DEA-C01 Practice Test 39 — 15 Questions

Question 1

A data engineer is troubleshooting a Lambda function that reads from a Kinesis Data Stream, processes records, and writes to a Kinesis Data Firehose delivery stream. The Firehose delivery stream is configured to deliver data to an S3 bucket. The Lambda function is failing with an access denied error. The IAM policy attached to the Lambda execution role is shown in the exhibit. Which permission is missing?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

firehose:PutRecord on the Firehose delivery stream. The Lambda function is failing due to a missing permission to write to the Kinesis Data Firehose delivery stream. The required permission is firehose:PutRecord (or firehose:PutRecordBatch). The IAM policy likely lacks this permission, causing an access denied error when the Lambda attempts to write records. Option A correctly identifies this missing permission.

Answer

firehose:DescribeDeliveryStream on the Firehose delivery stream

Answer

logs:CreateLogGroup and logs:CreateLogStream on the CloudWatch log group

Answer

s3:PutObjectAcl on the S3 bucket

Question 2

A company uses AWS Glue for ETL jobs. The data engineer needs to ensure that the Glue job can access an S3 bucket in another account. What is the recommended approach?

Accepted Answer

Assign an IAM role to the Glue job with permissions to access the bucket, and configure the bucket policy to allow the role. For a Glue job in one account to access an S3 bucket in another account, the standard approach is to grant the Glue job's IAM role permissions to perform S3 actions on the bucket and configure the bucket policy in the target account to allow that role's ARN. Option A is technically possible if the target account's role trusts the Glue job's account and the job has sts:AssumeRole permissions, but this adds unnecessary complexity and is not the recommended method. Option C is incorrect because Glue jobs do not have resource-based policies. Option D is incorrect because Glue jobs cannot use static access keys.

Answer

Create an IAM role in the target account and have the Glue job assume that role

Answer

Configure the S3 bucket policy to allow the Glue job's IAM role and also set the Glue job's resource-based policy

Answer

Store AWS access keys for the target account in AWS Secrets Manager and have the Glue job retrieve them

Question 3

A data engineer runs the above AWS CLI command to investigate who uploaded a file to an S3 bucket. The output shows the event was recorded. Which additional step is needed to confirm the identity of the user?

Accepted Answer

No additional step is needed; the 'Username' field already identifies the IAM user.. The 'Username' field in the CloudTrail event log directly identifies the IAM user who made the API call. No additional step is needed to confirm the identity. Options B, C, and D are unnecessary as they provide supplementary information but do not directly identify the user when the Username is already present.

Answer

Use the 'MFA' field to check if multi-factor authentication was used.

Answer

View the 'accessKeyId' field in the CloudTrailEvent JSON.

Answer

Look up the 'sourceIPAddress' in the CloudTrailEvent.

Question 4

A company uses AWS DMS to replicate data from an Amazon RDS for MySQL database to Amazon S3. Which TWO configurations are required to enable continuous change data capture (CDC) from MySQL?

Accepted Answer

Grant REPLICATION CLIENT and REPLICATION SLAVE privileges to the DMS user. Correct options: B and C. For AWS DMS to perform continuous change data capture (CDC) from a MySQL source, binary logging (binlog) must be enabled on the source database (option C) to capture changes. Additionally, the MySQL user used by DMS must be granted the REPLICATION CLIENT and REPLICATION SLAVE privileges (option B) to read the binlog and stream changes. Option D (S3 bucket versioning) is not required for DMS CDC. Option A (same Region) is not a requirement. Option E (Multi-AZ) is not needed for CDC. Therefore, B and C are the required configurations.

Answer

Ensure the S3 bucket is in the same AWS Region as the source database

Answer

Enable versioning on the target S3 bucket

Answer

Configure the MySQL source to be Multi-AZ

Question 5

A data engineer is troubleshooting an AWS Glue job that is failing with an Access Denied error when trying to read data from an S3 bucket. The IAM policy attached to the Glue job's IAM role is shown in the exhibit. What is the likely cause of the failure?

