DEA-C01 Practice Test 3 — 30 Questions

Question 1

A company is building a data lake on Amazon S3 and wants to ingest data from multiple AWS services (CloudTrail, VPC Flow Logs, and ALB logs). The data should be stored in a central S3 bucket with a common partitioning scheme. Which service can be used to collect and centralize this data with minimal configuration?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure each source service to deliver logs directly to the central S3 bucket.. CloudTrail, VPC Flow Logs, and ALB logs can each be configured to deliver logs directly to a specified S3 bucket, including a central bucket, with no intermediary service required. This approach minimizes configuration overhead and avoids data movement costs, as each service writes natively to S3 using its own built-in delivery mechanism.

Answer

Use AWS Data Pipeline to copy logs from each source S3 bucket to the central bucket.

Answer

Use AWS Glue to crawl the logs from each source and write to a central S3 bucket.

Answer

Set up Amazon Kinesis Data Firehose to ingest logs from each service and write to S3.

Question 2

A data engineer needs to store archival data that is rarely accessed but must be retained for 7 years. The data should be retrievable within 12 hours. Which Amazon S3 storage class is MOST cost-effective?

Accepted Answer

S3 Glacier Deep Archive. S3 Glacier Deep Archive is the most cost-effective storage class for archival data that is rarely accessed and requires a 7-year retention period, with retrieval times up to 12 hours. It offers the lowest storage cost among S3 classes, making it ideal for long-term retention of data that does not need immediate access.

Answer

S3 Intelligent-Tiering

Answer

S3 Glacier Flexible Retrieval

Answer

S3 Standard

Question 3

An organization is using AWS Glue to process sensitive data. The data is stored in S3 with server-side encryption using AWS KMS (SSE-KMS). The Glue job fails with an error indicating that it cannot read the data. The IAM role used by Glue has the following policy. What is missing?

Accepted Answer

The kms:Decrypt permission on the KMS key. The Glue job fails because the IAM role lacks the kms:Decrypt permission on the KMS key used for SSE-KMS encryption. When S3 objects are encrypted with SSE-KMS, any principal reading the object must have both s3:GetObject on the object and kms:Decrypt on the KMS key. Without kms:Decrypt, S3 returns an AccessDenied error even though the s3:GetObject permission is present.

Answer

The s3:GetObject permission on the bucket

Answer

The kms:GenerateDataKey permission on the KMS key

Answer

The kms:ReEncrypt permission on the KMS key

Question 4

Refer to the exhibit. A data engineer queries AWS CloudTrail to investigate a PutObject event. What does the exhibit reveal about the object sensitive.csv?

Accepted Answer

The object was uploaded with server-side encryption using AWS KMS.. The CloudTrail event contains `x-amz-server-side-encryption: aws:kms`, which confirms the object was uploaded with server-side encryption using AWS KMS (SSE-KMS). Option A is incorrect because the event shows a successful upload, not a failure. Option C is incorrect because the event indicates encryption was applied. Option D is incorrect because SSE-S3 would show `AES256`, not `aws:kms`.

Answer

The upload failed due to encryption mismatch.

Answer

The object was not encrypted at rest.

Answer

The object was encrypted with SSE-S3.

Question 5

A company needs to ingest data from multiple SaaS applications (Salesforce, Marketo) into Amazon S3 for analytics. The data volume is moderate (~100 GB per day). The pipeline must handle schema changes, deduplicate records, and provide low latency (under 1 hour). Which THREE services should be used? (Choose THREE.)

Accepted Answer

Amazon AppFlow. Amazon AppFlow is the correct choice because it is a fully managed integration service specifically designed to transfer data from SaaS applications like Salesforce and Marketo to AWS services such as Amazon S3. It supports incremental transfers, handles schema changes automatically via its schema evolution feature, and can achieve sub-hour latency for moderate data volumes (~100 GB/day) without custom coding.

Answer

Amazon Kinesis Data Streams

Answer

AWS Database Migration Service (DMS)

Question 6

Which THREE factors should be considered when choosing a partition key for an Amazon DynamoDB table?

Accepted Answer

If the table has a write-heavy workload, the partition key should distribute writes evenly.. Option B is correct because a write-heavy workload requires the partition key to spread write traffic across many partitions; otherwise a hot partition throttles throughput, since each partition supports a limited write capacity (up to 1,000 WCU per partition). Option C is correct because DynamoDB retrieves items by partition key, so aligning the key with the most common query access pattern enables efficient Query operations instead of expensive Scan operations. Option E is correct because high cardinality produces many distinct partition key values, which distributes items and traffic evenly across partitions and avoids hot partitions. Option A is not a valid factor because item size does not determine partition key choice; DynamoDB partitions data by key value, and large items only consume more capacity, not improve partitioning. Option D is not a valid factor because RCU consumption is driven by item size and consistency model, not by selecting a partition key to minimize reads.

