DEA-C01 Practice Test 33 — 15 Questions

Question 1

A company wants to audit API calls made to its Amazon S3 buckets. Which AWS services can be used to achieve this? (Choose TWO.)

Accepted Answer

AWS CloudTrail. Options D and E are correct. AWS CloudTrail can log API calls to S3 by enabling data events, and S3 server access logs record detailed request information. Option A is wrong because IAM Access Analyzer reviews resource policies, not API calls. Option B is wrong because AWS Config tracks configuration changes, not API calls. Option C is wrong because VPC Flow Logs capture network traffic, not API calls.

Answer

IAM Access Analyzer

Answer

AWS Config

Answer

VPC Flow Logs

Question 2

A data engineer is configuring an S3 bucket to host sensitive data. The security policy requires that all objects be encrypted with a key that is generated and managed by the customer, and that the key be stored in AWS KMS. Which encryption option should be used?

Accepted Answer

Server-Side Encryption with AWS KMS-Managed Keys (SSE-KMS). SSE-KMS allows you to use customer-managed keys stored in AWS KMS, meeting the requirement for customer-generated and managed keys. Option A is incorrect because SSE-S3 uses AWS-managed keys, not customer-managed. Option B is incorrect because client-side encryption encrypts data outside S3, not using S3 server-side encryption. Option C is incorrect because SSE-C uses customer-provided keys that you manage yourself, but they are not stored in AWS KMS—you must provide them with each request.

Answer

Server-Side Encryption with S3-Managed Keys (SSE-S3)

Answer

Client-Side Encryption

Answer

Server-Side Encryption with Customer-Provided Keys (SSE-C)

Question 3

A company is using Amazon Redshift for analytics and needs to ensure that all data is encrypted at rest. The current cluster does not have encryption enabled. What is the most efficient way to enable encryption?

Accepted Answer

Create a snapshot of the cluster and restore it to a new cluster with encryption enabled. Redshift does not support enabling encryption on an existing cluster; a new encrypted cluster must be created and data migrated. Modifying the cluster configuration or parameter groups does not enable encryption. Creating a snapshot and restoring it to a new cluster with encryption enabled is the standard approach.

Answer

Change the cluster parameter group to enable encryption

Answer

Modify the cluster configuration to enable encryption

Answer

Use AWS DMS to migrate data to a new encrypted cluster

Question 4

A company needs to securely store and manage database credentials used by a data pipeline. Which AWS services can be used to store and rotate secrets automatically? (Choose TWO.)

Accepted Answer

AWS Systems Manager Parameter Store. AWS Systems Manager Parameter Store (A) can securely store secrets and, when using the Advanced tier, supports automatic rotation via AWS Lambda. AWS Secrets Manager (E) provides native automatic rotation for database credentials and other secrets. B (IAM) is for identity and access management, not secret storage. C (KMS) manages encryption keys, not secrets. D (CloudHSM) provides hardware security modules for key management, not secret storage. Therefore, the correct answers are A and E.

Answer

AWS IAM

Answer

AWS Key Management Service (AWS KMS)

Answer

AWS CloudHSM

Question 5

A company is using an Amazon RDS for PostgreSQL database to store personally identifiable information (PII). The security team wants to ensure that database administrators cannot view the plaintext PII data. Which solution should a data engineer implement?

Accepted Answer

Use client-side encryption with AWS KMS to encrypt PII before inserting into the database. Using AWS KMS with client-side encryption ensures that data is encrypted before being sent to RDS, so database administrators cannot read the plaintext. Dynamic data masking in RDS is not natively supported; application-level masking would be needed. RDS encryption at rest protects data on disk but DBAs with access can still query plaintext. Using IAM policies to restrict access does not prevent DBAs with database credentials from viewing data.

Answer

Use IAM policies to restrict DBA access to the RDS instance

Answer

Enable Dynamic Data Masking in RDS to obfuscate PII for all users

Answer

Enable encryption at rest for the RDS instance using AWS KMS

Question 6

A company needs to audit access to their Amazon S3 buckets. Which TWO services can be used together to achieve this? (Choose two.)

