DEA-C01 Practice Test 37 — 15 Questions

Question 1

A data engineer is running an Amazon EMR cluster with Spark to process log files. The cluster uses instance fleets with m5.xlarge core nodes. The engineer observes that the Spark job is running slower than expected. CloudWatch metrics show that the cluster's CPU utilization is below 20% but memory utilization is near 90%. Which configuration change would most likely improve performance?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use memory-optimized instances (r5.xlarge) for core nodes.. The CloudWatch metrics show CPU below 20% while memory is near 90%, which is the classic signature of a memory-bound Spark workload. Spark executors on m5.xlarge (16 GiB RAM) are spilling to disk or GC-thrashing because the working set exceeds available heap. Switching core nodes to r5.xlarge (memory-optimized, 32 GiB RAM) doubles the memory per node, reducing spills and GC pressure, which directly addresses the bottleneck.

Answer

Increase the number of core nodes from 5 to 10.

Answer

Increase the number of Spark shuffle partitions.

Answer

Decrease the number of core nodes to reduce overhead.

Question 2

A company needs to store relational data that requires complex joins and transactional consistency. The workload is predictable and the data size is less than 500 GB. Which AWS service is MOST cost-effective for this use case?

Accepted Answer

Amazon RDS for PostgreSQL. Amazon RDS for PostgreSQL is the most cost-effective choice because it provides a fully managed relational database service that supports complex joins and transactional consistency (ACID compliance) for predictable workloads under 500 GB. Unlike Redshift, which is optimized for petabyte-scale analytics, RDS offers lower cost for this data size and workload pattern, while DynamoDB lacks native SQL join capabilities and S3 is not a relational database.

Answer

Amazon Redshift

Answer

Amazon S3

Answer

Amazon DynamoDB

Question 3

A company runs a nightly ETL job using AWS Glue. The job reads data from a JDBC connection to an on-premises MySQL database. The job fails with an error indicating that the connection pool is exhausted. What is the most likely cause and solution?

Accepted Answer

The Glue job is using too many executors, exhausting the database connections. Reduce the number of DPUs or increase the database max connections.. AWS Glue jobs distribute work across multiple executors, each of which opens its own JDBC connection to the source database. When the number of executors (controlled by DPUs) exceeds the database's configured maximum connections, the database connection pool is exhausted, causing the error. Reducing the number of DPUs or increasing the database's max_connections setting resolves the issue.

Answer

The database is not reachable due to network issues. Check VPC and security groups.

Answer

The Glue job is hitting the AWS Glue connection pool limit. Increase the Glue connection pool size.

Answer

The database credentials are expired. Rotate the password in AWS Secrets Manager.

Question 4

A company wants to ingest real-time data from a social media API into Amazon S3 for analysis. The API provides data as JSON records. Which AWS service is best suited for this ingestion?

Accepted Answer

Amazon Kinesis Data Firehose. Amazon Kinesis Data Firehose is the best choice because it is a fully managed service designed to ingest real-time streaming data, such as JSON records from a social media API, and automatically load it into Amazon S3 with optional data transformation and compression. It handles scaling, buffering, and delivery without requiring custom code or infrastructure management, making it ideal for this use case.

Answer

AWS Glue

Answer

Amazon Simple Queue Service (SQS)

Answer

Amazon DataZone

Question 5

A data engineer needs to store semi-structured JSON log files from multiple sources and query them using SQL. The data is rarely updated and access frequency is low. Which storage solution is MOST cost-effective?

Accepted Answer

Amazon S3 with Amazon Athena for querying.. Amazon S3 with Athena is the most cost-effective solution because the data is semi-structured JSON, rarely updated, and accessed infrequently. S3 provides low-cost storage for static data, and Athena uses a serverless, pay-per-query model, eliminating the need for a running cluster or provisioned capacity. This combination avoids the fixed costs of Redshift, DynamoDB, or RDS, making it ideal for low-frequency SQL querying of archival logs.

Answer

Amazon Redshift with JSON ingestion and compression.

Answer

Amazon DynamoDB with JSON documents.

Answer

Amazon RDS for PostgreSQL with JSONB columns.

Question 6

A data engineer is designing a solution to securely store and rotate database credentials used by an application. The credentials should be automatically rotated every 90 days. Which AWS service should be used?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is designed specifically for storing, managing, and automatically rotating secrets such as database credentials. It natively supports rotation schedules (e.g., every 90 days) using Lambda rotation functions, and integrates with RDS, Redshift, and DocumentDB for managed rotation. This directly meets the requirement for automatic rotation every 90 days.