Answer

The partition key should be chosen to maximize the size of items in each partition.

Answer

The partition key should be chosen to minimize read capacity unit consumption.

Question 7

Match each AWS database service to its primary use case.

Accepted Answer

Amazon RDS: Relational database for online transaction processing (OLTP) workloads.. Correct matches: RDS -> OLTP relational, DynamoDB -> NoSQL low-latency, Redshift -> data warehousing, ElastiCache -> in-memory caching. Common confusions include swapping RDS and DynamoDB use cases.

Answer

Amazon RDS: NoSQL key-value database for low-latency applications.

Answer

Amazon DynamoDB: Relational database for OLTP workloads.

Question 8

A financial services company uses AWS Glue ETL jobs to process sensitive customer data stored in Amazon S3. The data is encrypted at rest with SSE-KMS using a customer-managed key. Recently, the security team discovered that the Glue job's IAM role has an overly permissive policy that allows the 'kms:Decrypt' action for all KMS keys in the account. The company wants to follow the principle of least privilege. The Glue job runs on a schedule and reads from a specific S3 bucket. The security team needs to update the IAM policy to restrict KMS decryption to only the specific key used for that bucket. What should they do?

Accepted Answer

Update the policy to allow 'kms:Decrypt' only for the specific KMS key ARN used by the S3 bucket containing the customer data.. To follow least privilege, the IAM role for the Glue job should only have access to decrypt using the specific KMS key that encrypts the S3 bucket containing the customer data. This is done by allowing 'kms:Decrypt' with a resource set to the exact ARN of that key, not a wildcard or all keys. Option A is incorrect because using a wildcard in the key ARN (key/*) still grants access to all keys under that key hierarchy, which is overly permissive. Option B is incorrect because allowing 'kms:Decrypt' with resource '*' would grant access to all keys in the account, violating least privilege. Option D is incorrect because removing 'kms:Decrypt' from the IAM policy would prevent the Glue job from decrypting the data; the job's IAM role needs the permission, and relying solely on S3 bucket policies cannot grant decryption permissions cross-account or for IAM roles.

Answer

Update the policy to allow 'kms:Decrypt' with a resource of 'arn:aws:kms:us-east-1:123456789012:key/*' to cover all keys in the account.

Answer

Update the policy to allow 'kms:Decrypt' with a resource of '*' to ensure the job can always decrypt data.

Answer

Remove the 'kms:Decrypt' action from the policy and rely on S3 bucket policies to grant decryption permissions.

Question 9

Match each AWS data analytics service to its primary function.

Accepted Answer

Amazon Athena: Query data in Amazon S3 using standard SQL. The correct matches are: Amazon Athena for serverless SQL querying on S3, Amazon Redshift for data warehousing, Amazon EMR for big data processing, and Amazon Kinesis for real-time streaming. Common confusions include swapping the roles of Athena and Redshift.

Answer

Amazon Athena: Fully managed data warehouse

Answer

Amazon Redshift: Query data in S3 using SQL

Question 10

A company needs to ingest data from multiple SaaS sources (e.g., Salesforce, Marketo) into Amazon S3 for analytics. Which AWS service is designed for this purpose?

Accepted Answer

Amazon AppFlow. Amazon AppFlow is a fully managed integration service specifically designed to securely transfer data between SaaS applications (like Salesforce, Marketo, Slack, and Zendesk) and AWS services such as Amazon S3 and Amazon Redshift. It supports scheduled, event-driven, or on-demand data ingestion with built-in transformations, filtering, and validation, making it the ideal choice for this use case.

Answer

AWS Transfer Family

Answer

AWS Glue

Answer

AWS DataSync

Question 11

A data engineer is designing a data ingestion pipeline to load data from an on-premises Oracle database into Amazon Redshift. The pipeline must capture changes (inserts, updates, deletes) with low latency and minimal impact on the source database. Which combination of AWS services should the engineer use?

Accepted Answer

AWS Database Migration Service (DMS) to Amazon S3, then COPY into Redshift. AWS DMS with ongoing replication (change data capture) can capture changes from Oracle with minimal impact and replicate to S3, then COPY into Redshift. Option B is wrong because Kinesis Data Streams requires a custom producer to capture Oracle changes and does not provide native CDC from Oracle databases. Option C is wrong because AWS Glue with JDBC is batch-oriented and does not support real-time change data capture natively. Option D is wrong because AWS Lambda can process events but is not designed for continuous, low-latency CDC from a database and would require polling or triggers.