Accepted Answer

Amazon CloudWatch Logs. CloudTrail records S3 API calls, and CloudWatch Logs can be used to store and monitor those logs. Config records configuration changes, not data access. S3 server access logs record object-level access, but the question asks for auditing access; CloudTrail with CloudWatch Logs is a common solution. S3 Inventory provides metadata, not access logs.

Answer

Amazon Macie

Answer

Amazon S3 Inventory

Answer

AWS Config

Question 7

A company is using Amazon Redshift for data warehousing. They need to ensure that data is encrypted at rest and in transit. Which TWO configurations are required to meet these requirements?

Accepted Answer

Enable encryption on the Redshift cluster using AWS KMS.. To encrypt data at rest in Amazon Redshift, you must enable encryption on the cluster using AWS KMS (Option A). To encrypt data in transit, you must configure the cluster to require SSL connections (Option B). Option C (CloudHSM) can be used for key management but is not a required configuration. Option D (VPC Flow Logs) captures network metadata and does not encrypt traffic. Option E (EBS encryption) is not applicable to Redshift's managed storage.

Answer

Use AWS CloudHSM to manage encryption keys for Redshift.

Answer

Enable VPC Flow Logs on the Redshift subnet.

Answer

Enable EBS encryption on the Redshift cluster nodes.

Question 8

A company is designing a data lake on AWS using S3. The security team requires that all data be encrypted at rest and that encryption keys be rotated annually. Which services can be used to meet these requirements? (Choose TWO.)

Accepted Answer

AWS Key Management Service (AWS KMS). AWS KMS (C) allows creating customer-managed keys that can be rotated annually or automatically. Amazon S3 managed keys (SSE-S3) (E) provide encryption at rest with keys that are automatically rotated by AWS. Option A (AWS Secrets Manager) is for storing secrets, not encryption keys. Option B (ACM) is for SSL/TLS certificates. Option D (CloudHSM) provides hardware security modules but does not support automatic key rotation for S3 and is not typically used for S3 encryption key management.

Answer

AWS Secrets Manager

Answer

AWS Certificate Manager (ACM)

Answer

AWS CloudHSM

Question 9

A company runs a critical application on Amazon RDS for MySQL that requires a Recovery Point Objective (RPO) of 5 minutes and a Recovery Time Objective (RTO) of 1 hour. The database is 500 GB. What is the MOST cost-effective disaster recovery solution that meets these requirements?

Accepted Answer

Use a Multi-AZ deployment with automatic failover.. Multi-AZ RDS for MySQL provides synchronous standby replication to a second Availability Zone, enabling automatic failover with minimal data loss (typically zero) and RTO under 1 hour. This meets the RPO of 5 minutes and RTO of 1 hour without manual intervention, and is more cost-effective than a cross-region replica for a 500 GB database.

Answer

Deploy the database in a single Availability Zone and perform manual point-in-time restores.

Answer

Take automated snapshots daily and store them in Amazon S3.

Answer

Create a cross-region read replica and promote it during a disaster.

Question 10

A data engineer needs to transform a large dataset stored in Amazon S3 using Apache Spark. The engineer wants to minimize startup time and use a serverless approach. Which AWS service should the engineer use?

Accepted Answer

AWS Glue. AWS Glue provides a serverless Spark environment with fast startup. Option A is wrong because Amazon Redshift is a data warehouse, not a Spark environment. Option B is wrong because Amazon EMR requires cluster provisioning, which increases startup time. Option D is wrong because Amazon Athena is for querying data, not for transforming with Spark.

Answer

Amazon Redshift

Answer

Amazon EMR

Answer

Amazon Athena

Question 11

A company uses AWS Glue to run ETL jobs daily. The data engineer wants to reduce costs by optimizing the job configuration. Which two actions will help reduce costs? (Choose TWO.)

