DEA-C01 Practice Test 2 — 30 Questions

Question 1

A company uses AWS Glue ETL jobs to transform data from Amazon S3 to Amazon Redshift. The job reads JSON files, applies schema mapping, and writes to a Redshift table. Recently, the job started failing with memory errors. The data volume has increased tenfold. Which approach should a data engineer take to resolve this issue with minimal code changes?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Increase the number of DPUs allocated to the Glue job.. Increasing the number of DPUs (Data Processing Units) allocated to the AWS Glue job directly addresses the memory constraint caused by a tenfold increase in data volume. Glue ETL jobs run on Apache Spark, which distributes data processing across executors; more DPUs provide more memory and compute capacity, allowing the job to handle larger datasets without code changes.

Answer

Switch from Spark to Python Shell job type.

Answer

Implement batch processing with smaller file sizes.

Answer

Use Redshift Spectrum to query data directly from S3.

Question 2

A company is building a data lake on AWS and must encrypt data at rest. Which services can provide server-side encryption for data stored in Amazon S3? (Choose TWO.)

Accepted Answer

SSE-S3. SSE-S3 (Option A) is correct because Amazon S3 server-side encryption with S3-managed keys (AES-256) encrypts objects at rest automatically, with AWS managing the key material and rotation. SSE-KMS (Option E) is also correct because it performs server-side encryption at rest using AWS KMS customer master keys (CMKs), giving you control over key policies, auditing, and rotation. Both are S3 server-side encryption modes applied after data reaches S3, satisfying the data-at-rest requirement. SSL/TLS (Option B) is wrong because it only encrypts data in transit between the client and S3, not at rest. AWS SDK client-side encryption (Option C) is wrong because it encrypts data before it is sent to S3, so it is client-side, not server-side. AWS CloudHSM (Option D) is wrong because it is a dedicated hardware security module service for key storage and cryptographic operations, not an S3 server-side encryption option by itself.

Answer

SSL/TLS

Answer

AWS SDK client-side encryption

Answer

AWS CloudHSM

Question 3

A CloudFormation template includes this IAM policy for a cross-account S3 upload use case. What is the purpose of the condition?

Accepted Answer

To ensure that uploaded objects grant full control to the bucket owner.. The condition in the IAM policy uses the `s3:x-amz-acl` key with a value of `bucket-owner-full-control`. This ensures that any object uploaded to the S3 bucket explicitly grants the bucket owner full control over the object, overriding the default behavior where the uploading account retains ownership. This is critical in cross-account uploads to prevent the uploading account from retaining exclusive access to the objects.

Answer

To enforce server-side encryption with KMS.

Answer

To limit the size of objects that can be uploaded.

Answer

To restrict uploads to only a specific AWS account.

Question 4

A company uses Amazon Redshift for data warehousing. The security team requires that all data loading into Redshift be encrypted in transit. Which configuration ensures this requirement is met?

Accepted Answer

Configure the Redshift cluster to require SSL connections. Configuring the Redshift cluster to require SSL connections (require_ssl = true in the parameter group) enforces TLS for all client connections, ensuring data is encrypted in transit during loads. This is the direct configuration that satisfies the in-transit encryption requirement.

Answer

Use a VPC security group to restrict access

Answer

Use client-side encryption before loading data

Answer

Enable server-side encryption on the Redshift cluster

Question 5

A data engineer is troubleshooting an access denied error when an AWS Lambda function tries to decrypt an object encrypted with the KMS key 'abc123'. The Lambda function's execution role has the above policy attached. What is the likely cause of the error?

Accepted Answer

The KMS key policy does not grant the Lambda role decrypt permission. The error occurs because KMS requires both the IAM policy and the key policy to grant the necessary permissions. While the IAM policy attached to the Lambda execution role includes kms:Decrypt, the KMS key policy for 'abc123' does not explicitly grant the Lambda role permission to call kms:Decrypt. Since KMS key policies act as a resource-based policy, they must allow the principal (the Lambda role) to perform the action; otherwise, the request is denied even if the IAM policy allows it.

Answer

The Deny statement blocks all decrypt requests

Answer

The Lambda function does not have permission to call kms:GenerateDataKey

Answer

The IAM policy does not include kms:Decrypt permission

Question 6

A data engineer uses AWS Glue to process data from S3. The Glue job frequently fails with 'Out of Memory' errors. The job reads several large compressed files. What is the MOST effective way to resolve this issue without changing the code?

