DEA-C01 Practice Test 36 — 15 Questions

Question 1

A company uses Amazon Redshift to store customer data. The security team requires that all queries are logged for auditing purposes. Which step should be taken to meet this requirement? (Select ONE.)

Accepted Answer

Enable Amazon Redshift audit logging to an S3 bucket.. The requirement is to log all queries for auditing. Amazon Redshift's native audit logging captures connection logs, user activity logs, and query logs, and can be exported to an S3 bucket. This is the only step that directly logs SQL queries. AWS CloudTrail does not log SQL queries; it logs management API calls (e.g., CreateCluster, ModifyCluster). Therefore, only Option E meets the requirement.

Answer

Enable AWS CloudTrail database audit logging.

Answer

Use AWS CloudTrail to log Redshift API calls.

Answer

Enable logging on the Redshift security group.

Answer

Enable VPC Flow Logs for the Redshift cluster.

Question 2

A company uses AWS Lake Formation to manage data lake permissions. A data analyst cannot query a table in Athena, although the table appears in the catalog. The analyst has IAM permissions to run Athena. What is the MOST likely cause?

Accepted Answer

The analyst lacks Lake Formation permissions on the table.. The most likely cause is that the analyst lacks Lake Formation permissions on the table. Even with IAM permissions to run Athena, Lake Formation enforces fine-grained access control at the table and column level. If the analyst has not been granted SELECT permission on the table via Lake Formation, Athena queries will fail with an access denied error, even though the table appears in the Glue Data Catalog.

Answer

The Glue Data Catalog does not have the table registered.

Answer

The S3 bucket policy denies access to the analyst's IAM role.

Answer

The Athena workgroup is not configured with the correct output location.

Question 3

A company uses Amazon EMR to run Spark jobs on data stored in S3. After upgrading the EMR cluster to a new release, one of the Spark jobs fails with 'OutOfMemoryError' in the executor. Which configuration change is MOST likely to resolve this issue?

Accepted Answer

Increase spark.executor.memory to allocate more memory per executor.. Increasing spark.executor.memory directly allocates more memory per executor, addressing the OutOfMemoryError in the executor. Option A (increasing the number of core nodes) adds more cluster capacity but does not increase the memory available to individual executors, so it may not resolve the OOM if the existing executors are already memory-constrained. Option B (decreasing spark.sql.shuffle.partitions) reduces the number of shuffle partitions, which can increase the size of each partition and potentially cause more memory pressure, not less. Option C (increasing spark.driver.memory) only helps the driver process, not the executor, so it does not fix executor OOM errors.

Answer

Increase the number of core nodes in the EMR cluster.

Answer

Decrease spark.sql.shuffle.partitions to reduce overhead.

Answer

Increase spark.driver.memory in the Spark configuration.

Question 4

Refer to the exhibit. A data engineer is troubleshooting an AWS Lambda function that processes data from Amazon S3. The function is triggered by S3 events, but no logs appear in CloudWatch Logs. The engineer runs the AWS CLI command shown. What is the MOST likely reason for the missing logs?

Accepted Answer

The Lambda execution role does not have permissions to create log groups and write logs.. The most likely reason for missing CloudWatch Logs is that the Lambda execution role lacks the necessary permissions to create log groups and write log streams. When a Lambda function is invoked, it attempts to create a log group named /aws/lambda/<function-name> and a log stream, then write logs. If the execution role does not include actions like logs:CreateLogGroup, logs:CreateLogStream, and logs:PutLogEvents, the function cannot write any logs, resulting in no log entries. This is a common misconfiguration, especially when roles are custom-created without the default AWSLambdaBasicExecutionRole policy.

Answer

The Lambda function is configured to log to a different log group.

Answer

The Lambda function is not being invoked by S3 events.

Answer

The log retention policy is set to 7 days, causing logs to expire immediately.

Question 5

Refer to the exhibit. A data engineer has attached this bucket policy to an S3 bucket. What is the effect of this policy?

Accepted Answer

It allows the DataLakeRole to read and write objects, but only over HTTPS.. The bucket policy uses a condition key `aws:SecureTransport` set to `true`, which restricts access to HTTPS (TLS) connections only. The `Principal` is `DataLakeRole`, and the `Action` includes `s3:GetObject` and `s3:PutObject`, so the policy allows that role to read and write objects exclusively over HTTPS, enforcing encrypted data in transit.