Accepted Answer

Use G.1X worker type instead of G.2X. G.1X workers provide 16 GB of memory and 4 vCPUs, while G.2X workers provide 32 GB and 8 vCPUs. For many ETL jobs, especially those with smaller data volumes or less complex transformations, G.1X workers are sufficient, and using them instead of G.2X directly reduces the cost per DPU-hour since AWS Glue pricing is based on DPU capacity. This optimization lowers costs without sacrificing performance if the job is not memory- or CPU-bound.

Answer

Increase the job timeout to 48 hours

Answer

Enable Spark UI logging for debugging

Answer

Increase the number of job retries to handle transient failures

Question 12

A company is ingesting streaming data from IoT devices into Amazon Kinesis Data Streams. The data must be transformed in real-time using custom Python code before being stored in Amazon S3. Which AWS service should be used to perform this transformation?

Accepted Answer

Kinesis Data Analytics for Apache Flink. Amazon EMR with Spark Streaming, which is optimized for large-scale batch and stream processing but is not the simplest or most direct service for this specific use case. Option B is AWS Lambda, which can be used for simple transformations but has limitations on execution time and complexity. Option D is Kinesis Data Firehose with custom data transformation, which supports only built-in transformations or Lambda functions, not arbitrary custom Python code directly. Option C, Kinesis Data Analytics for Apache Flink, is correct because it allows running custom Apache Flink applications, which support custom Python code via the Apache Flink Python API, for real-time data transformation.

Answer

Amazon EMR with Spark Streaming

Answer

AWS Lambda function triggered by Kinesis Data Streams

Answer

Kinesis Data Firehose with custom data transformation

Question 13

A data engineer needs to ingest data from an Amazon RDS for MySQL database into Amazon S3 on a daily basis. The data volume is about 50 GB per day. The engineer wants to minimize the impact on the source database. Which AWS service should be used?

Accepted Answer

AWS Database Migration Service (DMS). AWS DMS can perform full load and ongoing replication with minimal impact on the source database. Option A is wrong because AWS Glue with a JDBC connection can impact the source due to high query load. Option B is wrong because Amazon Athena Federated Query reads data directly from RDS, which can cause performance issues. Option D is wrong because AWS DataSync is designed for file storage, not databases.

Answer

AWS Glue with a JDBC connection

Answer

Amazon Athena Federated Query

Answer

AWS DataSync

Question 14

A company runs a production Amazon Redshift cluster. The data engineering team notices that queries are running slowly during peak hours. The cluster's CPU utilization is consistently above 80%. Which action should the engineer take to improve query performance?

Accepted Answer

Perform an elastic resize to add more nodes.. Performing an elastic resize allows adding nodes to the Redshift cluster, increasing CPU capacity and resolving the CPU bottleneck. Option A is incorrect: moving tables to Redshift Spectrum offloads queries to S3 but does not reduce CPU usage on the cluster for existing queries. Option B is incorrect: re-distributing tables might improve data distribution but does not directly address high CPU utilization. Option C is incorrect: concurrency scaling helps with many concurrent queries by adding transient capacity, but it does not reduce CPU usage on the main cluster; it may even increase it.

Answer

Move some tables to Amazon Redshift Spectrum.

Answer

Re-distribute the tables using a different distribution key.

Answer

Enable concurrency scaling.

Question 15

A company is building a data lake on Amazon S3. Data arrives from multiple sources in JSON, CSV, and Avro formats. The data must be transformed to Parquet and partitioned by date and source. Which TWO services can perform this transformation with minimal custom code? (Choose TWO.)

Accepted Answer

Amazon EMR with Spark. Both Amazon EMR with Spark and AWS Glue ETL jobs can perform the transformation with minimal custom code. Spark natively supports reading JSON, CSV, and Avro formats and writing Parquet with partitioning by date and source, requiring only a concise PySpark or Scala script. Similarly, AWS Glue provides a managed Spark environment with built-in transforms and crawlers, allowing users to write Spark scripts or use visual ETL jobs with minimal code. The other options either lack native transformation capabilities (Lake Formation, Athena CTAS queries) or are designed for streaming data (Kinesis Data Firehose).

Answer

AWS Lake Formation

Answer

Amazon Athena CTAS queries

Answer

Amazon Kinesis Data Firehose