DEA-C01 Practice Test 29 — 15 Questions

Question 1

A company runs a daily batch ETL job using AWS Glue. The job processes 500 GB of data from Amazon RDS to Amazon S3. The job currently uses a single DPU and takes 6 hours to complete. The team wants to reduce runtime to under 1 hour without increasing costs significantly. Which approach should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use AWS Glue Spark job with 100 workers.. AWS Glue Spark jobs can parallelize data processing across multiple workers, dramatically reducing runtime. With 100 workers, the job can process the 500 GB dataset in parallel, achieving sub-1-hour runtime while keeping costs relatively low since Glue charges per DPU-second and the total DPU-seconds may be similar to the original 6-hour single-DPU job.

Answer

Change the job type from Python to Spark.

Answer

Use multiple Glue jobs triggered sequentially.

Answer

Increase the RDS instance size to improve read throughput.

Question 2

A data engineer needs to ensure that data in an Amazon S3 bucket is not publicly accessible. Which TWO measures should the engineer implement? (Choose TWO.)

Accepted Answer

Attach a bucket policy that denies access to 'Principal': '*' unless specific conditions are met.. Option A is correct because an S3 bucket policy with an explicit Deny for 'Principal': '*' (optionally scoped by conditions such as aws:SourceIp or aws:SourceVpce) overrides any Allow and prevents anonymous or public access to the bucket's objects. Option C is correct because S3 Block Public Access provides account-level and bucket-level controls (BlockPublicAcls, IgnorePublicAcls, BlockPublicPolicy, RestrictPublicBuckets) that reject public ACLs and public bucket policies, which is the primary AWS safeguard against accidental public exposure. Option B is incorrect because a lifecycle policy only transitions or expires objects and has no effect on access permissions. Option D is incorrect because S3 Versioning only retains multiple object versions for recovery and does not restrict who can read the data. Option E is incorrect because default encryption protects data at rest but does not prevent public read access to the bucket or its objects.

Answer

Create a lifecycle policy to delete objects after 30 days.

Answer

Enable S3 Versioning on the bucket.

Answer

Enable default encryption on the bucket.

Question 3

A healthcare company stores patient records in an S3 bucket encrypted with SSE-S3. The data engineering team uses AWS Glue ETL jobs to process this data and load it into an Amazon Redshift cluster for analytics. Recently, the security team mandated that all sensitive data must be encrypted at rest using customer-managed keys (CMK) in AWS KMS, and that the keys must be rotated automatically every year. The team updated the S3 bucket to use SSE-KMS with a CMK and enabled automatic key rotation. However, after the change, the Glue ETL jobs that read from the S3 bucket started failing with 'Access Denied' errors. The Glue job uses an IAM role named 'GlueETLRole' that has the following permissions: s3:GetObject on the bucket, kms:Decrypt and kms:GenerateDataKey on the CMK, and all necessary Glue permissions. The Redshift cluster is also encrypted with a different CMK, and the Glue role has kms:Decrypt on that key as well. What is the most likely cause of the failure?

Accepted Answer

The KMS key policy for the CMK used for S3 encryption does not grant 'GlueETLRole' permission to use the key.. The most likely cause is that the KMS key policy for the CMK used for S3 encryption does not grant 'GlueETLRole' permission to use the key. Even if the IAM role has kms:Decrypt and kms:GenerateDataKey permissions, the KMS key policy must also allow the role to use the key. KMS requires both IAM policy and key policy to grant access.

Answer

The IAM role 'GlueETLRole' does not have kms:Decrypt permission on the CMK used for S3 encryption.

Answer

The Glue job requires kms:Encrypt permission to read encrypted data from S3.

Answer

The S3 VPC endpoint policy does not allow the Glue job to access the KMS key.

Question 4

A data engineer needs to capture change data capture (CDC) events from an Amazon RDS for PostgreSQL database and stream them to Amazon S3 in near real-time. Which AWS service should be used?

Accepted Answer

AWS Database Migration Service (AWS DMS). AWS DMS supports continuous replication from PostgreSQL source databases using logical replication slots to capture CDC events in near real-time. It can directly stream these changes to Amazon S3 as a target, making it the correct choice for this use case.

Answer

Amazon S3 Transfer Acceleration

Answer

Amazon Athena

Answer

Amazon Kinesis Data Streams

Question 5

A company is migrating a large Oracle database to Amazon Aurora PostgreSQL. The migration must have minimal downtime and preserve data consistency. Which THREE AWS services or features should be used?

Accepted Answer

AWS Schema Conversion Tool (SCT) for schema conversion. Option C (AWS Schema Conversion Tool) is correct because migrating from Oracle to Aurora PostgreSQL requires converting the Oracle schema, stored procedures, and PL/SQL objects into PostgreSQL-compatible DDL, which SCT automates. Option D (Amazon Aurora PostgreSQL as the target database) is correct because the scenario explicitly states the migration target is Aurora PostgreSQL, so the target engine must be Aurora PostgreSQL. Option E (AWS DMS for continuous replication) is correct because DMS supports ongoing change data capture (CDC) from Oracle to Aurora PostgreSQL, enabling minimal downtime by replicating changes until cutover. Option A is incorrect because RDS for Oracle is the source engine, not the target, and would not accomplish the migration to PostgreSQL. Option B is incorrect because AWS DataSync is a file/object transfer service for data like NFS/SMB/S3, not a database migration tool, and cannot preserve relational data consistency for an Oracle-to-PostgreSQL migration.

