DEA-C01 Practice Test 30 — 15 Questions

Question 1

A data engineer is optimizing an Amazon Redshift cluster that runs a nightly ETL workload. The engineer notices that the query performance degrades over the week and improves after a VACUUM operation. Which action should the engineer take to automate this maintenance and minimize impact on performance?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Schedule a VACUUM command using a query scheduler like Amazon EventBridge.. It enables automated scheduling of VACUUM using Amazon EventBridge or Redshift's query scheduler, ensuring regular maintenance without manual intervention. Option A is wrong because manual intervention only when performance degrades is not automated and allows performance to degrade unnecessarily. Option B is wrong because disabling auto vacuum and running manual VACUUM nightly is not as efficient or integrated as using a scheduler, and it may disrupt the ETL if not timed properly. Option D is wrong because dropping and recreating tables weekly is disruptive and loses data or requires complex re-creation logic, whereas VACUUM re-sorts data in place.

Answer

Run VACUUM manually only when performance degrades significantly.

Answer

Disable auto vacuum and run a manual VACUUM every night after the ETL.

Answer

Drop and recreate the tables weekly to avoid unsorted data.

Question 2

A company uses AWS DMS to migrate data from an on-premises Oracle database to Amazon RDS for PostgreSQL. The migration completes successfully, but the target database has inconsistent data. What should the team do to ensure data consistency?

Accepted Answer

Configure the DMS task to use 'Full LOB mode' with parallel threads and enable 'BatchApply'.. Using 'Full LOB mode' ensures that large objects are migrated without truncation, parallel threads improve throughput, and 'BatchApply' applies changes in batches to maintain transactional consistency. Option A is incorrect because 'Limited LOB mode' can truncate LOB data if the size exceeds the configured maximum, leading to data loss. Option B is incorrect because merely enabling 'Full LOB mode' without parallel threads and 'BatchApply' may not handle large volumes efficiently, potentially causing inconsistency under heavy load. Option C is incorrect because truncating target tables and restarting the task is a destructive approach that does not resolve the underlying migration issues and can cause data loss or downtime.

Answer

Use 'Limited LOB mode' and set the maximum LOB size to a higher value.

Answer

Enable 'Full LOB mode' in the DMS task settings.

Answer

Restart the DMS task after truncating the target tables.

Question 3

A data engineer is designing an ETL pipeline that uses AWS Glue to process data from an Amazon DynamoDB table and write results to an S3 bucket in Parquet format. The pipeline must handle schema changes in the source DynamoDB table. Which THREE steps should the engineer take to ensure the pipeline handles schema evolution? (Choose THREE.)

Accepted Answer

Use Glue's 'recast' transformation to handle type changes.. Options A, B, and E are correct. Option A: Glue's 'recast' transformation can handle type changes by converting data types as needed. Option B: Setting the Glue crawler to update the table's schema in the Data Catalog ensures that new columns or changes in the source DynamoDB table are reflected. Option E: Using Spark's 'mergeSchema' option when writing to S3 allows Parquet files to have differing schemas, enabling schema evolution. Option C is incorrect because converting Parquet to CSV does not help with schema evolution and may introduce data loss or inefficiency. Option D is incorrect because partitioning by date and deleting old partitions is a data retention strategy, not a schema evolution technique.

Answer

Convert the Parquet output to CSV to avoid schema constraints.

Answer

Partition the data by date and delete old partitions.

Question 4

A data engineer is setting up an AWS Glue job to process data from an Amazon S3 bucket. The job fails with an 'Access Denied' error. Which TWO IAM permissions are MOST likely missing from the Glue job's IAM role?

Accepted Answer

s3:PutObject. Options A and E are correct. A Glue job requires s3:GetObject to read input data from S3 and s3:PutObject to write output data to S3. Option B (kms:Decrypt) is only needed if the S3 objects are encrypted with KMS. Option C (dynamodb:GetItem) is not relevant unless the job accesses DynamoDB. Option D (glue:StartJobRun) is not needed for the job's execution itself; it is used to start a job run.

Answer

kms:Decrypt

Answer

dynamodb:GetItem

Answer

glue:StartJobRun

Question 5

A data engineer needs to monitor the number of records processed by an AWS Glue ETL job. Which CloudWatch metric should the engineer use?

Accepted Answer

glue.driver.aggregate.numRecords. Glue emits a 'glue.driver.aggregate.numRecords' metric for the number of records processed. Option A is wrong because 'glue.driver.aggregate.elapsedTime' is for time. Option C is wrong because 'glue.driver.aggregate.bytesRead' is for bytes. Option D is wrong because 'glue.driver.aggregate.recordsRead' is not a standard metric.

