DEA-C01 Practice Test 36 — 15 Questions

Question 1

A company uses Amazon Kinesis Data Streams to ingest clickstream data from a website. The data must be transformed (e.g., enrich with user location) before being stored in Amazon S3. Which architecture is MOST efficient for this transformation?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use Amazon Kinesis Data Analytics to transform the stream and output to Amazon Kinesis Data Firehose, which writes to S3.. Amazon Kinesis Data Analytics (KDA) can perform real-time transformations (e.g., enriching clickstream data with user location via SQL or Flink) on the stream, then output the transformed data to Kinesis Data Firehose, which can batch and compress records before writing to S3. This architecture minimizes operational overhead and is purpose-built for streaming transformations, avoiding the latency and complexity of Lambda cold starts or the provisioning overhead of Glue/EMR.

Answer

Use AWS Glue to run a streaming ETL job.

Answer

Use Amazon EMR to consume the stream using Spark Streaming.

Answer

Use AWS Lambda to process each record from the stream and write to S3.

Question 2

A data engineer is monitoring an Amazon RDS for PostgreSQL instance. The engineer wants to set up alerts for high CPU utilization and low free storage space. Which AWS services can be used together to achieve this? (Choose TWO.)

Accepted Answer

Amazon Simple Notification Service (SNS). Amazon CloudWatch is the correct service because it can monitor RDS metrics such as CPUUtilization and FreeStorageSpace, and trigger alarms based on thresholds. Amazon SNS is correct because it can receive CloudWatch alarm notifications and deliver them via email, SMS, or other endpoints, enabling the data engineer to be alerted when high CPU or low storage conditions occur.

Answer

AWS CloudTrail

Answer

AWS Config

Answer

Amazon Route 53

Question 3

A company uses AWS Glue ETL jobs to transform data in Amazon S3. The data arrives in JSON format but needs to be converted to Parquet for efficient querying. Which AWS Glue feature should be used to infer the schema and generate transformation code?

Accepted Answer

AWS Glue crawlers. AWS Glue crawlers are the correct feature because they automatically connect to data stores (like S3), infer the schema of JSON data by sampling it, and populate the AWS Glue Data Catalog with table definitions. This catalog schema can then be used by AWS Glue ETL jobs to generate transformation code (e.g., converting JSON to Parquet) without manual schema definition.

Answer

Amazon S3 Select

Answer

Amazon Athena

Answer

Amazon Kinesis Data Analytics

Question 4

A data engineer needs to audit all access to an S3 bucket for compliance. They want to capture object-level operations such as GetObject and PutObject, as well as bucket-level operations like ListBucket. Which AWS service should be used?

Accepted Answer

S3 server access logs. S3 server access logs record both object-level operations (e.g., GetObject, PutObject) and bucket-level operations (e.g., ListBucket). AWS CloudTrail can also capture S3 API calls, but by default it logs bucket-level management events only; object-level data events must be explicitly enabled. Amazon CloudWatch Logs (Option A) is a log storage and monitoring service, not a source of S3 access logs; logs must be sent to it from another service. AWS CloudTrail management events (Option C) capture only bucket-level operations, not object-level. AWS Config (Option D) monitors resource configuration changes, not API calls. Therefore, the correct service for auditing all S3 access is S3 server access logs.

Answer

Amazon CloudWatch Logs

Answer

AWS CloudTrail management events

Answer

AWS Config

Question 5

A data engineer is designing a data lake on Amazon S3 and needs to ensure that objects are automatically encrypted at rest using server-side encryption with AWS KMS. Which bucket policy statement achieves this?

Accepted Answer

Deny PutObject requests where the x-amz-server-side-encryption header is not set to aws:kms.. It enforces server-side encryption with AWS KMS (SSE-KMS) by denying any PutObject request that does not include the `x-amz-server-side-encryption` header set to `aws:kms`. This bucket policy ensures that all objects written to the S3 bucket are automatically encrypted at rest using AWS KMS, meeting the requirement for mandatory encryption with a specific key management service.

Answer

Deny PutObject requests that do not include the x-amz-server-side-encryption header.

