DEA-C01 Practice Test 41 — 15 Questions

Question 1

A data engineer needs to ensure that an S3 bucket is encrypted at rest using AWS KMS. The bucket policy must allow only a specific IAM role to access the bucket and enforce encryption in transit. Which combination of bucket policy statements should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use kms:ViaService: s3.*.amazonaws.com and aws:SecureTransport: true. Option A uses the kms:ViaService condition key to restrict the use of the KMS key to requests that come through Amazon S3 (s3.*.amazonaws.com) and the aws:SecureTransport condition to enforce encryption in transit. This ensures that only requests made via S3 and using HTTPS/TLS are allowed to use the key. Option B uses s3:x-amz-server-side-encryption: AES256, which enforces SSE-S3 (AES-256) encryption, not KMS encryption. Option C uses s3:x-amz-server-side-encryption-aws-kms-key-id, which requires a specific KMS key ID, but the aws:SourceIp condition does not enforce encryption in transit. Option D uses kms:EncryptionContext, which can be used to enforce KMS encryption but does not include the aws:SecureTransport condition, so encryption in transit is not enforced.

Answer

Use s3:x-amz-server-side-encryption: AES256 and aws:SecureTransport: true

Answer

Use s3:x-amz-server-side-encryption-aws-kms-key-id and aws:SourceIp

Answer

Use kms:EncryptionContext: service:s3 and aws:SecureTransport: true

Question 2

A company uses AWS Lake Formation to manage permissions on a data lake in S3. A data analyst reports that queries using Amazon Athena return zero rows for a table that the analyst has been granted SELECT permission on. The table is registered in Lake Formation and uses a partition projection. What is the most likely cause?

Accepted Answer

The analyst lacks GetObject and ListBucket permissions on the underlying S3 location. When a table in Lake Formation uses partition projection, Athena bypasses the Glue Data Catalog for partition discovery and directly accesses the S3 location. This requires explicit S3 permissions (GetObject and ListBucket) on the underlying data, which Lake Formation does not automatically grant. The analyst likely can see the table metadata but cannot read the data, resulting in zero rows. Option A is incorrect because the table is registered in Lake Formation (otherwise it wouldn't appear in Athena). Option B is incorrect because DESCRIBE permission is not required for SELECT queries; SELECT alone should suffice. Option D is incorrect because encryption permission issues would cause an error message, not a silent return of zero rows.

Answer

The table is not registered as a resource in Lake Formation

Answer

The analyst does not have DESCRIBE permission on the table

Answer

The table uses server-side encryption with KMS and the analyst lacks kms:Decrypt permission

Question 3

A data engineer is building a streaming pipeline using Amazon Kinesis Data Streams. The data must be enriched with reference data from a DynamoDB table before being written to S3. The engineer wants to minimize latency. Which architecture is BEST?

Accepted Answer

Use Kinesis Data Analytics for Apache Flink to enrich and output to Firehose.. (Kinesis Data Analytics for Apache Flink) is the best choice because it supports low-latency enrichment using external sources like DynamoDB via asynchronous I/O, meeting the requirement to minimize latency. Option A (AWS Glue streaming ETL) is designed for batch-oriented processing and introduces higher latency. Option C (Kinesis Data Firehose with a Lambda function) may experience cold starts and limited concurrency, increasing latency. Option D (Lambda polling the stream) also suffers from cold starts and scalability issues, making it less suitable for low-latency enrichment.

Answer

Use AWS Glue streaming ETL to read from Kinesis, enrich, and write to S3.

Answer

Use Kinesis Data Firehose with a Lambda function for enrichment.

Answer

Use a Lambda function to poll the stream, enrich, and write to Firehose.

Question 4

A data engineer is troubleshooting a daily batch ingestion pipeline that uses AWS Glue to read CSV files from Amazon S3 and write Parquet files to another S3 bucket. The job runs successfully but takes significantly longer than expected. The engineer notices that the input data is highly skewed with many small files. Which is the most effective optimization to reduce job duration?

Accepted Answer

Enable the 'groupFiles' option in the S3 source configuration. The 'groupFiles' option in AWS Glue's S3 source configuration allows Glue to combine small files into larger splits, reducing the number of tasks and the overhead associated with processing many small files. This directly addresses the high skew and small file issue, significantly reducing job duration. Option A is incorrect because changing the output format from Parquet to JSON would likely increase file size and processing time, not reduce it. Option C is incorrect because increasing DPUs may improve parallelism but does not solve the file-level overhead; it could even be wasteful if the bottleneck is task scheduling. Option D is incorrect because enabling the schema registry is unrelated to file grouping; it is used for schema management and validation.