Answer

Amazon RDS for Oracle as the target

Answer

AWS DataSync for initial load

Question 6

A data engineer is troubleshooting an issue where an AWS Glue ETL job fails when trying to read data from an S3 bucket encrypted with SSE-KMS. The job has an IAM role that includes `kms:Decrypt` permission. What is the most likely reason for the failure?

Accepted Answer

The KMS key policy does not allow the Glue job to use the key. Even if the IAM role has `kms:Decrypt` permission, the KMS key policy must also allow the Glue job's role to use the key. KMS key policies are resource-based policies that control access to the key, and if they do not explicitly grant permission to the Glue job's role, the decrypt operation will fail. This is a common oversight when using SSE-KMS with services like AWS Glue.

Answer

The IAM role does not have s3:GetObject permission

Answer

The S3 bucket is in a different AWS region than the Glue job

Answer

The Glue job is not configured to use the KMS key for decryption

Question 7

A company needs to audit all API calls made in their AWS account, including actions performed by the root user. Which AWS service should be used?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records all API calls made in an AWS account, including root user actions, for auditing and compliance. Option A is incorrect because VPC Flow Logs capture network traffic metadata, not API calls. Option C is incorrect because Amazon CloudWatch Logs stores log data but does not natively capture API calls; it can ingest logs from other sources. Option D is incorrect because AWS Config tracks configuration changes to AWS resources, not API calls.

Answer

VPC Flow Logs

Answer

Amazon CloudWatch Logs

Answer

AWS Config

Question 8

A data engineer is migrating an on-premises PostgreSQL database to Amazon RDS for PostgreSQL. The database is 2 TB in size. The engineer needs to minimize downtime. Which AWS service should be used for the migration?

Accepted Answer

AWS Database Migration Service (DMS). AWS Database Migration Service (DMS) is the correct choice because it supports continuous replication (change data capture) from an on-premises PostgreSQL source to Amazon RDS for PostgreSQL, enabling near-zero downtime migration. DMS can handle a 2 TB database by using a large replication instance and tuning task settings, and it automatically converts the source schema to the target RDS engine.

Answer

AWS Data Pipeline

Answer

AWS Snowball

Answer

Amazon S3

Question 9

A data engineer notices that an Amazon RDS for PostgreSQL instance's CPU utilization is consistently above 90% during business hours. The database is used for reporting queries. Which action should be taken FIRST to improve performance?

Accepted Answer

Enable Performance Insights and review slow queries.. The first step in diagnosing high CPU utilization on an RDS for PostgreSQL instance used for reporting queries is to identify the root cause. Enabling Performance Insights provides a detailed view of database load, wait events, and SQL query performance, allowing the data engineer to pinpoint slow or inefficient queries that are consuming CPU resources. Without this diagnostic data, any other action would be premature and could lead to unnecessary cost or complexity.

Answer

Enable Multi-AZ deployment for automatic failover.

Answer

Create a read replica to offload reporting queries.

Answer

Increase the instance size to a larger instance class.

Question 10

A data engineering team is using AWS DMS to migrate a 2 TB Oracle database to Amazon RDS for PostgreSQL. The migration must have minimal downtime and needs to capture ongoing changes after the full load. Which THREE resources are required for this task? (Choose three.)

Accepted Answer

A DMS source endpoint configured for Oracle.. Option A is correct because AWS DMS requires a source endpoint that defines the Oracle database connection details, including server name, port, SID/service name, and credentials, so the replication instance can read the full load data and ongoing redo/archive log changes. Option B is correct because the AWS DMS replication instance is the managed compute resource that actually runs the migration tasks, performs the full load, and applies change data capture (CDC) from Oracle to the target. Option E is correct because a target endpoint pointing to the Amazon RDS for PostgreSQL instance is mandatory so DMS knows where to write the migrated tables and replicated changes. Option C is not needed because Snowball Edge is an offline physical transfer device, whereas DMS performs the migration over the network and supports ongoing replication. Option D is not required because DMS does not need an Amazon S3 staging bucket for an Oracle-to-RDS PostgreSQL migration; S3 is only used for certain source/target types such as S3 endpoints or specific native backup/restore workflows.

Answer

An AWS Snowball Edge device for initial data transfer.

Answer

An Amazon S3 bucket for staging the data.

Question 11

A data engineer is designing a data pipeline that ingests data from an on-premises database into Amazon S3 using AWS Database Migration Service (DMS). The data must be encrypted at rest in S3 using SSE-S3. The engineer also needs to track changes to the source database in real time. Which DMS configuration should the engineer use?