Answer

It enforces server-side encryption for all objects written to the bucket.

Answer

It allows anonymous access to the bucket for HTTPS requests.

Answer

It denies all access to the bucket except for requests from the DataLakeRole.

Question 6

A data pipeline uses AWS Glue to process data from Amazon S3. The job fails with an 'OutOfMemoryError' during the transformation phase. Which action should the data engineer take to resolve this issue?

Accepted Answer

Increase the number of DPUs (Data Processing Units) for the Glue job.. The OutOfMemoryError occurs because the Glue job does not have enough memory allocated. Increasing the number of DPUs (Data Processing Units) increases both memory and processing capacity, directly resolving the issue. Option A (S3 server-side encryption) affects data security, not memory. Option B (increasing data partitions) may help parallelism but does not directly increase memory per executor. Option C (changing to Parquet) can reduce data volume but does not guarantee sufficient memory for transformation.

Answer

Enable S3 server-side encryption.

Answer

Increase the number of partitions in the input data.

Answer

Change the data format from CSV to Parquet.

Question 7

A data engineer needs to ingest JSON files from an S3 bucket into a DynamoDB table. The files are updated hourly and contain new records. Which AWS service should be used to trigger a Lambda function for each new object?

Accepted Answer

S3 Event Notifications. S3 Event Notifications are the correct choice because they are designed to trigger AWS Lambda functions directly in response to object creation events (e.g., `s3:ObjectCreated:*`) in an S3 bucket. This allows the data engineer to automatically invoke a Lambda function for each new JSON file as it is uploaded, enabling ingestion into DynamoDB without polling or additional infrastructure.

Answer

Kinesis Data Firehose

Answer

Amazon EventBridge

Answer

Amazon SQS

Question 8

A data engineer needs to transform CSV files arriving in an S3 bucket into Parquet format and store them in another S3 bucket. The transformation is simple and on-demand, triggered by data arrival. Which solution is the MOST cost-effective and requires the least operational overhead?

Accepted Answer

Use S3 Events to trigger an AWS Lambda function that transforms the data. Using S3 Events to trigger an AWS Lambda function is the most cost-effective and operationally lightweight solution for simple, on-demand CSV-to-Parquet transformations. Lambda scales automatically with each S3 PUT event, incurs no idle cost, and requires no cluster management, making it ideal for event-driven, low-volume transformations.

Answer

Use Amazon EMR with Spark streaming

Answer

Use Amazon Athena to create a new table with Parquet format

Answer

Use AWS Glue ETL jobs scheduled to run every hour

Question 9

A data engineer is setting up an AWS Glue job to process data from an Amazon S3 bucket. The job fails with an 'Access Denied' error. Which TWO IAM permissions are MOST likely missing from the Glue job's IAM role?

Accepted Answer

s3:PutObject. The Glue job needs to read the source data from the S3 bucket, which requires the s3:GetObject permission on the bucket's objects, so option E is correct. The job also needs to write its output (or intermediate results) back to S3, which requires the s3:PutObject permission, making option A correct. Option B (kms:Decrypt) is not necessarily missing unless the S3 objects are encrypted with a customer-managed KMS key and the role lacks decrypt rights, but the scenario does not state that. Option C (dynamodb:GetItem) is unrelated because the job processes data from S3, not DynamoDB. Option D (glue:StartJobRun) is a permission for triggering jobs, not for the job's execution role to access data, so it is not the cause of the Access Denied error.

Answer

kms:Decrypt

Answer

dynamodb:GetItem

Answer

glue:StartJobRun

Question 10

A data engineer notices that an AWS Glue ETL job that processes streaming data from Amazon Kinesis Data Streams is failing intermittently with a 'ResourceNotFoundException' error for the Kinesis stream. The job has been running successfully for weeks. Which action should the engineer take to resolve the issue?

Accepted Answer

Add the 'kinesis:DescribeStream' permission to the IAM role used by the Glue job.. A 'ResourceNotFoundException' from a Glue job reading Kinesis typically indicates the Glue execution role lacks permission to describe or access the stream, causing the service to report the stream as not found rather than as access-denied. Adding 'kinesis:DescribeStream' (and typically DescribeStreamSummary, GetShardIterator, GetRecords) to the IAM role resolves the issue. Since the job ran successfully for weeks, a recent IAM policy change or role modification is the likely trigger.

Answer

Increase the number of shards in the Kinesis data stream to handle higher throughput.