Answer

Change the output format to JSON

Answer

Increase the number of DPUs allocated to the job

Answer

Enable the 'use_glue_schema_registry' option

Question 5

A data pipeline ingests streaming data from thousands of IoT devices into Kinesis Data Streams. The data must be transformed using a simple field mapping before being stored in S3. Which service should be used to perform the transformation with minimal operational overhead?

Accepted Answer

Kinesis Data Firehose with a Lambda transformation. Kinesis Data Firehose can invoke a Lambda function to perform simple field mapping transformations before delivering data to S3, minimizing operational overhead. Option A is wrong because AWS Lambda invoked directly by the Kinesis stream requires custom logic for S3 delivery and stream management, increasing overhead. Option B is wrong because AWS Glue ETL jobs are designed for batch processing and are more complex to set up for streaming transformations. Option C is wrong because Kinesis Data Analytics is used for real-time analytics with SQL or Flink, not simple field mapping transformations.

Answer

AWS Lambda function invoked by the Kinesis stream

Answer

AWS Glue ETL job

Answer

Kinesis Data Analytics

Question 6

A company wants to ingest data from an on-premises SQL Server database into Amazon Redshift. They need to transform the data during ingestion, such as masking PII columns. Which approach meets these requirements with minimal operational overhead?

Accepted Answer

Use AWS Database Migration Service (DMS) with transformation rules. AWS DMS can perform transformations, such as data masking, during the migration process and can load data directly into Amazon Redshift, minimizing operational overhead. Option A (AWS Glue ETL) adds an extra step and overhead compared to DMS. Option B (custom application on EC2) introduces high operational overhead for management and scaling. Option C (Kinesis Data Firehose) is designed for streaming data and is not suitable for batch ingestion from an on-premises SQL Server database.

Answer

Use AWS Glue ETL jobs to extract data from SQL Server, transform it, and load into Redshift

Answer

Use a custom application on EC2 to extract, transform, and load

Answer

Use Kinesis Data Firehose to stream data from SQL Server to Redshift

Question 7

A company uses Kinesis Data Firehose to deliver streaming data to S3. They need to transform the data by adding a timestamp and removing sensitive fields. Which TWO approaches can achieve this?

Accepted Answer

Use AWS Glue ETL to process data after delivery to S3. Options C and E are correct. E: Kinesis Firehose can invoke a Lambda function to transform records (add timestamp, remove fields) before delivery to S3. C: AWS Glue ETL can process data after it is stored in S3, performing transformations like adding timestamps and removing sensitive fields. Option A is incorrect because Kinesis Data Analytics is for real-time analytics, not for adding timestamps or removing fields in the Firehose pipeline. Option B is incorrect because S3 Select is used to retrieve subsets of data using SQL, not to transform data. Option D is incorrect because Redshift Spectrum is for querying data in S3, not for transforming it.

Answer

Use Kinesis Data Analytics to transform the stream

Answer

Use S3 Select to transform data at rest

Answer

Use Amazon Redshift Spectrum to transform data

Question 8

A company stores IoT sensor data in S3 as JSON files. They need to convert the data to Parquet format for efficient querying with Amazon Athena. Which AWS service can perform this transformation with minimal effort?

Accepted Answer

AWS Glue ETL job. AWS Glue ETL jobs can easily convert JSON to Parquet with built-in transforms. Option A is wrong because Kinesis Data Firehose is for streaming data ingestion, not batch transformations. Option B is wrong because Amazon Athena is a query engine, not a transformation service. Option D is wrong because AWS Lambda is for small, event-driven transformations and is not ideal for large-scale batch conversion.

Answer

Kinesis Data Firehose

Answer

Amazon Athena

Answer

AWS Lambda

Question 9

Match each AWS service to its primary purpose in data engineering.

Accepted Answer

Amazon S3: Object storage for data lakes. The correct matches are: Amazon S3 → object storage for data lakes (A), AWS Glue → serverless ETL (B), Amazon Athena → interactive SQL queries on S3 (C), and Amazon Redshift → data warehousing (D). Common confusions involve mixing up services like Kinesis (streaming) with Glue (ETL) or Data Pipeline (orchestration) with Kinesis (ingestion).

Answer

AWS Kinesis: Serverless ETL service

Answer

AWS Data Pipeline: Real-time data ingestion

Question 10

A data engineering team needs to ingest streaming data from an application into Amazon S3 for analytics. The data volume is moderate and the team wants the lowest operational overhead. Which AWS service should they use?

Accepted Answer

Amazon Kinesis Data Firehose. Amazon Kinesis Data Firehose is a fully managed service for loading streaming data into S3 with no code required and minimal operational overhead. Option A is incorrect because Amazon SQS is a message queue service, not designed for streaming data ingestion into S3. Option B is incorrect because AWS Glue is primarily a batch ETL service, not suitable for real-time streaming. Option C is incorrect because Amazon Kinesis Data Streams requires custom consumers and more management, increasing operational overhead.

