DEA-C01 Practice Test 30 — 15 Questions

Question 1

A data engineer is setting up a data pipeline that ingests streaming data from Amazon Kinesis Data Streams into an S3 data lake using Amazon Kinesis Data Firehose. The data contains personally identifiable information (PII). The security team requires that all data be encrypted at rest in S3 using an AWS KMS customer managed key (CMK) that is specific to the application. Additionally, the data must be encrypted in transit between all services. The engineer creates the KMS key and configures Firehose to use server-side encryption with the key for the S3 destination. However, Firehose delivery fails with an error indicating that the KMS key is not accessible. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The KMS key policy does not grant the firehose.amazonaws.com service principal the required permissions.. When Firehose writes to S3 using SSE-KMS with a customer managed key, the Firehose service principal (firehose.amazonaws.com) must be granted kms:GenerateDataKey and kms:Decrypt in the KMS key policy. Without that grant, Firehose cannot obtain the data key to encrypt objects, and delivery fails with an access-denied error referencing the KMS key. The key policy is the resource-based control that authorizes the service principal.

Answer

The Kinesis data stream is not encrypted at rest.

Answer

The Firehose delivery stream is not in the same region as the KMS key.

Answer

The S3 bucket policy does not grant the Firehose delivery stream access to write objects.

Question 2

Refer to the exhibit. A data engineer ran the CLI command to check the configuration of an RDS instance named 'mydb'. Which statement accurately describes the current configuration?

Accepted Answer

The database is a Single-AZ deployment and is not a read replica. The CLI command output shows 'DBInstanceStatus: available' and 'MultiAZ: False', indicating the database is running as a Single-AZ deployment. Additionally, the absence of a 'SourceDBInstanceIdentifier' field confirms it is not a read replica. The 'ReadReplicaSourceDBInstanceIdentifier' is not present, which would be required if it were a read replica.

Answer

The database is in the 'stopped' state

Answer

The database is a read replica of another instance

Answer

The database is a Multi-AZ deployment

Question 3

A company has an Amazon Redshift cluster with a mix of frequently accessed hot data and rarely accessed cold data. They want to reduce storage costs without affecting query performance for the hot data. Which strategy is MOST effective?

Accepted Answer

Use RA3 nodes with managed storage to automatically offload cold data to Amazon S3.. RA3 nodes with managed storage automatically separate compute and storage, offloading cold data to Amazon S3 while keeping hot data on local SSD for fast queries. This reduces storage costs without manual intervention or affecting hot data performance.

Answer

Reduce the number of nodes and increase the number of slices.

Answer

Create external tables in Redshift Spectrum to query cold data in S3.

Answer

Use Dense Compute nodes and unload cold data to Amazon S3 manually.

Question 4

A data engineer is using AWS Glue ETL to transform data from an S3 data lake. The job fails with a memory error. Which approach should be used to resolve this issue without major code changes?

Accepted Answer

Increase the number of DPUs allocated to the Glue job. Increasing the number of DPUs (Data Processing Units) allocated to the Glue job provides more memory and parallelism. Option A is wrong because rewriting in PySpark is a major code change. Option B is wrong because using a smaller file format may not address memory issues. Option D is wrong because using a different service is unnecessary.

Answer

Rewrite the ETL script in PySpark instead of Scala

Answer

Change the input file format from CSV to Parquet

Answer

Use Amazon EMR instead of AWS Glue

Question 5

A company uses Amazon RDS for MySQL to store transactional data. The database contains sensitive financial information. The company's security policy requires that all data at rest be encrypted using a customer-managed KMS key. The database was originally launched without encryption at rest. The security team now needs to enable encryption without significant downtime. What should they do?

Accepted Answer

Create a snapshot of the database, copy the snapshot with encryption enabled, and restore a new DB instance from the encrypted snapshot.. RDS for MySQL does not support enabling encryption at rest on an existing unencrypted DB instance. The only supported method is to take a snapshot, copy the snapshot with encryption enabled using a customer-managed KMS key, and then restore a new DB instance from that encrypted snapshot. This approach requires a brief downtime during the switchover but avoids a full data migration.

Answer

Enable encryption by modifying the DB instance's storage type to 'encrypted'.

Answer

Use the AWS DMS (Database Migration Service) to migrate data to a new encrypted RDS instance.

Answer

Modify the DB instance and enable encryption under the 'Storage' settings.

Question 6

A data pipeline uses Amazon Kinesis Data Firehose to deliver data to Amazon S3. The delivery occasionally fails with 'Firehose is throttled'. What should be done to reduce throttling?

