used as a filter in the WHERE clause — Athena is scanning all partitions instead of pruning to the relevant ones. Partition pruning only occurs when the query includes a predicate on the partition column (e.g., WHERE ds = '2024-01-01'), so equal scan sizes across different filters indicate the predicate is missing or not applied.

Answer

The table does not have any partitions defined

Answer

The table is not partitioned

Answer

Partition pruning is working correctly

Question 11

Refer to the exhibit. A data engineer runs the AWS CLI command shown to encrypt a file using AWS KMS. The command succeeds. Later, the engineer tries to decrypt the file using the same key but without providing an encryption context. The decryption fails. What is the most likely reason?

Accepted Answer

The encryption context must be provided during decryption.. When encrypting data with AWS KMS, an encryption context can be provided as additional authenticated data (AAD). This context must be supplied during decryption; otherwise, decryption fails. The command succeeded during encryption, so the key is not disabled (B is wrong) and the key policy is not the issue (A is wrong). File corruption would cause a different error (C is wrong).

Answer

The KMS key policy does not allow decryption.

Answer

The KMS key has been disabled.

Answer

The plaintext file was corrupted.

Question 12

The exhibit shows an IAM policy attached to a role used by an AWS Glue ETL job. The job reads from an S3 bucket and writes to another S3 bucket. However, the job fails with an access denied error when trying to write to the output bucket. What is the most likely cause?

Accepted Answer

The policy only allows PutObject on the my-data-lake bucket, but the job writes to a different bucket. The IAM policy attached to the Glue job's role grants s3:PutObject only on the my-data-lake bucket ARN, but the ETL job's output path points to a different bucket. S3 authorization is evaluated per-resource ARN, so a PutObject call to any bucket not listed in the Resource element is implicitly denied. The fix is to add the output bucket's ARN (or a wildcard) to the policy's Resource list.

Answer

The policy is missing permissions for AWS KMS to decrypt/encrypt objects

Answer

The policy does not allow glue:StartJobRun on the specific job

Answer

The policy does not include s3:ListBucket permission

Question 13

A company runs a multi-AZ Amazon RDS for PostgreSQL instance. They need to run a one-time analytical query that will take several hours and consume significant I/O. The query should not impact the primary workload. What should the data engineer do?

Accepted Answer

Create a read replica of the RDS instance and run the query on the replica.. Creating a read replica of the RDS for PostgreSQL instance allows the analytical query to run on a separate database engine without affecting the primary workload. Read replicas in Amazon RDS use asynchronous replication from the source instance, so the replica can handle heavy I/O and long-running queries independently. This ensures the primary instance remains available for the production workload without performance degradation.

Answer

Run the query directly on the primary instance during off-peak hours.

Answer

Increase the instance size to handle the load.

Answer

Enable Multi-AZ and run the query on the standby instance.

Question 14

A data engineering team is designing a data lake on Amazon S3 for storing sensor data from IoT devices. The data is written in near real-time and needs to be queried using Amazon Athena. Which TWO configurations should the team implement to optimize query performance and minimize costs?

Accepted Answer

Store the data in Apache Parquet format.. Option C is correct because storing the data in Apache Parquet, a columnar format, allows Athena to read only the columns referenced in a query and leverages columnar compression and predicate pushdown, which dramatically reduces the amount of data scanned and therefore query cost and latency. Option D is correct because partitioning the data by date and sensor ID lets Athena prune irrelevant partitions using the partition metadata in the AWS Glue Data Catalog, so queries only scan the specific date/sensor combinations needed instead of the entire dataset. Together, Parquet plus partitioning is the standard best practice for cost-efficient, high-performance Athena queries over S3 data lakes. Option A is not correct because GZIP is a row-based compression format that cannot be split for parallel reads and does not provide column pruning, so it is inferior to Parquet's built-in columnar compression for this use case. Option B is not correct because S3 Standard-IA is a storage-class cost optimization for infrequently accessed data, not a query-performance optimization, and it can even add retrieval costs for frequently queried near real-time data. Option E is not correct because Requester Pays shifts data-transfer costs to the requester and does nothing to improve Athena query performance or reduce the team's own query scanning costs.

Answer

Compress the data using GZIP.

Answer

Use S3 Standard-IA storage class.

Answer

Enable Requester Pays on the S3 bucket.