Accepted Answer

Increase the number of G.1X workers or use G.2X workers. Increasing the number of G.1X workers or switching to G.2X workers directly addresses the 'Out of Memory' errors by allocating more memory per Spark executor. G.1X provides 16 GB of memory per worker, while G.2X provides 32 GB, which is critical when processing large compressed files because decompression and transformation require additional heap space. This approach resolves the issue without modifying the job code, as it only changes the resource configuration.

Answer

Convert the compressed files to uncompressed format before processing

Answer

Repartition the data to fewer partitions

Answer

Increase the job timeout setting

Question 7

A data engineer is building a data ingestion pipeline using AWS Glue. The source is an Amazon DynamoDB table, and the target is an Amazon S3 data lake in Parquet format. The pipeline must handle large volumes and ensure exactly-once processing. Which THREE features should the engineer use together to achieve this? (Choose THREE.)

Accepted Answer

Configure the Glue job to convert data to Parquet format.. Converting data to Parquet format is a core requirement for an S3 data lake, as Parquet offers columnar storage, compression, and efficient querying via services like Amazon Athena and Amazon Redshift Spectrum. AWS Glue natively supports Parquet as an output format, enabling the engineer to specify it in the job's output schema or transformation logic.

Answer

Use Amazon Kinesis Data Streams to capture DynamoDB Streams changes.

Answer

Use Amazon S3 Object Lambda to transform data on the fly.

Question 8

A company wants to enforce that all data in an S3 bucket is encrypted at rest using AWS KMS. Which bucket policy condition key should be used?

Accepted Answer

s3:x-amz-server-side-encryption with value aws:kms. The condition key `s3:x-amz-server-side-encryption` with value `aws:kms` enforces that objects uploaded to the S3 bucket must be encrypted using AWS KMS (SSE-KMS). This bucket policy condition ensures that any PUT request includes the `x-amz-server-side-encryption` header set to `aws:kms`, thereby enforcing encryption at rest with KMS-managed keys.

Answer

s3:x-amz-acl with value bucket-owner-full-control

Answer

s3:x-amz-server-side-encryption with value AES256

Answer

aws:SourceIp with value 10.0.0.0/8

Question 9

A company runs an AWS Glue ETL job that reads data from Amazon S3, transforms it, and writes back to S3 in a different partition structure. The job uses the 'spark.sql.shuffle.partitions' option set to 200. After the job completes, the output has many small files. The data engineer wants to minimize the number of output files while maintaining job performance. Which action should the engineer take?

Accepted Answer

Use 'coalesce(n)' with n based on target file size (e.g., 128 MB) before writing.. 'coalesce(n)' reduces the number of partitions without triggering a full shuffle, allowing you to control the number of output files based on a target file size (e.g., 128 MB). This minimizes small files while preserving job performance, as coalesce is a narrow transformation that avoids the overhead of a shuffle. In contrast, 'repartition(n)' would cause a full shuffle, degrading performance.

Answer

Enable S3 multipart upload for the Glue job.

Answer

Increase the 'spark.sql.shuffle.partitions' to 500.

Answer

Reduce the 'spark.sql.shuffle.partitions' to 50.

Question 10

A company uses AWS Glue to run ETL jobs that process data from Amazon S3 and load into Amazon Redshift. The jobs have recently started failing with 'Out of Memory' errors. The data volume has increased 3x in the past month. Which is the MOST effective solution to resolve this issue without redesigning the job?

Accepted Answer

Increase the number of Glue workers (DPUs) for the job.. Glue ETL jobs run on a Spark cluster sized by the number of DPUs (workers). Out-of-memory errors during a 3x data volume increase indicate the existing worker count cannot hold the partitions and shuffle data in memory. Increasing the number of Glue workers adds executor memory and parallelism, which is the most direct fix without redesigning the job.

Answer

Use Amazon Athena instead of Glue for the transformation.

Answer

Rewrite the job to use Spark SQL instead of PySpark.

Answer

Increase the number of partitions in the input S3 data.

Question 11

A company is migrating its on-premises Oracle database to Amazon Aurora PostgreSQL. The migration must have minimal downtime. The source database is 2 TB and runs on a single server. Which AWS service should be used for the migration?