Answer

glue.driver.aggregate.elapsedTime

Answer

glue.driver.aggregate.bytesRead

Answer

glue.driver.aggregate.recordsRead

Question 6

A company runs a time-series forecasting model that writes results to an S3 bucket every 5 minutes. A downstream ETL job reads this data, but sometimes fails because it encounters incomplete files (zero bytes). What is the MOST reliable way to ensure the ETL job only processes complete files?

Accepted Answer

Use S3 Event Notifications to trigger a Lambda function that checks file size and then moves the file to a 'ready' prefix.. S3 Event Notifications can trigger a Lambda function upon object creation, which can check the file size (e.g., > zero bytes) and then copy the file to a 'ready' prefix, ensuring the ETL job only processes complete files. Option A is wrong because an S3 Lifecycle policy can delete small files but does not prevent the ETL from reading incomplete files. Option B is wrong because S3 Copy does not verify completeness. Option C is wrong because S3 Select still reads the file even if it is incomplete; it doesn't guarantee completeness.

Answer

Set an S3 Lifecycle policy to delete files smaller than 1 MB.

Answer

Use S3 Copy to move files to a 'processed' folder after the ETL job reads them.

Answer

Configure S3 Select to query the files and only return rows if the file is complete.

Question 7

A company uses Amazon S3 to store sensitive data. The data engineer needs to ensure that all data in transit between the S3 bucket and clients is encrypted. Which configuration should the engineer implement?

Accepted Answer

Create an S3 bucket policy that denies requests where SecureTransport is false.. An S3 bucket policy that denies requests where SecureTransport is false enforces HTTPS for all access, encrypting data in transit. Option A is wrong because CloudFront with SSL can enforce HTTPS but is not a direct S3 configuration and may incur additional costs. Option B is wrong because SSE-S3 only encrypts data at rest, not in transit. Option D is wrong because SSE-C also encrypts data at rest with a customer-provided key, not in transit.

Answer

Use Amazon CloudFront to serve the content and enable SSL.

Answer

Enable default encryption on the S3 bucket using SSE-S3.

Answer

Use SSE-C to encrypt the data with a customer-provided key.

Question 8

A data engineer is designing a disaster recovery plan for an Amazon Redshift data warehouse. The cluster is in us-east-1 and must be recoverable in us-west-2 with minimal data loss. Which THREE actions should the engineer take? (Choose THREE)

Accepted Answer

Create manual snapshots and copy them to us-west-2. Options A, D, and E are correct. To recover an Amazon Redshift cluster in a different region (us-west-2) from us-east-1, you need to have snapshots available in the target region. Manual snapshots (option A) can be copied to us-west-2 and are retained even if the cluster is deleted. Automated snapshots with a retention period (option D) ensure regular backups, and by configuring automated snapshot copy to us-west-2 (option E), these snapshots are automatically replicated to the target region for cross-region recovery. Option B (multi-AZ) provides high availability within a single region but does not help with cross-region disaster recovery. Option C (concurrent scaling) improves query performance under load, not disaster recovery.

Answer

Deploy Redshift in a multi-AZ configuration

Answer

Enable Redshift concurrent scaling

Question 9

A company uses AWS Kinesis Data Firehose to deliver streaming data to an Amazon S3 bucket. Recently, the delivery stream has been failing with the error 'S3 bucket does not exist'. The S3 bucket exists and the Firehose IAM role has s3:PutObject permissions. What is the most likely cause?

Accepted Answer

The S3 bucket is in a different AWS Region than the Firehose stream.. The most likely cause is that the S3 bucket is in a different AWS Region than the Firehose stream. AWS Kinesis Data Firehose requires the destination S3 bucket to be in the same region as the delivery stream. If the bucket is in a different region, Firehose will fail with a 'S3 bucket does not exist' error even though the bucket exists. Option A is incorrect because a misspelled bucket name would cause a similar error, but the error message specifically says the bucket does not exist, which can also happen if the bucket is in a different region. Option B is incorrect because default encryption does not affect the bucket's existence; Firehose can write to encrypted buckets with the proper permissions. Option D is incorrect because s3:ListBucket permission is not required for Firehose to deliver data; s3:PutObject is sufficient.

Answer

The S3 bucket name is misspelled in the Firehose configuration.

Answer

The S3 bucket has default encryption enabled.

Answer

The IAM role does not have s3:ListBucket permission.

Question 10

A company uses Amazon S3 to store log files from multiple applications. The logs are encrypted with AWS KMS (SSE-KMS). A data engineer needs to grant a new IAM user read-only access to the logs. The engineer attaches an S3 bucket policy that allows s3:GetObject and a KMS key policy that allows kms:Decrypt. However, the user still receives an 'Access Denied' error when trying to download an object. What is the MOST likely missing permission?

Accepted Answer

The user's IAM policy does not include kms:Decrypt permission.. To use SSE-KMS, the user needs kms:Decrypt, but also the IAM policy must allow kms:Decrypt, not just the key policy. The key policy alone is not sufficient if the IAM user's policy denies or does not allow the action. Option A is incorrect because s3:ListBucket is for listing, not downloading. Option B is incorrect because s3:GetObjectVersion is for versioned buckets. Option D is incorrect because kms:GenerateDataKey is for encryption, not decryption.