Accepted Answer

Use DMS with ongoing replication (change data capture) enabled.. DMS with ongoing replication (change data capture) enables real-time tracking of changes from the source database. Option A is incorrect because using a snapshot only captures data at a point in time, not real-time changes. Option C is incorrect because a full load task only loads existing data without capturing ongoing changes. Option D is incorrect because streaming to Amazon Kinesis is unnecessary; DMS CDC can directly replicate changes to S3. Encryption at rest in S3 with SSE-S3 is automatically supported by DMS when writing to S3.

Answer

Use DMS with a snapshot of the source database.

Answer

Use DMS with a full load task only.

Answer

Use DMS with a full load task and then stream to Amazon Kinesis.

Question 12

A company is using Amazon Redshift for its data warehouse. The data engineering team needs to improve query performance for a large fact table that is frequently joined with multiple dimension tables. Which THREE strategies should be considered?

Accepted Answer

Define sort keys on columns used in WHERE clauses.. Option A is correct because defining sort keys on columns frequently used in WHERE clauses allows Redshift to use zone maps and block-level metadata to skip irrelevant blocks, dramatically reducing I/O for filtered queries on the large fact table. Option D is correct because choosing a distribution key based on the fact table's join columns co-locates matching rows on the same node slice, enabling collocated joins that avoid costly data redistribution (broadcast or shuffle) across the cluster. Option E is correct because columnar compression reduces the amount of data read from disk and improves I/O efficiency, which is especially beneficial for large fact tables scanned by analytical queries. Option B is not ideal here because DISTSTYLE EVEN spreads rows uniformly but does not co-locate join keys, so joins with dimension tables require network redistribution, hurting performance for frequent joins. Option C is not a targeted strategy for join performance; adding nodes increases compute and storage capacity but does not by itself address sort keys, distribution keys, or compression, and may not resolve join-related bottlenecks.

Answer

Use DISTSTYLE EVEN to distribute data evenly.

Answer

Increase the number of nodes in the cluster.

Question 13

A company uses AWS CloudTrail to log all API calls. The security team wants to ensure that log files are tamper-proof and cannot be deleted. Which TWO actions should the data engineer take? (Choose TWO.)

Accepted Answer

Enable CloudTrail log file validation. Option A is correct because enabling CloudTrail log file validation generates a digitally signed digest file for each log file, allowing you to verify that logs have not been tampered with or modified after delivery. Option B is correct because S3 Object Lock enforces WORM (Write Once Read Many) protection, preventing log files from being deleted or overwritten for a specified retention period, which directly satisfies the tamper-proof and non-deletable requirement. Option C is not correct because MFA Delete only requires multi-factor authentication for deleting objects or changing versioning state; it adds a control but does not make logs inherently tamper-proof or prevent deletion by an authorized MFA holder. Option D is not correct because S3 Versioning merely preserves prior versions of objects, so deleted or altered logs can still be removed and versioning alone does not prevent deletion. Option E is not correct because SSE-KMS encryption protects data confidentiality at rest but does not prevent log files from being modified or deleted.

Answer

Enable MFA Delete on the S3 bucket

Answer

Enable S3 Versioning on the S3 bucket

Answer

Enable SSE-KMS encryption on the S3 bucket

Question 14

A data engineer is designing an Amazon Redshift data warehouse for a high-traffic analytics workload. The engineer needs to ensure fast query performance and minimize data movement. Which THREE design decisions should be made? (Choose THREE.)

Accepted Answer

Choose DISTSTYLE KEY for tables that are frequently joined.. Option A is correct because choosing DISTSTYLE KEY on the columns used in frequent joins colocates matching rows on the same slice, so join processing avoids broadcasting or redistributing data across nodes. Option D is correct because applying appropriate compression encodings (for example AZ64, ZSTD, or LZO) reduces the amount of data read from disk and moved across the network, directly improving query performance. Option E is correct because defining SORT KEYs on columns used in WHERE clauses enables zone-map block skipping, so the query reads only the relevant blocks instead of scanning the whole table. Option B is not appropriate because the default distribution style (AUTO) may not optimally colocate join keys, and relying on it for all tables can cause unnecessary data movement. Option C is wrong because DISTSTYLE ALL replicates the entire table to every node, which is suitable only for small dimension tables, not large fact tables, since it would multiply storage and load/redistribution overhead.

Answer

Use the default distribution style for all tables.

Answer

Use DISTSTYLE ALL for all large fact tables.

Question 15

Which THREE of the following are valid storage classes in Amazon S3? (Choose THREE.)

Accepted Answer

S3 Standard. S3 Standard (A) is a valid storage class designed for frequently accessed data with low latency and high throughput, and it is the default class for S3 objects. S3 Intelligent-Tiering (C) is a valid class that automatically moves objects between access tiers based on changing access patterns, charging a small monitoring and automation fee. S3 One Zone-IA (E) is a valid class that stores data in a single Availability Zone at lower cost, intended for infrequently accessed data that can be easily recreated. The other options are not real S3 storage classes: S3 Archive (B) does not exist — the archival class is S3 Glacier, and S3 Cold (D) is not a class either, as the closest real classes are S3 Glacier Instant Retrieval and S3 Glacier Flexible Retrieval.

Answer

S3 Archive

Answer

S3 Cold