Accepted Answer

AWS Database Migration Service (DMS). AWS Database Migration Service (DMS) is the correct choice because it supports homogeneous migrations from Oracle to Amazon Aurora PostgreSQL with minimal downtime using ongoing replication (change data capture). DMS can handle a 2 TB source database by performing a full load followed by continuous replication of changes from the Oracle redo logs, allowing the target Aurora database to stay nearly in sync until cutover.

Answer

AWS DataSync

Answer

Amazon S3 Transfer Acceleration

Answer

AWS Snowball Edge

Question 12

A company uses AWS Glue to process streaming data from Amazon Kinesis Data Streams. The data is JSON formatted and includes a timestamp field. The company wants to partition the output in Amazon S3 by date and hour, and ensure exactly-once processing semantics. Which combination of configurations should be used?

Accepted Answer

Enable checkpointing in the AWS Glue streaming job and specify an S3 location for checkpoint data.. AWS Glue streaming jobs require checkpointing to track the progress of data consumption from Kinesis Data Streams and to ensure exactly-once processing semantics. By enabling checkpointing and specifying an S3 location, Glue periodically saves the state of processed records, allowing it to resume from the last committed offset in case of failures, thus preventing duplicates or data loss.

Answer

Disable checkpointing and use the 'exactly_once' delivery option in Kinesis Data Streams.

Answer

Use Amazon DynamoDB as a checkpoint store by configuring the Glue job with a DynamoDB connection.

Answer

Use Kinesis Client Library (KCL) checkpointing with a DynamoDB table.

Question 13

A company needs to migrate an on-premises 10 TB PostgreSQL database to Amazon RDS for PostgreSQL with minimal downtime. Which AWS service should be used for the migration?

Accepted Answer

AWS Database Migration Service (DMS). AWS Database Migration Service (DMS) is the correct choice because it is specifically designed for migrating databases to AWS with minimal downtime. It supports continuous replication from an on-premises PostgreSQL source to Amazon RDS for PostgreSQL using change data capture (CDC), allowing the source database to remain operational during the migration.

Answer

AWS Storage Gateway

Answer

AWS Snowball Edge

Answer

AWS DataSync

Question 14

A company uses AWS DMS to migrate an on-premises PostgreSQL database to Amazon RDS for PostgreSQL. After initial load, ongoing replication is set up. The replication task shows 'Task status: failed with error: The specified LSN is not available in the source database logs.' What is the most likely cause?

Accepted Answer

The source database's WAL retention period is too short, and required logs have been purged.. The error 'The specified LSN is not available in the source database logs' indicates that AWS DMS is trying to read a Write-Ahead Log (WAL) position that has already been purged. PostgreSQL sources require sufficient WAL retention to allow DMS to catch up during ongoing replication (CDC). If the WAL segments are recycled or removed before DMS reads them, the replication task fails with this specific LSN error.

Answer

DMS does not support PostgreSQL as a source for ongoing replication.

Answer

The source database's network security group blocks outbound traffic to DMS.

Answer

The full load was incomplete, preventing CDC from starting.

Question 15

A data engineer is troubleshooting a failed AWS Glue Crawler. The crawler logs show 'Insufficient permissions to access S3 bucket'. What should the engineer do to resolve this?

Accepted Answer

Update the IAM role used by the crawler to include S3 read permissions. The AWS Glue Crawler uses an IAM role to access data sources. The error 'Insufficient permissions to access S3 bucket' indicates that the IAM role attached to the crawler lacks the necessary S3 read permissions (e.g., s3:GetObject, s3:ListBucket). Updating the IAM role's policy to include these permissions resolves the issue, as the crawler operates under that role, not under a specific IAM user.

Answer

Grant the crawler's IAM user access to the bucket

Answer

Attach a VPC endpoint to the S3 bucket

Answer

Enable S3 default encryption on the bucket

Question 16

A company wants to migrate its on-premises MySQL database to Amazon RDS for MySQL with minimal downtime. Which AWS service should be used for the migration?

Accepted Answer

AWS Database Migration Service (DMS). AWS Database Migration Service (DMS) is purpose-built for migrating databases to AWS with minimal downtime by using ongoing replication (change data capture, CDC) from the source MySQL database to the target Amazon RDS for MySQL instance. This allows the source to remain fully operational during the migration, meeting the minimal-downtime requirement.

Answer

AWS Schema Conversion Tool (SCT)

Answer

AWS DataSync

Answer

AWS Direct Connect

Question 17

Refer to the exhibit. A data engineer applies the following S3 bucket policy to an S3 bucket. What does this policy enforce?

