DEA-C01 Practice Test 38 — 15 Questions

Question 1

A data engineer needs to store semi-structured JSON logs from multiple sources in a centralized data store for querying using SQL. The logs are immutable and need to be retained for 90 days. Which AWS service should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Amazon S3 with Amazon Athena.. Amazon S3 with Amazon Athena is the correct choice because S3 provides durable, cost-effective storage for immutable semi-structured JSON logs, and Athena enables serverless SQL querying directly against the data in S3 without needing to load or transform it. This combination meets the 90-day retention requirement and supports querying semi-structured data using standard SQL via Athena's built-in JSON SerDe.

Answer

Amazon RDS for MySQL.

Answer

Amazon DynamoDB.

Answer

Amazon ElastiCache for Redis.

Question 2

A data engineer is building a real-time data pipeline to ingest sensor data from IoT devices. The data is sent to AWS IoT Core, which publishes messages to a Kinesis Data Stream. Each message is about 1 KB in size. The data must be transformed (add a device location field) and then stored in Amazon S3 for long-term analytics. The engineer has set up a Lambda function to transform the records and write to S3. However, the engineer notices that the Lambda function is invoked thousands of times per second, causing high costs and occasional throttling. The Lambda function processes only one record at a time. The engineer wants to reduce the number of Lambda invocations and improve throughput. What should the engineer do?

Accepted Answer

Configure the event source mapping to use a larger batch size and set a batch window.. Configuring the event source mapping with a larger batch size and a batch window allows Lambda to process multiple records per invocation, reducing the number of invocations and costs. This improves throughput and reduces throttling. Option A is incorrect because reducing shards reduces the stream capacity, causing backpressure and potential data loss. Option B is incorrect because increasing memory does not reduce the number of invocations; it only speeds up processing per invocation, but still processes one record at a time. Option C is incorrect because Kinesis Data Firehose can batch records, but it still uses per-record Lambda transformation if you use a Lambda function, or it can use built-in transformations but not the flexible logic described. The most direct solution is to batch records in the existing Lambda function via event source mapping parameters.

Answer

Reduce the number of shards in the Kinesis stream to limit concurrency.

Answer

Increase the Lambda function's memory allocation to improve performance.

Answer

Replace the Lambda function with Amazon Kinesis Data Firehose and use its built-in transformation.

Question 3

A data engineering team needs to transform CSV files to Parquet format after they land in an S3 bucket. The transformation should be triggered automatically as soon as a new file arrives. Which AWS service is best suited for this task?

Accepted Answer

AWS Lambda function triggered by S3 event. AWS Lambda functions can be directly triggered by S3 events (e.g., `s3:ObjectCreated:*`) to process newly uploaded CSV files. This serverless approach provides near-instantaneous, event-driven transformation to Parquet without managing any infrastructure, making it the most cost-effective and simplest solution for this specific use case.

Answer

AWS Batch job submitted by S3 event

Answer

Amazon EMR cluster running continuously

Answer

AWS Glue ETL job scheduled every 5 minutes

Question 4

A company uses Kinesis Data Firehose to deliver streaming data to S3. They need to transform the data by adding a timestamp and removing sensitive fields. Which TWO approaches can achieve this?

Accepted Answer

Use AWS Glue ETL to process data after delivery to S3. Option E is correct because Kinesis Data Firehose natively supports Lambda-based data transformation: you attach a Lambda function to the delivery stream, and Firehose invokes it synchronously on each record (or batch) before delivery, allowing the function to add a timestamp and strip sensitive fields. Option C is correct because AWS Glue ETL can process the data after it lands in S3, using Spark-based jobs to enrich records with timestamps and drop sensitive columns, which is a valid post-delivery transformation approach. Option A is not correct because Kinesis Data Analytics is for real-time SQL/Flink analytics on streams, not for modifying records delivered by Firehose. Option B is not correct because S3 Select only filters and projects data at rest using SQL on individual objects; it cannot add timestamps or rewrite/remove fields. Option D is not correct because Redshift Spectrum queries data in S3 for analytics and does not transform or modify the delivered objects.

Answer

Use Kinesis Data Analytics to transform the stream

Answer

Use S3 Select to transform data at rest

Answer

Use Amazon Redshift Spectrum to transform data

Question 5

A company wants to store data from thousands of IoT devices with varying data rates. The data must be stored in a schema-on-read fashion and support SQL queries. Which AWS service should be used?

Accepted Answer

Amazon S3 with Amazon Athena. Amazon S3 stores data in its native format (e.g., JSON, Parquet) without requiring a predefined schema, enabling schema-on-read. Amazon Athena uses Presto-based SQL to query data directly from S3, making it ideal for IoT data with varying rates and ad-hoc SQL analysis without provisioning servers.