Question 15

A data engineer needs to transform JSON data from an S3 bucket using AWS Glue. The JSON contains nested arrays and objects. Which Glue transform is best suited for flattening nested structures?

Accepted Answer

Relationalize. The Relationalize transform is specifically designed to flatten nested JSON structures (arrays and objects) into a set of related tables, making it ideal for this use case. It automatically handles complex nesting by creating separate DataFrames for each nested level and linking them via foreign keys, which is exactly what is needed when ingesting JSON with nested arrays and objects into a relational format.

Answer

Unnest

Answer

ResolveChoice

Answer

Map

Question 16

Refer to the exhibit. An S3 event notification is configured to trigger an AWS Lambda function when objects are created in 'my-bucket'. The Lambda function processes the JSON file and writes results to Amazon DynamoDB. The function fails with a timeout error. Which action should the engineer take to resolve the issue?

Accepted Answer

Increase the Lambda function timeout. The Lambda function is failing with a timeout error, which indicates that the function is taking longer to execute than the default timeout of 3 seconds. Increasing the Lambda function timeout allows the function to run longer and complete its processing of the JSON file and DynamoDB write operation without being prematurely terminated.

Answer

Modify the S3 event notification to use a different event type

Answer

Grant the Lambda function permission to access DynamoDB

Answer

Change the trigger to Amazon SQS instead of S3

Question 17

A data engineer runs the above command and gets the output. What does the 'MFADelete' setting imply?

Accepted Answer

To permanently delete a version of an object, the user must provide MFA.. The 'MFADelete' setting on an S3 bucket versioning configuration requires multi-factor authentication to permanently delete an object version. This means that when a user issues a DELETE request with a version ID (a permanent delete), they must include a valid MFA token in the request headers. It does not apply to creating new versions, reading objects, or other operations.

Answer

Any modification to an object requires MFA.

Answer

MFA is required for all read operations as well.

Answer

All operations on the bucket require MFA authentication.

Question 18

A data engineer is optimizing an Amazon RDS for MySQL database that experiences high write throughput. The engineer wants to improve write performance and reduce latency. Which TWO database-level configuration changes can help achieve this?

Accepted Answer

Use Provisioned IOPS (io1 or io2) storage.. Provisioned IOPS (io1 or io2) storage delivers consistent and predictable I/O performance by guaranteeing a specified number of I/O operations per second, which directly reduces latency and improves write throughput for high-write workloads. This is the most effective storage-level change for write-intensive RDS for MySQL databases.

Answer

Reduce the backup retention period to 1 day.

Answer

Create a Read Replica to offload writes.

Answer

Enable Multi-AZ for high availability.

Question 19

A data engineer needs to audit data access in Amazon S3 for compliance. Which TWO services can be used to capture and analyze S3 access logs? (Choose TWO.)

Accepted Answer

AWS CloudTrail. AWS CloudTrail (B) is correct because it records S3 data events (object-level operations like GetObject and PutObject) and management events, delivering them to CloudTrail logs or CloudWatch Logs for auditing and analysis of who accessed what in S3. S3 server access logs (C) are correct because they provide detailed, best-effort records of every request made to a bucket, including requester, bucket, key, operation, and response codes, which can be stored and analyzed for compliance auditing. Amazon CloudWatch Logs (A) is not a log source for S3 access itself; it only stores and analyzes logs that are delivered to it by other services such as CloudTrail. Amazon Macie (D) is a data security service that discovers and classifies sensitive data in S3, not a service for capturing S3 access logs. AWS Config (E) tracks resource configuration changes and compliance against rules, not individual S3 data access events.

Answer

Amazon CloudWatch Logs

Answer

Amazon Macie

Answer

AWS Config

Question 20

A data engineer needs to monitor the performance of an Amazon Redshift cluster. Which Amazon CloudWatch metric should the engineer monitor to detect disk space issues?

Accepted Answer

PercentageDiskSpace. PercentageDiskSpace is the correct metric because it directly reports the percentage of disk space used in the Redshift cluster. Monitoring this metric allows the engineer to detect when disk space is running low, which can lead to performance degradation or query failures. Unlike I/O or CPU metrics, it specifically measures storage utilization, making it the most relevant for disk space issues.

Answer

ReadIOPS

Answer

WriteIOPS

Answer

NetworkThroughput

Answer

CPUUtilization