Answer

Deny PutObject requests where the x-amz-server-side-encryption header is not set to AES256.

Answer

Allow PutObject requests only if the x-amz-server-side-encryption header is set to AES256.

Question 6

A data engineer is migrating an on-premises Oracle database to Amazon RDS for Oracle. The database is 5 TB in size and has a 1 Gbps network connection. The migration must be completed within 48 hours. Which service should be used?

Accepted Answer

AWS Database Migration Service (DMS).. AWS DMS is the correct choice because it is designed for migrating databases to AWS with minimal downtime, and it can handle a 5 TB Oracle database over a 1 Gbps network within 48 hours. DMS supports ongoing replication to keep the source and target in sync, and it can use Oracle-specific features like supplemental logging and change data capture (CDC) to reduce migration time. The 1 Gbps connection provides sufficient bandwidth to transfer 5 TB in under 12 hours at full utilization, leaving ample time for setup and validation.

Answer

AWS DataSync.

Answer

Amazon S3 Transfer Acceleration.

Answer

AWS Snowball Edge.

Question 7

A company is migrating an on-premises Apache Hadoop cluster to Amazon EMR. The cluster uses HDFS for storage. Which THREE features of Amazon EMR help reduce storage costs compared to on-premises HDFS? (Choose THREE)

Accepted Answer

Leverage Amazon S3 storage classes like S3 Standard-IA for older data.. Amazon S3 Standard-IA (Infrequent Access) offers lower storage costs than S3 Standard for data that is accessed less frequently, making it ideal for older or archival data in a Hadoop migration. By using S3 as the primary storage layer via EMRFS, you decouple compute from storage and avoid the replication overhead of HDFS (which typically uses 3x replication), significantly reducing storage costs.

Answer

Use instance store volumes for intermediate data.

Answer

Attach Amazon EBS volumes to cluster nodes for persistent storage.

Question 8

A data engineer is designing a data ingestion pipeline for real-time financial transactions. The pipeline must ensure exactly-once processing semantics and must handle duplicate records that may occur due to retries. Which combination of AWS services can achieve exactly-once processing?

Accepted Answer

Amazon Kinesis Data Streams with Amazon Kinesis Data Analytics for Apache Flink. Amazon Kinesis Data Streams with Kinesis Data Analytics for Apache Flink enables exactly-once processing by leveraging Flink's built-in checkpointing and two-phase commit protocols. Kinesis Data Streams provides a durable, ordered record store, while Flink uses its internal state and idempotent sinks to deduplicate records that arise from retries, ensuring each record is processed exactly once.

Answer

Amazon SQS with AWS Lambda

Answer

Amazon MSK with AWS Lambda

Answer

Amazon Kinesis Data Firehose with AWS Lambda

Question 9

A company uses Amazon Kinesis Data Firehose to deliver data to Amazon S3. The data is compressed with GZIP and partitioned by year, month, day, and hour. The delivery stream is configured to buffer up to 5 MB or 60 seconds. Some records are missing from S3. What is the most likely cause?

Accepted Answer

The Lambda transformation function timed out and records were skipped. When a Lambda transformation function times out, Kinesis Data Firehose will skip the affected records by default. The delivery stream configuration (5 MB or 60 seconds) only controls buffering, not Lambda invocation failures. If the Lambda function exceeds its timeout limit, Firehose treats the invocation as failed and, depending on the error handling configuration, may drop the records entirely, leading to missing data in S3.

Answer

The S3 bucket does not have sufficient permissions

Answer

The data compression format is incompatible with S3

Answer

The partition key configuration is incorrect

Question 10

Refer to the exhibit. A data engineer is configuring an IAM policy for a Lambda function that writes transformed data to S3. The function writes to both 'example-bucket/data/' and 'example-bucket/public/'. The policy is intended to enforce server-side encryption with SSE-S3 for all objects written to the 'public/' prefix, while allowing all operations on other prefixes. However, the Lambda function is failing with an AccessDenied error when writing to 'example-bucket/public/'. What is the most likely cause?