Answer

The user does not have s3:ListBucket permission on the bucket.

Answer

The user does not have s3:GetObjectVersion permission.

Answer

The user does not have kms:GenerateDataKey permission.

Question 11

A data engineer is troubleshooting an AWS Glue ETL job that fails with a 'java.lang.OutOfMemoryError: Java heap space' error. The job processes a 50 GB Parquet file from an S3 bucket. The job uses a G.1X DPU (16 GB memory) and default parameters. Which action should the engineer take to resolve the issue?

Accepted Answer

Change the worker type to G.2X (32 GB memory).. Changing the worker type to G.2X (32 GB memory) doubles the memory per worker, directly addressing the Java heap space error. Option B is incorrect because increasing the number of workers does not increase memory per worker; each G.1X DPU still has only 16 GB. Option C is incorrect because increasing the batch size would increase the amount of data loaded into memory per worker, potentially worsening the memory issue. Option D is incorrect because converting from Parquet to JSON typically increases file size and memory usage due to lack of compression and columnar storage.

Answer

Increase the number of workers from 2 to 4.

Answer

Increase the 'batch size' parameter in the DynamicFrame reader.

Answer

Convert the input data from Parquet to JSON format.

Question 12

A data engineer is building a real-time data pipeline using Amazon Kinesis Data Streams with a Lambda consumer. The data volume is 2 MB/s with average record size of 5 KB. The Lambda function processes records and writes to DynamoDB. Occasionally, the Lambda function fails with 'ProvisionedThroughputExceededException' on DynamoDB. What is the best way to handle this?

Accepted Answer

Configure a Lambda destination on failure to send records to an SQS dead-letter queue, and implement retry logic in Lambda.. Configuring a Lambda destination on failure to send unprocessed records to an SQS dead-letter queue, combined with retry logic in the Lambda function, provides a robust mechanism to handle DynamoDB throttling exceptions. This approach decouples the retry handling from the Kinesis stream, preventing the Lambda function from blocking the shard iterator and allowing the pipeline to continue processing other records while failed records are retried or investigated.

Answer

Replace Lambda with the Kinesis Client Library (KCL) running on EC2.

Answer

Increase the Lambda function's reserved concurrency to process more records in parallel.

Answer

Use DynamoDB Streams to capture the records and process them asynchronously.

Question 13

A company ingests clickstream data into Amazon S3 via Kinesis Data Firehose. The data arrives in 20 MB files every 2 minutes. The data engineering team needs to transform nested JSON into a flat structure before loading into Amazon Redshift. Which approach is most cost-effective and scalable?

Accepted Answer

Create an AWS Glue ETL job that runs on a schedule, using dynamic frames to flatten the data and write to S3 in Parquet. AWS Glue ETL jobs are designed for serverless, scalable data transformation, and using dynamic frames to flatten nested JSON and write to Parquet is both cost-effective (pay per DPU-hour) and scalable (automatically handles data volume). The 20 MB files arriving every 2 minutes are well-suited for Glue's batch processing, and Parquet output optimizes Redshift loading via COPY commands.

Answer

Run an Amazon EMR cluster with Spark to flatten the data and write back to S3

Answer

Use AWS Lambda to transform each file as it arrives in S3

Answer

Use Amazon Redshift Spectrum to query the nested JSON directly and create a view

Question 14

Refer to the exhibit. A data engineer attached this S3 bucket policy to the bucket 'example-bucket'. What is the effect of this policy?

Accepted Answer

It denies PutObject requests that do not use SSE-S3. The bucket policy denies PutObject requests that do not include the x-amz-server-side-encryption header with value AES256 (SSE-S3). This means any PutObject request without SSE-S3 encryption is denied. Therefore, the correct answer is B.

Answer

It allows all PutObject requests that do not use encryption

Answer

It denies all PutObject requests unless they use SSE-KMS

Answer

It denies all PutObject requests from anonymous users

Question 15

A company stores sensitive data in S3 and uses VPC Endpoints to restrict access. They want to ensure that data can only be accessed from their VPC. What configuration is required?

Accepted Answer

Add a bucket policy condition aws:SourceVpce. To restrict S3 bucket access to a specific VPC, use a bucket policy with the aws:SourceVpce condition key to specify the VPC endpoint ID. Option A (VPC Flow Logs) logs traffic but does not restrict access. Option B is correct. Option C (S3 Block Public Access) prevents public access but does not limit access to a specific VPC. Option D (security groups) are used for EC2 instances, not S3 buckets.

Answer

Configure VPC Flow Logs to monitor access

Answer

Enable S3 Block Public Access

Answer

Associate a security group with the S3 bucket