Answer

Amazon RDS for MySQL

Answer

Amazon DynamoDB

Answer

Amazon Redshift

Question 6

A company needs to ingest streaming data from thousands of IoT devices. The data must be processed in real-time and stored in Amazon S3. Which TWO services should be used together?

Accepted Answer

Amazon Kinesis Data Streams. Amazon Kinesis Data Streams (A) is correct because it provides a highly scalable, real-time streaming ingestion layer that can continuously capture data from thousands of IoT devices with low latency and durable, ordered record storage across shards. Amazon Kinesis Data Firehose (B) is correct because it is the fully managed delivery service that can consume that streaming data and automatically batch, transform, and load it directly into Amazon S3 without writing custom consumer applications. Together they satisfy the requirement for real-time processing plus reliable storage in S3. AWS Glue (C) is a serverless ETL and data catalog service, not a streaming ingestion or delivery mechanism, so it does not fit this pipeline. Amazon SQS (D) is a message queue for decoupling applications, not a real-time streaming service designed for high-throughput IoT telemetry or direct S3 delivery. AWS Direct Connect (E) is a dedicated network connection from on-premises to AWS, not a data streaming or processing service.

Answer

AWS Glue

Answer

Amazon Simple Queue Service (SQS)

Answer

AWS Direct Connect

Question 7

Refer to the exhibit. A data engineer has attached this IAM policy to an AWS Glue job role. The Glue job fails when trying to write transformed data to an S3 bucket located in a different AWS account. What is the most likely reason?

Accepted Answer

The policy does not grant s3:ListBucket, and the bucket policy may not allow cross-account access. The IAM policy shown does not include the s3:ListBucket permission, which is required for the Glue job to list objects in the S3 bucket before writing. Additionally, cross-account access requires both the source account's IAM policy (this one) to grant write permissions and the target account's S3 bucket policy to explicitly allow the source account's role, which may not be configured. Without s3:ListBucket, the Glue job cannot verify the bucket's existence or structure, causing the write operation to fail.

Answer

The policy does not allow lambda:InvokeAsync

Answer

The Glue job role does not have permissions to write to S3

Answer

The policy does not include kinesis:DescribeStream

Question 8

A data engineer needs to securely store database credentials used by a Lambda function. The solution must automatically rotate the credentials every 90 days. Which AWS service should the engineer use?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is purpose-built for storing and managing secrets such as database credentials, API keys, and tokens. It natively supports automatic rotation via Lambda rotation functions on a schedule (e.g., every 90 days), and integrates with RDS, Redshift, and DocumentDB for managed rotation. This directly satisfies both the secure storage and automatic 90-day rotation requirements.

Answer

AWS CloudHSM

Answer

AWS Systems Manager Parameter Store

Answer

IAM Roles for Lambda

Question 9

A company uses Amazon Redshift for analytics. The data engineering team wants to improve query performance for frequently used aggregate queries. Which TWO actions would help achieve this?

Accepted Answer

Use distribution keys to collocate data on the same node slices. Option B is correct because choosing an appropriate distribution key collocates matching rows on the same node slices, so joins and aggregations can be processed locally without expensive data redistribution (broadcast or shuffle) across the cluster, directly speeding up frequently used aggregate queries. Option D is correct because defining appropriate sort keys physically orders data on disk by the key columns, enabling zone maps to skip irrelevant blocks and allowing efficient range-restricted scans and merge joins, which reduces the data read for aggregate queries. Option A is not correct because adding WLM query queues only changes concurrency and memory allocation among query groups; it does not by itself make an individual aggregate query faster. Option C is not correct because VACUUM reclaims space from deleted rows and re-sorts data, which is a maintenance operation rather than a design change that improves aggregate query performance. Option E is not correct because adding nodes increases cluster capacity and parallelism but does not address the underlying data layout, so poorly distributed or unsorted tables can still cause slow aggregate queries.

Answer

Increase the number of WLM query queues

Answer

Run the VACUUM command to reclaim space from deleted rows

Answer

Increase the number of nodes in the cluster

Question 10

A data engineer needs to design a data ingestion pipeline that captures streaming data from mobile app events into Amazon S3 for analytics. The pipeline must support real-time processing of events and allow for schema evolution over time. Which AWS services should the engineer use? (Choose THREE.)

Accepted Answer

Amazon Kinesis Data Analytics. Amazon Kinesis Data Analytics is correct because it enables real-time processing of streaming data using SQL or Apache Flink, allowing the engineer to analyze mobile app events as they arrive. This supports the requirement for real-time processing before the data is stored in Amazon S3 for analytics.