Accepted Answer

The Lambda function is not setting the 'x-amz-server-side-encryption' header to 'AES256' when writing to 'public/'.. The policy enforces SSE-S3 encryption for objects written to the 'public/' prefix. When a Lambda function writes to S3 without setting the 'x-amz-server-side-encryption' header to 'AES256', the request fails with an AccessDenied error if the bucket policy requires SSE-S3. The policy explicitly denies PutObject unless the encryption header is present, so the function must include this header to succeed.

Answer

The policy denies DeleteObject on 'public/'.

Answer

The policy denies PutObject on 'public/' unconditionally.

Answer

The policy does not allow GetObject for 'public/'.

Question 11

A company is using Amazon Kinesis Data Streams with a Lambda consumer to process clickstream data. The data rate is high and the Lambda function is falling behind, resulting in increased processing latency. What is the MOST effective way to improve throughput?

Accepted Answer

Increase the number of shards in the Kinesis stream.. Increasing the number of shards in the Kinesis stream increases the stream's total read capacity, allowing more concurrent Lambda invocations to process records in parallel. Since each shard supports up to 5 read transactions per second and a maximum of 2 MB/s read throughput, adding shards directly raises the aggregate throughput, enabling the Lambda consumer to keep up with the high data rate.

Answer

Increase the memory allocated to the Lambda function.

Answer

Increase the Lambda function timeout.

Answer

Use Kinesis Data Firehose instead of Lambda.

Question 12

Which TWO actions should a data engineer take to protect sensitive data in an Amazon S3 bucket from being accessed by unauthorized users? (Select TWO.)

Accepted Answer

Add a bucket policy with a Deny effect for unauthorized principals. Options C and E are correct. Option C (bucket policy with Deny effect) explicitly denies access to unauthorized users, preventing unauthorized access. Option E (S3 Block Public Access) prevents public access to the bucket, ensuring it is not publicly accessible. Option A (VPC endpoint) is for network connectivity, not access control. Option B (server access logging) is for auditing, not prevention. Option D (CloudTrail) is for logging and monitoring, not access control.

Answer

Create a VPC endpoint for S3

Answer

Enable S3 server access logging

Answer

Enable AWS CloudTrail for the bucket

Question 13

A data engineer is building a pipeline to ingest JSON files from Amazon S3 into Amazon Redshift. The files are 100 MB each and arrive every 5 minutes. Which service is BEST suited for this ingestion?

Accepted Answer

Amazon Redshift COPY command. The Amazon Redshift COPY command is the most efficient and best-suited service for bulk loading 100 MB JSON files from S3 into Redshift at regular 5-minute intervals. It is optimized for high-throughput, parallel ingestion directly from S3, minimizing latency and resource overhead compared to other services.

Answer

AWS Glue ETL job

Answer

AWS Lambda with Redshift Data API

Answer

Amazon Kinesis Data Firehose with Redshift destination

Question 14

A data engineer needs to transform data in Amazon S3 using AWS Glue. The job must handle schema evolution and partition pruning. Which THREE features should be used?

Accepted Answer

AWS Glue Data Catalog. AWS Glue Data Catalog (A) is correct because it acts as a central metadata repository that stores table definitions and schema information. When schema evolution occurs (e.g., new columns are added in Parquet or JSON data), the Data Catalog can be updated via crawlers or manual schema registration, allowing Glue ETL jobs to dynamically adapt to changing schemas without hardcoding column structures.

Answer

AWS Glue job bookmarks

Answer

AWS Glue FindMatches transform

Question 15

Which THREE factors should be considered when choosing a partition key for an Amazon DynamoDB table?

Accepted Answer

If the table has a write-heavy workload, the partition key should distribute writes evenly.. DynamoDB distributes data and request traffic across partitions based on the partition key. For write-heavy workloads, a partition key that evenly distributes writes prevents hot partitions, which can throttle requests and degrade performance. This ensures that no single partition exceeds its write capacity limit.

Answer

The partition key should be chosen to maximize the size of items in each partition.

Answer

The partition key should be chosen to minimize read capacity unit consumption.