Accepted Answer

The policy does not include s3:ListBucket permission on the bucket.. The IAM policy grants s3:GetObject and s3:PutObject on the bucket objects, but it does not include s3:ListBucket permission on the bucket itself. When AWS Glue reads data from S3, it needs to list the objects in the bucket first (s3:ListBucket) to discover which objects to read. Without this permission, the Glue job fails with an Access Denied error even though it has GetObject permission. Option A is incorrect because the policy does include s3:GetObject (implied for objects) and the issue is not about PutObject. Option B is incorrect because glue:StartJobRun is not related to S3 access; the error is S3-specific. Option D is incorrect because glue:GetJobRun is unrelated to the S3 access issue.

Answer

The policy does not include s3:GetObject or s3:PutObject permissions.

Answer

The policy does not include glue:StartJobRun permission.

Answer

The policy does not include glue:GetJobRun permission.

Question 6

A company is ingesting IoT sensor data into Amazon Kinesis Data Streams. Each sensor sends a JSON payload every second. The data must be transformed and aggregated in real-time before being stored in Amazon DynamoDB. Which THREE services should be used together in the pipeline? (Choose THREE.)

Accepted Answer

AWS Lambda. Amazon Kinesis Data Streams (D) is the ingestion layer that captures the JSON payloads from IoT sensors in real-time, ensuring data is available for processing. AWS Lambda (A) can be used as a consumer of the stream to perform lightweight, per-record transformations, such as filtering or enriching the JSON payloads. Amazon Kinesis Data Analytics (B) is required for real-time aggregation and complex transformations using SQL or Apache Flink, enabling calculations like averages or counts per second before storing in DynamoDB. Together, these three services form a complete real-time pipeline: ingest with Kinesis Data Streams, transform/aggregate with Kinesis Data Analytics, and optionally further transform with Lambda before writing to DynamoDB.

Answer

Amazon S3

Answer

Amazon Kinesis Data Firehose

Question 7

A company is using AWS DMS to migrate a 5 TB SQL Server database to Amazon Aurora PostgreSQL. The migration is using full load plus CDC. After the full load completes, the ongoing replication task is failing with errors related to large transactions on the source. The team needs to ensure that CDC continues without falling behind. What should the team do?

Accepted Answer

Increase the DMS replication instance size to provide more memory and CPU.. Increasing the DMS replication instance size provides more memory and CPU, enabling the instance to process large transactions more efficiently and keep up with CDC changes without falling behind. Option C (modifying MaxFileSize and decreasing CommitRate) is not the best solution because decreasing CommitRate means less frequent commits, which could worsen the problem by accumulating more data per commit. The more direct approach is to scale the instance vertically to handle the load.

Answer

Use Amazon Kinesis Data Streams as an intermediate target for CDC.

Answer

Modify the DMS task settings to increase MaxFileSize and decrease the CommitRate.

Answer

Disable foreign key constraints on the target Aurora database.

Question 8

A media company stores video files in an S3 bucket. The files are processed by a fleet of EC2 instances that read the files, add watermarks, and write the output back to the same bucket. Recently, the processing jobs have been failing with '500 Internal Server Error' and '503 Slow Down' errors. The data engineer checks the S3 bucket metrics and sees that the PUT/GET request rate is consistently above 5,500 requests per second for a single prefix. The engineer needs to resolve the errors with minimal changes to the application code. Which course of action should the engineer take?

Accepted Answer

Modify the application to add a random hash prefix to the object keys to distribute load across multiple prefixes.. S3 supports up to 5,500 GET/HEAD requests per second per prefix (and 3,500 PUT requests). By adding a random hash prefix to object keys, the load is distributed across multiple prefixes, effectively increasing the aggregate request rate limit. Option A (S3 Batch Operations) is designed for large-scale batch operations, not for real-time processing, and would not resolve the immediate request rate errors. Option B (increasing EC2 instances) would increase the request rate, potentially worsening the problem. Option C (S3 Transfer Acceleration) improves transfer speed over long distances but does not affect the per-prefix request rate limits.

Answer

Use S3 Batch Operations to process the files.

Answer

Increase the number of EC2 instances to process files in parallel.

Answer

Enable S3 Transfer Acceleration on the bucket to improve throughput.