Answer

AWS Systems Manager Parameter Store

Answer

AWS Key Management Service (KMS)

Answer

AWS Identity and Access Management (IAM)

Question 7

A data engineer is troubleshooting a slow-running Amazon Athena query on a large dataset stored in S3. The query scans many small files. Which TWO actions can improve query performance?

Accepted Answer

Concatenate small files into larger files. Option C is correct because Athena performance is heavily degraded by many small files, since each file incurs overhead for opening, listing, and reading metadata; concatenating small files into larger files (typically 128 MB or more) reduces this per-file overhead and lets Athena scan data more efficiently. Option D is correct because partitioning the data by a frequently filtered column allows Athena to use partition pruning, so it reads only the relevant S3 prefixes instead of scanning the entire dataset, dramatically reducing the amount of data scanned and query time. Option A is incorrect because adding more small files increases metadata and open/close overhead rather than improving performance, even though parallelism is a factor. Option B is incorrect because S3 server-side encryption is transparent to Athena and disabling it does not affect query performance. Option E is incorrect because converting CSV to JSON does not inherently reduce scanned data or file count and JSON is typically more verbose, so it would not improve performance.

Answer

Increase the number of files to increase parallelism

Answer

Disable S3 server-side encryption

Answer

Convert files from CSV to JSON

Question 8

Refer to the exhibit. An AWS Glue ETL job is failing with an OutOfMemoryError. The job reads from Amazon S3 and performs a GROUP BY on a large dataset. Which change should the data engineer make to resolve this error?

Accepted Answer

Increase the number of DPUs allocated to the Glue job.. The OutOfMemoryError in an AWS Glue ETL job performing a GROUP BY on a large dataset indicates that the executors do not have enough memory to handle the shuffle operations required for aggregation. Increasing the number of DPUs (Data Processing Units) allocated to the Glue job increases the total memory and compute resources available, allowing the job to process larger partitions without running out of memory.

Answer

Use coalesce to reduce the number of partitions.

Answer

Increase the number of partitions in the DataFrame.

Answer

Use repartition to increase the number of partitions.

Question 9

A data engineer is troubleshooting an Amazon Redshift cluster that is not responding to queries. The engineer suspects that the cluster may have been accidentally deleted. Which AWS service should be used to investigate the deletion?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records API activity in an AWS account, including the DeleteCluster API call that would be logged when a Redshift cluster is deleted. By querying CloudTrail event history or a trail's logs, the engineer can identify who deleted the cluster, when, and from which source IP. This makes CloudTrail the correct service for investigating the deletion event itself.

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Answer

AWS Trusted Advisor

Question 10

A data engineer is designing a data pipeline that processes sensitive personal data. The data is ingested via Amazon Kinesis Data Firehose and stored in Amazon S3. The pipeline must ensure that the data is encrypted at rest and in transit. The engineer also needs to audit access to the data. Which combination of services meets these requirements?

Accepted Answer

S3 server-side encryption (SSE-S3) for at-rest encryption, HTTPS for in-transit encryption, and AWS CloudTrail for auditing.. Option C correctly combines S3 server-side encryption (SSE-S3) for data at rest, HTTPS (TLS) for data in transit, and AWS CloudTrail for auditing access. SSE-S3 provides AES-256 encryption managed by S3, HTTPS ensures secure ingestion and retrieval, and CloudTrail logs all API calls to S3, enabling audit trails. This meets all three requirements: encryption at rest, encryption in transit, and auditability.

Answer

AWS KMS for encryption at rest, Kinesis Data Analytics for in-transit encryption, and AWS CloudTrail for auditing.

Answer

AWS KMS for encryption at rest, Amazon CloudWatch Logs for auditing, and TLS for in-transit encryption.

Answer

S3 client-side encryption, AWS Config for auditing, and TLS for in-transit encryption.

