DEA-C01 Practice Test 37 — 15 Questions

Question 1

An IAM policy is attached to an AWS Glue job. The job needs to read from and write to S3 buckets, and also trigger other Glue jobs. The job is failing with an AccessDenied error when trying to write to a bucket named 'example-bucket'. What is the MOST likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The bucket name in the resource ARN does not match the actual bucket name.. The AccessDenied error when writing to 'example-bucket' most likely occurs because the resource ARN in the IAM policy specifies a different bucket name, causing the S3 service to deny the s3:PutObject action. IAM policies require exact ARN matches for resource-based permissions, and a mismatch between the ARN bucket name and the actual bucket name will result in an implicit deny, even if the action is allowed.

Answer

The policy does not include s3:PutObject action.

Answer

The policy uses a resource ARN with a wildcard, which is not allowed.

Answer

The policy does not allow Glue actions.

Question 2

A data engineer is troubleshooting a slow-running query on an Amazon Redshift cluster. The query involves joining two large tables. The engineer notices that the query plan shows a large number of distribution and broadcast operations. Which design change would most likely improve query performance?

Accepted Answer

Change the distribution style of both tables to KEY on the join column. Changing the distribution style of both tables to KEY on the join column ensures that rows with the same join key value are co-located on the same node. This eliminates the need for expensive broadcast or redistribution operations during the join, as Redshift can perform the join locally on each slice without moving data across the network.

Answer

Change the distribution style of both tables to ALL

Answer

Change the distribution style of both tables to EVEN

Answer

Add a sort key on the join column

Question 3

A company stores sensitive data in an Amazon S3 bucket. A compliance requirement mandates that all data must be encrypted at rest with a key that is automatically rotated every year. The company also needs to maintain an audit trail of who used the key. Which solution meets these requirements?

Accepted Answer

Use AWS KMS customer managed keys (SSE-KMS) with automatic key rotation enabled.. AWS KMS customer managed keys (SSE-KMS) with automatic key rotation enabled satisfies both requirements: it encrypts data at rest in S3 and automatically rotates the KMS key every year. Additionally, KMS integrates with AWS CloudTrail to log every API call (e.g., Decrypt, GenerateDataKey) that uses the key, providing an audit trail of who used the key and when.

Answer

Use customer-provided encryption keys (SSE-C) and rotate keys manually.

Answer

Use S3 managed keys (SSE-S3) and enable S3 server access logs.

Answer

Configure a bucket policy to enforce encryption using the 'aws:SecureTransport' condition.

Question 4

A data engineer is troubleshooting a Kinesis Data Firehose delivery stream that ingests JSON log data from web servers. The stream is configured to transform records with an AWS Lambda function and deliver to an Amazon S3 bucket. Recently, the stream has been failing with 'InvalidData' errors. Which action should the engineer take to resolve the issue?

Accepted Answer

Check the CloudWatch Logs for the Lambda function to identify transformation errors.. The 'InvalidData' error in Kinesis Data Firehose typically indicates that the Lambda function used for data transformation is failing or returning malformed records. By checking the CloudWatch Logs for the Lambda function, the engineer can identify specific transformation errors, such as incorrect JSON parsing, missing fields, or exceptions, which cause Firehose to reject the records. This is the most direct troubleshooting step because Firehose relies on the Lambda function to return valid transformed data in the expected format.

Answer

Verify the S3 bucket policy allows Firehose to write.

Answer

Increase the buffer size and interval in the Firehose delivery stream.

Answer

Change the data format to CSV in the Firehose configuration.

Question 5

A data engineer is monitoring an Amazon EMR cluster and notices that one core node is running out of disk space. The cluster is running a Spark job that processes large Parquet files. What should the engineer do to prevent the issue?

Accepted Answer

Enable Snappy compression for intermediate data. Enabling Snappy compression for intermediate data reduces the volume of data written to disk during Spark shuffle operations, directly addressing the disk space issue on the core node. Snappy provides a good balance between compression ratio and speed, minimizing I/O overhead while conserving storage. This is a standard tuning practice in Amazon EMR for Spark jobs that process large Parquet files.

Answer

Terminate the core node and replace it with a larger instance type

Answer

Use Spark's in-memory processing to avoid writing intermediate data to disk

Answer

Increase the number of core nodes

Question 6

Arrange the steps to create an AWS Glue job that transforms data from Amazon S3 to Amazon Redshift in the correct order.