Question 9

A data engineer at a media company is managing an Amazon RDS for MySQL database that stores user profiles and preferences. The database has been running on a db.r5.large instance with 500 GB of General Purpose SSD (gp2) storage. Recently, the application team has noticed increased query latency during peak hours. Amazon CloudWatch metrics show that the ReadIOPS metric is consistently peaking at 5,000 IOPS, which is near the baseline performance of the gp2 volume (1,500 IOPS baseline for 500 GB, but with bursts up to 3,000 IOPS for short periods). The database is not CPU-bound, and memory utilization is moderate. The data engineer needs to resolve the I/O bottleneck with minimal cost increase. The company is open to changing the storage type or instance class, but wants to avoid over-provisioning. What should the data engineer do?

Accepted Answer

Change the storage type to General Purpose SSD (gp3) and set the provisioned IOPS to 5,000.. Gp3 provides a baseline of 3,000 IOPS at no additional cost and allows provisioning additional IOPS independently. Setting provisioned IOPS to 5,000 gives the required performance without the burst limitations of gp2 and at a lower cost than io1. Option B is incorrect because Multi-AZ does not improve read IOPS; the standby is not used for reads. Option C is incorrect because io1 would be more expensive than gp3 for the same IOPS. Option D is incorrect because upgrading the instance class adds memory and compute, which does not directly improve IOPS, and would increase cost unnecessarily.

Answer

Enable Multi-AZ deployment to offload reads to the standby instance.

Answer

Change the storage type to Provisioned IOPS SSD (io1) and provision 5,000 IOPS.

Answer

Upgrade the instance to a db.r5.xlarge to get more memory and reduce I/O.

Question 10

A company wants to use AWS Glue to transform data stored in Amazon S3. The data is partitioned by date and includes both CSV and Parquet files. The transformation should be optimized for cost and performance. Which THREE actions should the data engineer take? (Choose THREE.)

Accepted Answer

Use partition pruning by filtering on the date column in the ETL script.. Options B, C, and E are correct. Partition pruning (B) reduces the amount of data scanned by filtering on the date column, lowering cost and improving performance. Job bookmarks (C) track processed data, preventing reprocessing and saving time and cost. Converting files to Parquet (E) reduces data size and enhances query performance due to its columnar format. Option A is incorrect because running a crawler before each job creates unnecessary overhead; the schema can be defined once or crawled periodically. Option D is incorrect because increasing DPUs to the maximum is costly and does not optimize performance; proper data partitioning and format are more effective.

Answer

Run a crawler to update the schema before each job run.

Answer

Increase the number of DPUs to the maximum allowed.

Question 11

A company wants to ingest data from SaaS applications (e.g., Salesforce, Marketo) into Amazon S3 for analytics. The data volume is moderate and updates occur frequently. Which AWS service is BEST suited for this task?

Accepted Answer

Amazon AppFlow. Amazon AppFlow is specifically designed to securely transfer data from SaaS applications like Salesforce and Marketo to AWS services such as Amazon S3. It handles authentication, data transformation, and scheduling. Amazon Kinesis Data Streams is for real-time streaming data, not batch ingestion from SaaS. AWS Database Migration Service (DMS) is for migrating databases, not SaaS data. AWS Glue is an ETL service that can process data but is not optimized for direct SaaS ingestion.

Answer

Amazon Kinesis Data Streams

Answer

AWS Database Migration Service (DMS)

Answer

AWS Glue

Question 12

A data engineering team needs to ingest streaming data from thousands of IoT devices. The data must be processed in near real-time and stored in Amazon S3 in Apache Parquet format partitioned by device_id and timestamp. Which combination of services should the team use to minimize operational overhead and cost?