Answer

Amazon Kinesis Data Streams with a custom producer on Oracle

Answer

AWS Glue with JDBC connection to Oracle, writing to Redshift

Answer

AWS Lambda reading from Oracle logs and writing to Redshift

Question 12

A data engineer is designing a solution to move data from an on-premises Oracle database to Amazon S3 using AWS DMS. The engineer needs to ensure that data changes are replicated continuously with minimal latency. Which DMS configuration is most appropriate?

Accepted Answer

Use a full-load task with ongoing replication (CDC). DMS with continuous replication (CDC) captures ongoing changes with low latency. Option A is wrong because AWS SCT is used for schema conversion, not data movement; DMS with full load only does an initial copy. Option C is wrong because a daily full-load task does not provide continuous replication or low latency. Option D is wrong because it describes Kinesis Data Streams, which is not a DMS configuration—DMS itself supports CDC to S3.

Answer

Use AWS SCT to convert the schema and then use DMS for full load

Answer

Use a full-load task that runs daily

Answer

Use Kinesis Data Streams to capture changes and write to S3

Question 13

A small startup is building a data pipeline to ingest customer orders from a web application into Amazon Redshift for analytics. The orders are written to an Amazon RDS MySQL database. The startup wants to replicate the orders to Redshift in near-real time (within 5 minutes) with minimal operational overhead. The data volume is low, averaging 100 new orders per minute. The startup has a single data engineer who is also responsible for other tasks. What is the simplest solution?

Accepted Answer

Use AWS Database Migration Service (DMS) with continuous replication. AWS DMS can continuously replicate from MySQL to Redshift with minimal setup and low overhead. Option A (AWS Glue) is batch-oriented and may not meet the 5-minute latency. Option B (Amazon EMR) is overkill for low data volumes. Option C (AWS Lambda) requires custom code and may not efficiently handle the replication.

Answer

Use AWS Glue with a scheduled job every 5 minutes to copy data from MySQL to Redshift

Answer

Use Amazon EMR with Spark streaming to read from MySQL and write to Redshift

Answer

Use an AWS Lambda function to query MySQL every minute and insert into Redshift

Question 14

A data engineer needs to transform JSON data from an S3 bucket into Parquet format and load it into Amazon Redshift. The transformation must be performed incrementally as new data arrives. Which AWS service is BEST suited for this task?

Accepted Answer

Use AWS Glue to create an ETL job that runs on a schedule or trigger.. AWS Glue provides a serverless ETL service that can run jobs triggered by S3 events to transform data incrementally and load into Redshift. Option A (AWS Lambda) can be used for simple transformations but may hit time limits for complex transformations. Option B (Amazon EMR) is more suited for large-scale big data processing but requires cluster management. Option D (Amazon Kinesis Data Firehose) is for streaming data, not for batch transformation of existing S3 objects.

Answer

Use AWS Lambda to transform the data on the fly and write to Redshift.

Answer

Use Amazon EMR with Apache Spark to transform the data and load it into Redshift.

Answer

Use Amazon Kinesis Data Firehose to transform and load data into Redshift in real time.

Question 15

A company uses AWS Glue ETL jobs to transform data from Amazon RDS to Amazon S3 daily. The job recently started failing with memory errors. The data volume has grown 3x in the past month. Which change should the data engineer make to resolve the issue?

Accepted Answer

Increase the number of DPUs allocated to the Glue job. The Glue job is failing with memory errors due to a 3x increase in data volume. Increasing the number of DPUs (Data Processing Units) allocated to the job provides more memory and compute resources, directly addressing the out-of-memory condition without changing the job logic or architecture.

Answer

Increase the size of the Amazon RDS instance

Answer

Switch the Glue job type from Python Shell to Spark

Answer

Partition the output data in Amazon S3 by date

Question 16

A data engineer needs to transform JSON data into CSV format using AWS Glue. The transformation is simple and must be executed on a schedule. Which Glue component is MOST suitable?

Accepted Answer

Glue ETL job. A Glue ETL job is the component designed to run transformation scripts (Spark or Python shell) on data, and it can be scheduled via triggers. For a simple JSON-to-CSV transformation on a schedule, an ETL job is the correct choice.

Answer

Glue Crawler

Answer

Glue Data Catalog

Answer

Glue Development Endpoint

Question 17

A data engineer is designing a pipeline to ingest change data capture (CDC) events from an Amazon RDS for PostgreSQL database into Amazon S3. The CDC events are captured using AWS DMS. The data must be available for querying within 5 minutes of the change. Which approach meets these requirements?