Accepted Answer

Increase the buffer size and buffer interval. Increasing the buffer size and buffer interval gives Kinesis Data Firehose more time and data volume to accumulate before delivering to S3, reducing the frequency of PutRecord.Batch calls to the underlying Kinesis stream. This directly mitigates throttling by lowering the request rate, as Firehose throttling typically occurs when the per-shard write throughput limit (1,000 records/second or 1 MB/second) is exceeded.

Answer

Enable compression on the Firehose delivery stream

Answer

Decrease the buffer size to flush more frequently

Answer

Increase the number of shards in the Kinesis stream

Question 7

A company stores data in Amazon S3 with server-side encryption using AWS KMS (SSE-KMS). The data engineer needs to give a third-party auditor read-only access to the encrypted objects. The auditor has an AWS account. Which strategy should be used?

Accepted Answer

Update the S3 bucket policy to allow access from the auditor's account and update the KMS key policy to allow the auditor's account to decrypt.. SSE-KMS requires two independent authorizations: the caller must have s3:GetObject on the bucket (via bucket policy or IAM) AND kms:Decrypt on the KMS key (via key policy or IAM). Because the auditor is in a separate AWS account, both the S3 bucket policy and the KMS key policy must explicitly grant the external account access. This is the only option that satisfies both layers for cross-account access.

Answer

Generate a presigned URL for each object the auditor needs to access.

Answer

Copy the objects to a new bucket encrypted with SSE-S3 and share that bucket.

Answer

Grant the auditor's IAM role permission to use the KMS key.

Question 8

A company uses Amazon Kinesis Data Firehose to ingest log data from web servers into Amazon S3. The data is in JSON format and each record is approximately 2 KB. The delivery stream is configured to buffer incoming records for 60 seconds or 5 MB, whichever comes first. The company notices that the data in S3 is delayed by up to 5 minutes during peak hours. Which action would most effectively reduce the delivery latency?

Accepted Answer

Decrease the buffer interval to 15 seconds.. The observed delay of up to 5 minutes during peak hours indicates that the buffer size threshold (5 MB) is rarely reached because each record is only ~2 KB, so the delivery stream relies on the buffer interval (60 seconds) to trigger delivery. By decreasing the buffer interval to 15 seconds, Kinesis Data Firehose will push data to S3 more frequently, directly reducing the maximum latency from 60 seconds to 15 seconds per batch, which eliminates the compounding delays caused by queuing during high-throughput periods.

Answer

Increase the buffer size to 10 MB to allow more records per delivery.

Answer

Enable compression (GZIP) on the delivery stream.

Answer

Enable data transformation with AWS Lambda to convert JSON to Parquet.

Question 9

A company stores sensitive financial data in an Amazon Redshift cluster. The data engineer must ensure that all queries are logged for audit purposes and that the logs are stored in Amazon S3 with server-side encryption. Which THREE steps should the data engineer take to meet these requirements?

Accepted Answer

Configure audit logs to be stored in an Amazon S3 bucket.. Amazon Redshift audit logs can be configured to be stored directly in an Amazon S3 bucket, which is a native feature for exporting connection logs, user logs, and query logs. This satisfies the requirement to log all queries for audit purposes without relying on external services.

Answer

Enable encryption on the Redshift cluster.

Answer

Enable AWS CloudTrail to log Redshift queries.

Question 10

A data engineer needs to transform data in Amazon S3 using AWS Glue. The job must handle schema evolution and partition pruning. Which THREE features should be used?

Accepted Answer

AWS Glue Data Catalog. AWS Glue Data Catalog (A) is correct because it stores the table definitions, schemas, and partition metadata that Glue ETL jobs reference, and it is the component that must be updated when schema evolution occurs so the job can read new columns. AWS Glue crawlers (D) are correct because they automatically scan S3 data, detect new or changed columns, and update the Data Catalog with revised schemas and newly discovered partitions, which is exactly how schema evolution is handled. Partition indexes (E) are correct because they accelerate partition pruning by allowing Glue and Athena to look up partitions without listing the entire catalog, dramatically reducing planning time for highly partitioned tables. AWS Glue job bookmarks (B) only track previously processed data to support incremental loads and do not address schema evolution or partition pruning. AWS Glue FindMatches transform (C) is a machine-learning transform for deduplicating and matching records, which is unrelated to schema evolution or partition pruning.

Answer

AWS Glue job bookmarks

Answer

AWS Glue FindMatches transform

Question 11

A company is using AWS Database Migration Service (DMS) to migrate a 2 TB MySQL database to Amazon Aurora MySQL. The migration is taking longer than expected. The source database is in a different AWS region. Which change would MOST likely improve the migration speed?