Accepted Answer

Requires that all objects uploaded to the bucket be encrypted with SSE-KMS. The bucket policy uses a Deny effect with a condition that checks if the s3:x-amz-server-side-encryption header is not 'aws:kms'. This means any PutObject request that does not use SSE-KMS will be denied. Therefore, the policy enforces that all objects uploaded must be encrypted with SSE-KMS. Option A is incorrect because the policy does not mention SSE-S3; it denies if not SSE-KMS. Option B is incorrect because it requires SSE-KMS, not SSE-S3. Option C is incorrect because the policy only allows SSE-KMS, not any type of server-side encryption. Option D is correct.

Answer

Denies all uploads unless SSE-S3 is used

Answer

Allows only SSE-S3 encrypted uploads

Answer

Allows any type of server-side encryption

Question 18

A data engineer is configuring a VPC for an Amazon Redshift cluster. The cluster must be accessible only from a specific on-premises network via a Direct Connect connection. Which TWO actions should the engineer take to meet this requirement? (Choose TWO.)

Accepted Answer

Configure a security group to allow inbound traffic from the on-premises CIDR block.. Option B is correct because a security group acts as the stateful firewall for the Redshift cluster, and adding an inbound rule that permits the on-premises CIDR block on the Redshift port (5439) is required to allow that specific network to reach the cluster. Option C is correct because the network ACL is the stateless subnet-level control, so it must also include an inbound rule allowing the on-premises CIDR block (and corresponding outbound return traffic) for the connection to succeed. Option A is not needed because Enhanced VPC Routing only affects how COPY/UNLOAD traffic is routed to S3 or other services, not client access from on-premises. Option D is wrong because a VPC endpoint is for private access to AWS services like S3, not for enabling on-premises clients to reach a Redshift cluster. Option E is wrong because making the cluster publicly accessible would expose it to the internet, violating the requirement to restrict access to the on-premises network only.

Answer

Enable Redshift Enhanced VPC Routing.

Answer

Create a VPC endpoint for Redshift.

Answer

Make the Redshift cluster publicly accessible.

Question 19

A company uses Amazon Kinesis Data Firehose to deliver streaming data to Amazon S3. The data is in JSON format. The delivery stream is configured with a buffer size of 5 MB and a buffer interval of 60 seconds. However, the data engineer notices that S3 objects are being created with sizes much smaller than 5 MB. What is a likely cause?

Accepted Answer

The incoming data rate is too low, causing the buffer interval to trigger before reaching the buffer size.. Kinesis Data Firehose delivers data to S3 when either the buffer size (5 MB) or the buffer interval (60 seconds) is reached, whichever occurs first. If the incoming data rate is low, the buffer interval will expire before accumulating 5 MB of data, resulting in smaller S3 objects.

Answer

The data is being compressed before delivery, reducing object size.

Answer

The data transformation lambda is splitting records into smaller ones.

Answer

The S3 bucket is configured with a lifecycle policy that splits objects.

Question 20

A company has a multi-account AWS environment with a centralized data lake in the Security account. Data producers in other accounts use AWS Glue to write data to S3 buckets in the Security account. The Security account uses AWS Lake Formation to manage permissions. The data engineer is setting up cross-account access so that users in the Producer account can query the data using Athena in their own account. The engineer has registered the S3 buckets and Data Catalog tables in Lake Formation. The IAM roles in the Producer account have the necessary permissions. However, when a user in the Producer account tries to query the table, they get an AccessDenied error. The error message indicates that the principal is not authorized to perform lakeformation:GetTable on the resource. What is the most likely cause?

Accepted Answer

The Lake Formation permissions in the Security account do not include a grant to the Producer account's IAM role.. The error explicitly states the principal is not authorized to perform lakeformation:GetTable, which is a Lake Formation permission check, not an S3, KMS, or Glue resource policy check. In Lake Formation cross-account access, the data owner (Security account) must grant table and data location permissions directly to the external IAM principal (the Producer account's role) using the Lake Formation GrantPermissions API or console. Without this explicit grant, Lake Formation denies the GetTable call before any S3 or KMS access is even attempted. Since the IAM roles already have the necessary permissions, the missing piece is the Lake Formation grant in the Security account.

Answer

The Glue Data Catalog resource policy is missing a statement to allow cross-account access.

Answer

The S3 bucket policy does not allow the Producer account's IAM role to read the data.

Answer

The KMS key policy does not allow the Producer account's IAM role to decrypt objects.