Accepted Answer

Use AWS DMS to replicate data directly to S3 in near real-time.. AWS DMS supports continuous replication (change data capture) directly to Amazon S3 as a target endpoint. DMS can write CDC events to S3 in near real-time (typically seconds to minutes), meeting the 5-minute latency requirement without intermediate services. The data is stored in comma-separated value (CSV) or Parquet format, ready for querying via Athena or Glue.

Answer

Export the database to S3 using pg_dump and then use AWS Glue to load into S3 in Parquet format.

Answer

Use AWS DMS to replicate data to Amazon Redshift, then unload to S3.

Answer

Use AWS DMS to replicate data to an SQS queue, then process with Lambda to write to S3.

Question 18

A company uses Amazon Kinesis Data Analytics for Apache Flink to process streaming data. The application reads from a Kinesis data stream and writes results to an Amazon S3 bucket. Recently, the application has been failing with 'ResourceNotFoundException' for the S3 bucket. What is the MOST likely cause?

Accepted Answer

The S3 bucket ARN is incorrectly specified in the application configuration.. The 'ResourceNotFoundException' for the S3 bucket indicates that the application cannot find the bucket. This is most likely due to an incorrectly specified bucket name or ARN in the application configuration. If the bucket name is misspelled or the ARN is malformed, the Kinesis Data Analytics application cannot resolve the bucket resource. Option A is incorrect because missing 's3:PutObject' permission would cause an 'AccessDenied' error, not 'ResourceNotFoundException'. Option C is incorrect because the AWS Region for S3 is determined by the bucket's location, and specifying a wrong region in Flink code would typically result in a different error (e.g., 'IllegalArgumentException' or cross-region access issues) but not 'ResourceNotFoundException'. Option D is incorrect because versioning is unrelated to bucket existence; disabling versioning does not cause a resource not found error.

Answer

The IAM role used by the application does not have s3:PutObject permission.

Answer

The Flink application code specifies the wrong AWS Region for the S3 bucket.

Answer

The S3 bucket has versioning disabled.

Question 19

Refer to the exhibit. A data engineer runs this AWS Glue Data Catalog DDL statement to create a table. The CSV files in 's3://my-bucket/sales/' use a pipe delimiter (|) instead of a comma. What change is needed to correctly read the data?

Accepted Answer

Change the 'field.delim' property to '|'.. The AWS Glue Data Catalog DDL statement uses the default 'field.delim' property, which expects comma-separated values. Since the CSV files use a pipe delimiter (|), the table will not parse rows correctly. Setting 'field.delim' to '|' in the SerDe properties tells the Hive-compatible SerDe to split on pipes instead of commas, enabling correct data ingestion.

Answer

Change the LOCATION to read from a subfolder.

Answer

Add a partition projection configuration.

Answer

Run a crawler to detect the schema automatically.

Question 20

A data engineer is responsible for a data pipeline that uses Amazon S3 as a data lake, AWS Glue for ETL, and Amazon Athena for ad-hoc queries. The pipeline ingests CSV files from an external partner via SFTP into an S3 bucket. The files are then processed by a Glue job that converts them to Parquet and writes to a separate S3 bucket partitioned by date. The Glue job runs daily and is triggered by a scheduled CloudWatch Events rule. Recently, the data engineer noticed that some days the Glue job fails because of memory errors, and on those days the Athena queries that rely on the data return incomplete results. The engineer needs to ensure that the pipeline is resilient and that Athena queries always see a complete view of the data, even if the Glue job fails mid-run. The engineer also needs to minimize re-processing of data. Which course of action should the engineer take?

Accepted Answer

Modify the Glue job to use job bookmarks for incremental processing and write the Parquet output to a temporary location, then use an S3 copy operation to move the data into the final partitioned location only after the job completes successfully.. Writing Parquet output to a temporary location and only copying it into the final partitioned path after the job succeeds ensures Athena never sees partial data from a failed run. Job bookmarks enable incremental processing so already-processed files aren't reprocessed, minimizing re-work. This combination directly addresses both resilience (atomic visibility) and efficiency (no duplicate processing).

Answer

Increase the number of workers and the worker type to G.2X to handle the memory errors, and enable job retries.

Answer

Replace the Glue job with an AWS Lambda function that processes the CSV files and writes Parquet to S3, and use S3 Event Notifications to trigger the function.

Answer

Use Athena partition projection to automatically discover partitions and set up a retry mechanism using AWS Step Functions.