Accepted Answer

Step 1: Catalog the source data with a crawler. Step 2: Prepare the ETL script. Step 3: Configure the job with connections. Step 4: Run the job. Step 5: Verify the results in Amazon Redshift.. First, catalog the source data with a crawler. Then, prepare the ETL script. Configure the job with connections, run it, and finally verify the results in Redshift.

Answer

Step 1: Prepare the ETL script. Step 2: Catalog the source data with a crawler. Step 3: Configure the job with connections. Step 4: Run the job. Step 5: Verify the results in Amazon Redshift.

Answer

Step 1: Configure the job with connections. Step 2: Catalog the source data with a crawler. Step 3: Prepare the ETL script. Step 4: Run the job. Step 5: Verify the results in Amazon Redshift.

Answer

Step 1: Catalog the source data with a crawler. Step 2: Configure the job with connections. Step 3: Prepare the ETL script. Step 4: Run the job. Step 5: Verify the results in Amazon Redshift.

Question 7

A data engineer is troubleshooting an Amazon Redshift cluster that is experiencing slow query performance. The engineer notices that the disk space is heavily utilized and queries are spilling to disk. What is the most cost-effective solution to improve performance?

Accepted Answer

Resize the cluster to a larger node type or add nodes. When queries spill to disk due to heavy disk utilization, the root cause is insufficient memory or compute capacity relative to the workload. Resizing the cluster (adding nodes or moving to a larger node type) directly increases available memory and CPU, reducing or eliminating disk spill and improving query performance. This is the most cost-effective solution because it scales resources proportionally without requiring manual tuning or schema changes.

Answer

Run VACUUM command to reclaim space

Answer

Change distribution style to KEY

Answer

Apply compression encoding to tables

Question 8

Which THREE storage classes in Amazon S3 are designed for infrequently accessed data with millisecond retrieval times? (Select THREE.)

Accepted Answer

S3 One Zone-IA. S3 One Zone-IA is designed for infrequently accessed data that requires millisecond retrieval times, but does not require the resilience of multiple Availability Zones. It stores data in a single AZ and offers the same low-latency performance as S3 Standard, making it suitable for non-critical, infrequently accessed data.

Answer

S3 Glacier Flexible Retrieval

Answer

S3 Glacier Deep Archive

Question 9

A company is migrating a legacy data warehouse to Amazon Redshift. They need to choose a distribution style to minimize data movement during joins. Which THREE factors should they consider?

Accepted Answer

The size of the table (number of rows).. The size of the table (number of rows) directly influences the distribution strategy. In Amazon Redshift, large tables benefit from a distribution style that evenly distributes rows across slices to avoid data skew, which can cause performance bottlenecks during joins. Choosing a distribution key that aligns with the join columns minimizes data movement, but the table size determines whether an ALL distribution (for small tables) or a KEY distribution (for large tables) is more appropriate to reduce shuffling.

Answer

The number of columns in the table.

Answer

The data type of the distribution key column.

Question 10

Match each AWS storage class to its description.

Accepted Answer

S3 Standard: Designed for frequently accessed data with low latency and high throughput.. Correct matches: S3 Standard for frequently accessed data, S3 Intelligent-Tiering for automatic cost optimization, and S3 Glacier for archival. Common confusions involve mixing up Standard-IA and Glacier Deep Archive definitions.

Answer

S3 Standard-IA: Lowest-cost storage class for long-term retention with retrieval times of 12 hours.

Answer

S3 Glacier Deep Archive: For data accessed less frequently but requires rapid access when needed.

Question 11

A company uses AWS Glue to catalog data in Amazon S3. The data includes personally identifiable information (PII). The security team requires that PII be masked when queried by users who are not data owners. Which AWS service should be used to enforce this requirement?

Accepted Answer

Use AWS Lake Formation to define column-level security and data masking.. AWS Lake Formation provides fine-grained access control and column-level masking for data cataloged in the Glue Data Catalog, enabling PII masking at query time. Option A is wrong because Amazon Macie discovers and classifies PII but does not automatically redact data from S3 objects. Option B is wrong because IAM policies with condition keys can restrict access but cannot perform data masking. Option D is wrong because Amazon S3 Object Lambda can transform data at the object level but not at the query level for dynamic masking.

Answer

Use Amazon Macie to automatically redact PII from S3 objects.

Answer

Use IAM policies with condition keys to restrict access based on tags.

Answer

Use Amazon S3 Object Lambda to transform data on the fly.