Answer

Rename the Kinesis data stream to match the stream name used in the Glue job exactly, including case.

Answer

Increase the timeout for the Glue job in the job configuration.

Question 11

A company is designing a data store for IoT sensor data that is written once and never updated. The data must be stored with high durability and low cost. Which TWO AWS storage services are most suitable? (Choose TWO.)

Accepted Answer

Amazon S3. Amazon S3 is correct because it provides 99.999999999% (11 9's) durability, is designed for write-once-read-many (WORM) workloads, and offers low-cost storage tiers suitable for IoT sensor data that is never updated. S3's object storage model and lifecycle policies allow automatic transition to colder storage, making it ideal for immutable data at scale.

Answer

Amazon ElastiCache

Answer

Amazon EBS

Answer

Amazon DynamoDB

Question 12

A data engineer is designing a data lake on S3 and needs to ensure that data is encrypted at rest using customer-managed KMS keys. The engineer also needs to audit all access to the KMS keys. Which combination of services should be used?

Accepted Answer

SSE-KMS with AWS CloudTrail. SSE-KMS allows customer-managed KMS keys, and AWS CloudTrail logs all KMS API calls (e.g., Decrypt, GenerateDataKey), enabling auditing. Option B is incorrect because SSE-C uses customer-provided encryption keys, not KMS, and CloudWatch Logs is for application logs, not KMS access. Option C is incorrect because S3 Inventory provides object metadata but does not audit KMS access. Option D is incorrect because SSE-S3 uses AWS-managed keys, not customer-managed, and S3 server access logs do not capture KMS API calls.

Answer

SSE-C with CloudWatch Logs

Answer

SSE-KMS with S3 Inventory

Answer

SSE-S3 with S3 server access logs

Question 13

A data engineer is designing a pipeline that ingests JSON logs from an application into Amazon S3. The logs contain a timestamp field. The pipeline must partition the data by date in S3 (e.g., year=2024/month=10/day=01). Which approach minimizes transformation effort?

Accepted Answer

Use Amazon Kinesis Data Firehose with dynamic partitioning. Amazon Kinesis Data Firehose with dynamic partitioning can automatically partition incoming JSON data based on the timestamp field without requiring custom transformation code. It evaluates the timestamp using a JQ expression or inline parsing, then writes records directly to S3 prefixes like year=2024/month=10/day=01. This minimizes transformation effort because the partitioning logic is configured declaratively in the Firehose delivery stream, eliminating the need for Lambda functions or post-ingestion processing.

Answer

Use AWS Glue crawlers to infer schema and create partitions

Answer

Use AWS Lambda to process each object and copy to the appropriate prefix

Answer

Use Amazon Athena to create partitions on the existing data

Question 14

A data engineer is designing a data transformation pipeline using AWS Glue. The source data is in Amazon S3 in Parquet format, and the transformed output must be written to another S3 bucket in Parquet format partitioned by year, month, day. The pipeline should handle incremental updates efficiently. Which three features should the engineer use? (Choose THREE.)

Accepted Answer

AWS Glue job bookmarks to track processed data. AWS Glue job bookmarks track processed data by recording the state of previously processed files and partitions, enabling incremental processing of new or changed data in subsequent runs. This is essential for efficiently handling incremental updates without reprocessing the entire dataset.

Answer

Use AWS Glue JobWatch for monitoring job progress

Answer

Use Spark SQL for transformations

Question 15

A company uses AWS Glue to run ETL jobs that process data from Amazon RDS for MySQL and load it into Amazon S3. The job runs daily and processes incremental changes using the JDBC connection. Recently, the job has been failing with a 'Communications link failure' error. The RDS instance is in a private subnet. Which step should the engineer take first to diagnose the issue?

Accepted Answer

Check the security group and network ACL rules for the RDS instance and the Glue connection.. The 'Communications link failure' error typically indicates a network connectivity issue between AWS Glue and the RDS instance. Since the RDS instance is in a private subnet, the Glue job must be able to reach it via a VPC endpoint or a Glue connection that uses network configuration. Checking the security group (inbound rules for the RDS instance allowing traffic from Glue's elastic network interfaces) and network ACLs (ensuring ephemeral ports are open) is the first logical step to diagnose connectivity.

Answer

Verify that the IAM role used by Glue has the correct permissions to access RDS.

Answer

Change the Glue job type from Spark to Python shell.

Answer

Check that the JDBC driver is compatible with the Glue version.