Accepted Answer

Increase the number of parallel tables being migrated.. DMS migrates tables in parallel, and the number of tables loaded concurrently is controlled by the replication task's parallel load settings. Increasing the number of parallel tables (or enabling parallel load with a higher thread count) directly increases throughput when the bottleneck is per-table serialization, which is the most likely cause of a slow 2 TB MySQL-to-Aurora migration. This is the change most likely to improve speed without altering the source or target architecture.

Answer

Use a smaller DMS replication instance to reduce costs.

Answer

Use a Multi-AZ deployment for the DMS replication instance in the target region.

Answer

Disable binary logging on the source MySQL database.

Question 12

A company runs a real-time analytics platform using Amazon Kinesis Data Streams with a shard count of 10. The data is consumed by an AWS Lambda function that writes to an Amazon DynamoDB table. The DynamoDB table has a partition key of 'user_id' and a sort key of 'timestamp'. The table is provisioned with 5000 RCUs and 5000 WCUs. Recently, the application experienced increased write latency and throttling errors (ProvisionedThroughputExceededException) on the DynamoDB table. The CloudWatch metrics show that ConsumedWriteCapacityUnits averages 4500 with occasional spikes to 6000. The Lambda function’s concurrency is set to 1000. The data engineer suspects the issue is due to hot partitions. Upon investigation, the engineer finds that a small number of users generate a disproportionately large amount of data. Which course of action would best resolve the throttling while minimizing cost?

Accepted Answer

Enable DynamoDB adaptive capacity and implement write sharding by adding a suffix to the partition key for high-volume users. The root cause is hot partitions caused by a small number of high-volume users. Enabling DynamoDB adaptive capacity allows the table to automatically adjust throughput to accommodate uneven access patterns, but the key fix is write sharding — adding a random or calculated suffix to the partition key for those high-volume users. This distributes writes across multiple physical partitions, eliminating the hot spot without requiring a global increase in provisioned capacity, thus resolving throttling while minimizing cost.

Answer

Increase the provisioned WCUs to 10000 to handle spikes

Answer

Switch the DynamoDB table to on-demand capacity mode

Answer

Reduce the Lambda function concurrency to 100 to limit write requests

Question 13

Refer to the exhibit. An IAM policy is attached to a user. What is the security implication of this policy?

Accepted Answer

The policy grants excessive permissions, violating least privilege.. The policy, which grants full S3 access to all resources, violates the principle of least privilege by providing excessive permissions. Option A is incorrect because the policy does not only allow read access; it allows all actions. Option B is incorrect because the use of asterisks is valid syntax in IAM policies. Option C is incorrect because the policy is overly permissive, not restrictive.

Answer

The policy only allows read access.

Answer

The policy is invalid because it uses asterisks.

Answer

The policy is too restrictive.

Question 14

A company wants to implement least privilege access for its data lake on S3. Which THREE practices should be followed? (Choose THREE.)

Accepted Answer

Use S3 bucket policies for cross-account access. Option B is correct because S3 bucket policies are resource-based policies that explicitly define which principals (including cross-account identities) may perform which s3: actions on the bucket, allowing tightly scoped cross-account access instead of broad grants. Option C is correct because S3 access points provide dedicated endpoints with their own access point policies and can be restricted to a VPC via network origin controls, enforcing network-level least privilege for data lake access. Option E is correct because IAM policies attached to users and roles grant only the specific S3 actions and resources needed, which is the core mechanism for implementing least privilege. Option A is incorrect because granting s3:* violates least privilege by allowing all S3 operations. Option D is incorrect because disabling S3 Block Public Access increases exposure risk and does not support least privilege.

Answer

Grant s3:* to all users for simplicity

Answer

Disable S3 Block Public Access to allow flexibility

Question 15

A data engineer is designing a data lake on Amazon S3. Data is ingested from multiple sources in JSON format. The engineer needs to optimize query performance for Amazon Athena while minimizing storage costs. Which storage strategy should the engineer use?

Accepted Answer

Convert data to Parquet format and partition by date.. Parquet is a columnar storage format that significantly reduces data scan volume in Amazon Athena, which charges per byte scanned. Partitioning by date further limits the data scanned to only relevant partitions, optimizing both query performance and cost. JSON and CSV are row-based formats that require full scans, and Glacier is unsuitable for interactive querying.

Answer

Store data as CSV files in a single S3 bucket without prefixes.

Answer

Store data as JSON files in a single prefix without partitioning.

Answer

Store compressed JSON files in Amazon S3 Glacier.