Accepted Answer

Amazon Kinesis Data Streams, Amazon Kinesis Data Firehose, and optionally AWS Lambda.. Amazon Kinesis Data Streams ingests streaming data from thousands of IoT devices in near real-time. Kinesis Data Firehose delivers the data directly to Amazon S3 with built-in conversion to Apache Parquet and automatic partitioning by device_id and timestamp, minimizing operational overhead. AWS Lambda can optionally be used for lightweight transformations if needed. Option A is incorrect because using Amazon EC2 for processing adds significant operational overhead for scaling and management. Option B is incorrect because Amazon MSK (Kafka) and AWS Glue Streaming require more operational overhead and are not as cost-effective for this simple near-real-time use case. Option D is incorrect because S3 Transfer Acceleration is designed for large file transfers over long distances, not for streaming data ingestion, and AWS Lambda alone cannot handle continuous streaming without a dedicated ingestion service like Kinesis.

Answer

Amazon Kinesis Data Streams, Amazon EC2 for processing, and Amazon S3 with lifecycle policies.

Answer

Amazon MSK (Kafka), AWS Glue Streaming, and Amazon S3.

Answer

Amazon S3 Transfer Acceleration and AWS Lambda for event-driven transformation.

Question 13

A company uses AWS Glue ETL jobs to transform data and load it into Amazon Redshift. The jobs are failing with 'Out of Memory' errors. What is the most cost-effective way to resolve this issue without changing the transformation logic?

Accepted Answer

Increase the number of G.1X workers in the Glue job configuration.. Increasing the number of G.1X workers (DPUs) adds parallelism, allowing the job to handle more data in memory without changing logic, and is cost-effective since G.1X workers are cheaper than G.2X. Option B is wrong: Redshift Spectrum is for querying data directly from S3, not for fixing memory issues in Glue ETL jobs. Option C is wrong: Changing to G.2X workers increases memory per worker but is more expensive than adding more G.1X workers; the goal is cost-effective. Option D is wrong: Switching to Scala does not directly address memory issues and may require code changes.

Answer

Use Amazon Redshift Spectrum to query data directly from S3 without transformation.

Answer

Change the worker type to G.2X and keep the same number of workers.

Answer

Switch the job from Python to Scala.

Question 14

A data engineer is building a real-time data pipeline to ingest sensor data from IoT devices. The data is sent to AWS IoT Core, which publishes messages to a Kinesis Data Stream. Each message is about 1 KB in size. The data must be transformed (add a device location field) and then stored in Amazon S3 for long-term analytics. The engineer has set up a Lambda function to transform the records and write to S3. However, the engineer notices that the Lambda function is invoked thousands of times per second, causing high costs and occasional throttling. The Lambda function processes only one record at a time. The engineer wants to reduce the number of Lambda invocations and improve throughput. What should the engineer do?

Accepted Answer

Configure the event source mapping to use a larger batch size and set a batch window.. Configuring the event source mapping with a larger batch size and a batch window allows Lambda to process multiple records per invocation, reducing the number of invocations and costs. This improves throughput and reduces throttling. Option A is incorrect because reducing shards reduces the stream capacity, causing backpressure and potential data loss. Option B is incorrect because increasing memory does not reduce the number of invocations; it only speeds up processing per invocation, but still processes one record at a time. Option C is incorrect because Kinesis Data Firehose can batch records, but it still uses per-record Lambda transformation if you use a Lambda function, or it can use built-in transformations but not the flexible logic described. The most direct solution is to batch records in the existing Lambda function via event source mapping parameters.

Answer

Reduce the number of shards in the Kinesis stream to limit concurrency.

Answer

Increase the Lambda function's memory allocation to improve performance.

Answer

Replace the Lambda function with Amazon Kinesis Data Firehose and use its built-in transformation.

Question 15

A data engineer is designing a data lake on Amazon S3 that must comply with GDPR. The engineer needs to ensure that individuals can request deletion of their personal data. Which THREE AWS services can be used together to automate the deletion of specific records?

Accepted Answer

AWS Lambda. AWS Lambda can be used to process deletion requests and trigger actions. Amazon S3 Batch Operations can perform bulk actions on S3 objects, such as deleting them. Amazon S3 Select can query specific records within S3 objects to identify which ones need deletion, enabling targeted removal. Together, these services automate the deletion of specific records to comply with GDPR. AWS Glue is an ETL service, not designed for selective deletion, and Amazon DynamoDB is a NoSQL database, not directly applicable to S3 data.

Answer

AWS Glue

Answer

Amazon DynamoDB