DEA-C01 Practice Test 3 — 10 Questions

Question 1

A data engineer needs to monitor the number of Amazon S3 PUT requests that result in a 403 AccessDenied error. Which AWS service should be used to capture the necessary data?

Accepted Answer

AWS CloudTrail data events. S3 request metrics do not provide filtering by status code; the 4xxErrors metric aggregates all 4xx errors. To monitor specific 403 AccessDenied errors, you should use AWS CloudTrail data events, which capture API call details including error codes. You can create a CloudWatch metric filter on the CloudTrail log group to emit a custom metric for 403 errors, enabling monitoring and alarming.

Answer

Amazon CloudWatch S3 request metrics

Answer

Amazon S3 server access logs

Answer

AWS Config

Question 2

A company runs a data pipeline that uses Amazon EMR to process large datasets. The pipeline reads data from S3, processes it using Spark, and writes results back to S3. Recently, the pipeline has been failing with 'OutOfMemoryError' in the Spark executors. The EMR cluster is configured with 5 core nodes of type m5.xlarge (4 vCPU, 16 GB memory each). The Spark application uses dynamic allocation and default Spark configurations. The input data size is approximately 500 GB in Parquet format. What is the most cost-effective way to resolve the out-of-memory errors?

Accepted Answer

Change the core node instance type to r5.xlarge (32 GB memory) and keep 5 nodes.. The current cluster has limited memory per node (16 GB). By switching to memory-optimized instances like r5.xlarge (32 GB), each node has double the memory, reducing the chance of OOM. This is more cost-effective than adding more nodes because the total memory per node increases without increasing the number of instances. Option A is wrong because increasing the number of nodes adds more memory but also more cost; it might be more expensive than using fewer, larger nodes. Option C is wrong because it's generally not recommended to increase spark.executor.memory beyond the physical memory; it could cause YARN to kill containers. Option D is wrong because Parquet is already efficient; changing to a different format may not solve memory issues.

Answer

Increase the spark.executor.memory setting to 8 GB in the Spark configuration.

Answer

Increase the number of core nodes to 10 to distribute the data across more executors.

Answer

Change the input data format from Parquet to ORC to reduce memory footprint.

Question 3

A data engineer needs to transform CSV files arriving in S3 into Parquet format and partition them by date. The transformation should be event-driven and run immediately after each file is uploaded. Which approach is most efficient?

Accepted Answer

Use S3 event notification to trigger an AWS Glue job. AWS Glue jobs can be triggered directly by S3 event notifications, enabling event-driven, serverless transformation of CSV to Parquet with partitioning by date. Glue is optimized for this batch ETL workload, handling schema inference and partitioning efficiently without managing infrastructure, making it the most efficient choice for immediate, per-file transformation.

Answer

Use an S3 event notification to invoke a Lambda function that converts the file

Answer

Use an Amazon EMR cluster running Spark to process files as they arrive

Answer

Use Amazon Athena CREATE TABLE AS SELECT (CTAS) on a schedule

Question 4

A company has an S3 bucket with millions of objects. The data engineer needs to identify which objects are not accessed for 90 days to move them to a lower-cost storage class. Which feature should be used?

Accepted Answer

S3 Storage Class Analysis. S3 Storage Class Analysis (SCA) is the correct feature because it monitors access patterns across objects and provides recommendations for transitioning data to lower-cost storage classes based on last-access dates. SCA can analyze objects that have not been accessed for 90 days and generate a report to inform lifecycle policy creation, directly addressing the requirement to identify objects for cost optimization.

Answer

S3 Inventory

Answer

S3 Server Access Logs

Answer

S3 Event Notifications

Question 5

A company uses Amazon RDS for MySQL with Multi-AZ deployment. The primary instance fails, and automatic failover occurs. After failover, the data engineer notices that the new primary instance has a different DNS endpoint. Which TWO statements are true about this scenario? (Choose TWO.)

Accepted Answer

The DNS CNAME record is updated to point to the new primary.. When Amazon RDS performs automatic failover in a Multi-AZ deployment, it updates the DNS CNAME record for the primary DB instance to point to the new primary (formerly the standby). This ensures that applications using the original endpoint are transparently redirected to the new primary without manual intervention.