Answer

Amazon SQS

Answer

AWS Glue

Answer

Amazon Kinesis Data Streams

Question 11

Refer to the exhibit. A Glue ETL job failed. What is the most likely cause?

Accepted Answer

Some source files have a different schema than others.. The error 'Cannot merge incompatible schemas' indicates that some source files have a different schema than others, preventing the Glue ETL job from merging them. Option D is wrong because insufficient DPUs cause memory or performance errors, not schema conflicts. Option B is wrong because partition pruning is about filtering data, not schema mismatches. Option C is wrong because job bookmarks track processed files to avoid reprocessing, not schema issues.

Answer

The job bookmarks are misconfigured.

Answer

The source data has inconsistent partitioning.

Answer

The job ran out of memory due to insufficient DPUs.

Question 12

A company uses Amazon Athena to query data in S3. Recently, queries have become slow. The data is stored as CSV files in a partitioned table. What is the most effective way to improve query performance?

Accepted Answer

Convert the data to Parquet format and optimize partitioning.. The correct answer. Parquet is a columnar storage format that allows Athena to read only the columns needed for a query, reducing I/O and improving performance. Combined with effective partitioning, it enables partition pruning, which further limits the data scanned. CSV files are row-based and require full scans, even with partitioning. Option A is incorrect because Athena is serverless and users cannot increase nodes; resources are managed automatically. Option C is incorrect: JSON is also row-based and verbose, making it even slower than CSV. Option D is incorrect because larger CSV files still lead to full scans; Parquet's columnar nature is more impactful than file size.

Answer

Increase the number of nodes in the Athena query engine.

Answer

Convert the data to JSON format.

Answer

Increase the size of the CSV files to reduce the number of files.

Question 13

A data engineer is using Amazon Kinesis Data Firehose to deliver streaming data to an S3 bucket. The data is delivered in 5-minute intervals. However, the engineer notices that the data in S3 is often delayed by up to 30 minutes. Which configuration change would most likely reduce the delay?

Accepted Answer

Decrease the 'Buffer interval' from 300 seconds to 60 seconds.. The buffer interval determines the maximum time Firehose will wait before delivering data, regardless of buffer size. Decreasing it from 300 to 60 seconds forces more frequent deliveries, reducing the delay. Option B (compression) reduces data size, which could slow buffer filling and potentially increase delay if the buffer size trigger is not met. Option C (increasing buffer size) would cause Firehose to wait longer for the buffer to fill, increasing delay. Option D (dynamic partitioning) affects data organization, not delivery frequency, so it does not reduce delay.

Answer

Enable compression (GZIP) on the Firehose delivery stream.

Answer

Increase the 'Buffer size' from 5 MB to 50 MB.

Answer

Enable 'Dynamic partitioning' on the Firehose stream.

Question 14

A data engineer is setting up a data pipeline using AWS DMS to migrate data from an on-premises database to Amazon RDS for MySQL. The data must be encrypted in transit. Which TWO options can the engineer use? (Choose TWO.)

Accepted Answer

Enable SSL encryption on the DMS endpoint. DMS supports SSL/TLS for encrypting connections. Option A (VPC peering) is incorrect because VPC peering does not encrypt traffic. Option B (Enable SSL encryption on the DMS endpoint) is correct because SSL/TLS encrypts the data in transit. Option C (Set up a VPN connection) is correct because VPN creates an encrypted tunnel. Option D (Use KMS) is incorrect because KMS is for encryption at rest, not in transit. Option E (VPC endpoint) is incorrect because VPC endpoints provide private connectivity but do not encrypt transit.

Answer

Use VPC peering between on-premises and AWS

Answer

Use KMS to encrypt the DMS connection

Answer

Use a VPC endpoint for DMS

Question 15

A company ingests IoT sensor data into an S3 bucket. Daily, a Lambda function reads new objects, processes them, and writes results to a DynamoDB table. Recently, the Lambda function started timing out after 15 minutes. The data volume has increased, and the function processes records one by one. Which solution would improve performance without significant cost increase?

Accepted Answer

Use S3 Batch Operations to invoke the Lambda function in parallel for each object.. S3 Batch Operations invokes the Lambda function for each object in parallel, efficiently handling increased volume without significant cost increase. Option A is incorrect because AWS Glue ETL jobs have startup overhead and may cost more. Option B is incorrect because increasing the timeout does not address the root cause of sequential processing; the function would still process records one by one and may still timeout. Option D is incorrect because increasing DynamoDB write capacity does not speed up the Lambda processing; the bottleneck is the sequential processing within the function.

Answer

Replace Lambda with an AWS Glue ETL job.

Answer

Increase the Lambda function timeout to 30 minutes.

Answer

Increase the DynamoDB write capacity units.