Answer

AWS Glue ETL jobs

Answer

AWS AppFlow

Question 11

A company needs to ingest real-time clickstream data from a web application into Amazon Redshift with minimal latency. The data volume is high and requires processing before loading. Which architecture is MOST appropriate?

Accepted Answer

Kinesis Data Streams -> Kinesis Data Firehose -> Redshift. D is correct because Kinesis Data Streams captures high-volume clickstream data in real time, and Kinesis Data Firehose can buffer, transform (e.g., with Lambda), and load the data directly into Amazon Redshift with near-zero latency. This architecture is purpose-built for streaming ingestion with minimal overhead, unlike batch or intermediary storage approaches.

Answer

AWS Glue ETL jobs scheduled every 5 minutes -> Redshift

Answer

S3 -> Lambda -> Redshift

Answer

DynamoDB Streams -> Lambda -> Redshift

Question 12

A data engineer is running an AWS Glue ETL job that reads from an Amazon RDS MySQL database and writes to Amazon S3. The job fails with a 'Communications link failure' error. The security group for the RDS instance allows inbound traffic from the Glue job's security group. What is the most likely cause of the failure?

Accepted Answer

The Glue job's security group does not allow outbound traffic to the RDS security group on port 3306.. AWS Glue ETL jobs run in a VPC that requires outbound security group rules to initiate connections to RDS. Even if the RDS security group allows inbound traffic from the Glue security group, the Glue security group must also have an outbound rule allowing traffic to the RDS security group on port 3306 (MySQL default port). Without this outbound rule, the TCP handshake from Glue to RDS fails, causing a 'Communications link failure'.

Answer

The JDBC connection string in the Glue job does not include the database name.

Answer

The Glue job is using the wrong JDBC driver.

Answer

The IAM role used by the Glue job does not have rds:Connect permission.

Question 13

A company uses AWS Glue ETL to process data from Amazon S3 and write results to Amazon Redshift. The job fails with a memory error when processing large files. Which action should the data engineer take to resolve this issue?

Accepted Answer

Increase the number of DPUs allocated to the Glue job.. Increasing the number of DPUs (Data Processing Units) allocated to the AWS Glue job provides more memory and compute resources, which directly addresses the out-of-memory error when processing large files. Glue jobs run on Apache Spark, and insufficient DPUs can cause executors to run out of memory during shuffle or aggregation operations on large datasets.

Answer

Reduce the number of partitions in the Glue job.

Answer

Switch to a smaller instance type in the Glue job configuration.

Answer

Use S3 Select to filter columns before reading into Glue.

Question 14

A data engineer is troubleshooting an AWS Glue ETL job that fails with the error: 'An error occurred while calling o137.pyWriteDynamicFrame. No such file or directory: s3://bucket/output/part-00000.parquet'. The job reads from a JDBC source and writes to S3. What is the most likely cause?

Accepted Answer

The output S3 path does not exist and the Glue job does not have permission to create it. The error 'No such file or directory: s3://bucket/output/part-00000.parquet' indicates that the Glue job is trying to write to an S3 path that does not exist. By default, AWS Glue does not automatically create the target S3 bucket or prefix; it requires the path to already exist or the IAM role to have s3:PutObject permissions that allow the S3 service to create the object. Since the error occurs at the write stage (pyWriteDynamicFrame) and not during read, the most likely cause is that the output S3 path does not exist and the Glue job lacks the necessary permissions to create it.

Answer

The schema of the source data has changed, causing a mismatch during write

Answer

The Glue job ran out of memory during the transformation phase

Answer

The IAM role attached to the Glue job lacks permissions to read from the JDBC source

Question 15

A data engineer is setting up cross-account access to an encrypted S3 bucket. The bucket uses a customer-managed KMS key. The engineer has configured the bucket policy and the IAM role in the source account. The target account still gets access denied errors when trying to read objects. What is the most likely cause?

Accepted Answer

The KMS key policy does not grant the target account's IAM role the kms:Decrypt permission.. For cross-account access to an S3 bucket encrypted with a customer-managed KMS key, the KMS key policy must explicitly grant the target account's IAM role the kms:Decrypt permission. Without this, the target account will get access denied errors even if the bucket policy and IAM role are correctly configured. Option B is incorrect because Object Ownership does not affect cross-account read access. Option C is incorrect because the bucket policy only needs to allow the target account's IAM role, not the root user. Option D is incorrect because VPC Endpoint policies are not relevant to this cross-account access issue.

Answer

The S3 bucket has Object Ownership set to BucketOwnerPreferred.

Answer

The bucket policy does not allow the target account's root user.

Answer

The VPC Endpoint policy blocks access from the target account.