Question 12

A data engineer is responsible for ingesting daily CSV files from an external partner into an Amazon S3 bucket. The partner uploads files to an AWS Transfer Family (SFTP) endpoint. Once a file is uploaded, an AWS Lambda function triggers an AWS Glue ETL job to transform the data and load it into an Amazon RDS database. Recently, some files have failed to trigger the Glue job because the Lambda function timed out while waiting for the Glue job to complete. The engineer needs to ensure that all files are processed reliably without manual intervention. What should the data engineer do?

Accepted Answer

Modify the Lambda function to send a message to an Amazon SQS queue after uploading, and create a separate Lambda function that reads from the queue and triggers the Glue job asynchronously.. Decoupling the Lambda function from the Glue job by using SQS allows the Lambda function to submit the job and exit, while a second Lambda function monitors completion. Option B is wrong because increasing Lambda timeout still ties it to job duration. Option C is wrong because the issue is not concurrency. Option D is wrong because increasing S3 events does not address the timeout.

Answer

Increase the Lambda function timeout to 15 minutes to accommodate longer Glue jobs.

Answer

Increase the Lambda function's reserved concurrency to allow multiple invocations.

Answer

Configure S3 event notifications to trigger the Glue job directly without Lambda.

Question 13

A data engineer is troubleshooting a failed AWS Glue job that reads from an Apache Hive metastore in an Amazon EMR cluster. The error message indicates 'ClassNotFoundException: org.apache.hadoop.hive.ql.metadata.HiveException'. The Glue job uses a custom Python shell script. What is the most likely cause of this error?

Accepted Answer

Include the Hive JAR files in the 'Python library path' or use a Glue version with Hive support.. The ClassNotFoundException for Hive classes indicates that the required Hive JARs are not available in the Glue job's classpath. The solution is to include the Hive JAR files in the 'Python library path' or use a Glue version that supports Hive connectivity. Option A is incorrect because a network connectivity issue would cause a different error, such as a timeout or connection refused. Option C is incorrect because simply adding an import statement in the Python script does not provide the underlying JAR files; the JARs must be included via library path. Option D is incorrect because IAM permissions do not affect class loading; the error is related to missing dependencies, not authorization.

Answer

Check the network connectivity between Glue and the EMR cluster.

Answer

Modify the Python script to import the Hive libraries manually.

Answer

Update the IAM role to allow 'hive:Describe*' actions.

Question 14

A company runs an Apache Spark job on Amazon EMR that writes output to an S3 bucket. The job fails with the error 'S3AccessDeniedException' when writing the final output, but earlier stages succeed. The EMR cluster uses a service role and an instance profile. The S3 bucket policy allows access from the VPC only. What is the MOST likely cause?

Accepted Answer

The EMR cluster is not using a VPC endpoint for S3, so requests are denied by the bucket policy's VPC condition.. The bucket policy restricts access to requests originating from the VPC, typically using a condition like `aws:SourceVpc`. If the EMR cluster does not use a VPC endpoint for S3 (either Gateway or Interface endpoint), traffic from the cluster to S3 traverses the public internet and does not match the VPC condition, causing the `S3AccessDeniedException`. Earlier stages may succeed if they use cached data or different paths, but the final write fails because it hits the bucket policy check.

Answer

The S3 bucket uses SSE-C encryption, and the EMR cluster does not have the encryption key.

Answer

The EMR service role does not have permissions to write to the S3 bucket.

Answer

The S3 bucket is configured with 'Bucket owner enforced' setting for ACLs, and the EMR cluster's account is not the bucket owner.

Question 15

A data engineer is troubleshooting a slow-running Amazon Redshift query. The query joins several large tables and performs aggregations. The engineer runs EXPLAIN and sees a 'DS_DIST_ALL' step. Which TWO actions will MOST likely improve query performance? (Choose TWO.)

Accepted Answer

Change the distribution style of the tables to DISTSTYLE KEY on the join columns.. The DS_DIST_ALL step in the query plan indicates that data is being broadcast from one node to all others, causing significant network overhead. Option C is correct because changing the distribution style to DISTSTYLE KEY on the join columns ensures that matching rows are co-located on the same node, reducing the need for redistribution. Option E is correct because defining appropriate SORTKEYs based on query predicates allows the query optimizer to use zone maps to skip irrelevant blocks, speeding up scans and aggregations. Option A is incorrect; VACUUM reorganizes data on disk but does not affect distribution. Option B is incorrect; CNAME is a DNS record type, not a Redshift command. Option D is incorrect; increasing nodes might not directly fix the distribution issue and is less targeted than changing distribution style.

Answer

Run the VACUUM command on all tables.

Answer

Use the CNAME command to rename the tables.

Answer

Increase the number of nodes in the Redshift cluster.