Question 11

A company wants to enforce encryption in transit for data moving between an EC2 instance and an S3 bucket. Which TWO methods can achieve this? (Choose 2)

Accepted Answer

Add a bucket policy that denies requests without the aws:SecureTransport condition.. Option A is correct because a bucket policy with a Deny effect on s3:* conditioned on "aws:SecureTransport": "false" explicitly rejects any request made over plain HTTP, thereby enforcing encryption in transit for all access to the bucket, including from EC2. Option D is correct because S3's HTTPS endpoint (https://bucket.s3.amazonaws.com or the regional equivalent) uses TLS to encrypt data in transit between the EC2 instance and S3, satisfying the encryption-in-transit requirement directly. Option B is not correct because a VPC endpoint (Gateway or Interface) only changes the network path and can be used with either HTTP or HTTPS; it does not by itself guarantee encryption in transit. Option C is not correct because SSE-S3 provides encryption at rest for objects stored in the bucket, not encryption of data moving over the network. Option E is not correct because CloudTrail only logs and monitors API activity; it is a detective control that does not encrypt traffic or prevent unencrypted requests.

Answer

Use a VPC endpoint for S3.

Answer

Enable default SSE-S3 encryption on the bucket.

Answer

Enable CloudTrail to monitor for non-encrypted requests.

Question 12

Which TWO AWS services can be used to ingest streaming data from a mobile application into Amazon S3 for near-real-time analytics? (Choose 2.)

Accepted Answer

Amazon Kinesis Data Firehose. Amazon Kinesis Data Firehose is the correct choice because it is a fully managed service designed to load streaming data directly into Amazon S3, Redshift, Elasticsearch, or Splunk without requiring custom code. It can capture and transform streaming data from mobile applications in near-real-time and automatically deliver it to S3, making it ideal for near-real-time analytics pipelines.

Answer

Amazon DynamoDB Streams

Answer

AWS Glue

Answer

Amazon SQS

Question 13

A company is using AWS Lake Formation to manage access to a data lake in S3. They want to grant a data analyst access to specific columns in a table, but not to the entire table. Which Lake Formation feature should be used?

Accepted Answer

Column-level filtering. Lake Formation column-level filtering allows granting access to specific columns in a table without granting access to the entire table. Option A (row-level security) controls access to rows, not columns. Option B (IAM policies on the S3 bucket) would grant access to the entire dataset or bucket, not specific columns. Option D (tag-based access control) uses tags to manage permissions but does not provide column-level granularity.

Answer

Row-level security (cell-level filtering)

Answer

IAM policies on the S3 bucket

Answer

Tag-based access control (TBAC)

Question 14

A company is using Amazon Kinesis Data Streams to ingest real-time clickstream data from a website. The data is consumed by an Amazon Kinesis Data Analytics for Apache Flink application that performs real-time analytics. The Flink application writes its results to an Amazon S3 bucket. The company has noticed that the Flink application is experiencing high checkpoint failure rates, causing delays. The CloudWatch metrics show that the checkpoint size is large and increasing. The data engineer needs to reduce the checkpoint size. Which action should the data engineer take?

Accepted Answer

Enable incremental checkpointing in the Flink application to only write changes since the last checkpoint.. Enabling incremental checkpointing in the Flink application is the correct action because it only writes the changes since the last checkpoint, significantly reducing checkpoint size. This is especially effective when state is large and growing, as it avoids rewriting the entire state with each checkpoint.

Answer

Decrease the checkpoint interval to reduce the amount of state accumulated.

Answer

Reduce the parallelism of the Flink application.

Answer

Increase the state time-to-live (TTL) configuration to retain state longer.

Question 15

A company needs to enforce encryption at rest for all data stored in Amazon S3. Which of the following are valid methods to achieve this? (Choose TWO.)

Accepted Answer

Enable default bucket encryption using SSE-S3.. Option B is correct because enabling default bucket encryption with SSE-S3 causes Amazon S3 to automatically encrypt every object at rest using AES-256 with S3-managed keys, satisfying the requirement without any client changes. Option D is correct because client-side encryption encrypts the data before it ever reaches S3, so the objects are stored in encrypted form and remain protected at rest regardless of server-side settings. Option A is incorrect because S3 Transfer Acceleration only speeds up uploads over AWS edge locations and does not encrypt data at rest. Option C is incorrect because S3 Versioning only preserves multiple object versions and does not provide encryption. Option E is incorrect because SSL/TLS protects data in transit between the client and S3, not data at rest in the bucket.

Answer

Use Amazon S3 Transfer Acceleration.

Answer

Enable S3 Versioning.

Answer

Use SSL/TLS for all S3 API calls.