Answer

The standby instance is created in the same Availability Zone as the failed primary.

Answer

A manual DNS update is required to connect to the new primary.

Answer

The endpoint changes to the standby instance's endpoint.

Question 6

Match each AWS security service to its purpose in data protection.

Accepted Answer

AWS KMS: Manage encryption keys for data at rest and in transit. The correct matches are: AWS KMS for encryption key management, AWS IAM for access control, and AWS CloudTrail for API auditing. Common confusions include swapping these services' purposes.

Answer

AWS KMS: Control access to AWS resources through users, groups, and roles

Answer

AWS IAM: Manage encryption keys for data at rest and in transit

Answer

AWS CloudTrail: Manage encryption keys for data at rest and in transit

Question 7

A data engineer is troubleshooting a failed AWS Glue ETL job that reads from and writes to the S3 bucket 'example-bucket'. The job's IAM role has the policy shown in the exhibit. The job fails with an Access Denied error when writing to a prefix 'output/'. Which permission is MISSING?

Accepted Answer

s3:DeleteObject. The IAM policy grants s3:GetObject and s3:PutObject on 'example-bucket/*', which includes the 'output/' prefix, so write access is sufficient. However, AWS Glue ETL jobs often create temporary files or need to clean up staging data, requiring s3:DeleteObject permission. Without it, the job may fail with an Access Denied error when attempting to delete objects during the write process or when cleaning up after a failure. Option D (s3:DeleteObject) is the missing permission.

Answer

s3:PutObjectAcl

Answer

s3:GetBucketAcl

Answer

s3:ListBucket on the output prefix

Question 8

A company uses AWS Glue to process streaming data from Amazon Kinesis Data Streams. The data is JSON formatted and includes a timestamp field. The company wants to partition the output in Amazon S3 by date and hour, and ensure exactly-once processing semantics. Which combination of configurations should be used?

Accepted Answer

Enable checkpointing in the AWS Glue streaming job and specify an S3 location for checkpoint data.. AWS Glue streaming jobs require checkpointing to track the progress of data consumption from Kinesis Data Streams and to ensure exactly-once processing semantics. By enabling checkpointing and specifying an S3 location, Glue periodically saves the state of processed records, allowing it to resume from the last committed offset in case of failures, thus preventing duplicates or data loss.

Answer

Disable checkpointing and use the 'exactly_once' delivery option in Kinesis Data Streams.

Answer

Use Amazon DynamoDB as a checkpoint store by configuring the Glue job with a DynamoDB connection.

Answer

Use Kinesis Client Library (KCL) checkpointing with a DynamoDB table.

Question 9

A company is using AWS Glue ETL jobs to process data from Amazon S3 and write results back to S3. The jobs are failing intermittently with 'ThrottlingException' errors. Which TWO configurations would help reduce these errors?

Accepted Answer

Add retry logic with exponential backoff in the job script.. Adding retry logic with exponential backoff in the job script directly addresses transient 'ThrottlingException' errors by automatically retrying failed API calls after increasing delays. This is a standard best practice for handling service throttling in AWS Glue, as it reduces the request rate to stay within service limits without requiring infrastructure changes.

Answer

Decrease the number of DPUs for the job.

Answer

Enable GZIP compression on the output data.

Answer

Change the job type from Spark to Python shell.

Question 10

A CloudFormation template includes this IAM policy for a cross-account S3 upload use case. What is the purpose of the condition?

Accepted Answer

To ensure that uploaded objects grant full control to the bucket owner.. The condition in the IAM policy uses the `s3:x-amz-acl` key with a value of `bucket-owner-full-control`. This ensures that any object uploaded to the S3 bucket explicitly grants the bucket owner full control over the object, overriding the default behavior where the uploading account retains ownership. This is critical in cross-account uploads to prevent the uploading account from retaining exclusive access to the objects.

Answer

To enforce server-side encryption with KMS.

Answer

To limit the size of objects that can be uploaded.

Answer

To restrict uploads to only a specific AWS account.