DEA-C01 Practice Test 43 — 15 Questions

Question 1

A data engineer is configuring an S3 bucket policy to allow cross-account access for a partner organization to write data to a specific prefix. The partner's AWS account ID is 111111111111. The engineer wants to ensure that only the partner can write, and that the partner cannot read or delete objects. Which policy statements should be included? (Choose TWO.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

{"Effect":"Allow","Principal":{"AWS":"111111111111"},"Action":"s3:PutObject","Resource":"arn:aws:s3:::mybucket/partner/*"}. The correct answers are C and E. Option C allows the partner account to perform s3:PutObject on the specified prefix, granting write access. Option E explicitly denies all actions except s3:PutObject, ensuring the partner cannot read or delete objects. Option A is incorrect because it specifies a user ARN instead of the account ARN, which would not allow all users in the partner account. Option B grants access to any principal with a condition, but the condition uses aws:SourceAccount which is not appropriate for cross-account access via bucket policy. Option D grants read and delete, which violates the requirement.

Answer

{"Effect":"Allow","Principal":{"AWS":"arn:aws:iam::111111111111:user/PartnerUser"},"Action":"s3:PutObject","Resource":"arn:aws:s3:::mybucket/partner/*"}

Answer

{"Effect":"Allow","Principal":"*","Action":"s3:PutObject","Resource":"arn:aws:s3:::mybucket/partner/*","Condition":{"StringEquals":{"aws:SourceAccount":"111111111111"}}}

Answer

{"Effect":"Allow","Principal":{"AWS":"111111111111"},"Action":["s3:GetObject","s3:DeleteObject"],"Resource":"arn:aws:s3:::mybucket/partner/*"}

Question 2

A company uses Amazon DynamoDB as the primary data store for a real-time application. The data engineer observes that some read requests are returning stale data, even though the application uses strongly consistent reads. The table has auto-scaling enabled with a maximum read capacity of 10,000 RCUs. The observed read traffic averages 8,000 RCUs but occasionally spikes to 12,000 RCUs. What is the most likely cause of the stale reads?

Accepted Answer

Read capacity auto-scaling cannot keep up with sudden traffic spikes, causing throttling and fallback to eventually consistent reads.. When read traffic spikes above the maximum auto-scaling limit of 10,000 RCUs (e.g., to 12,000 RCUs), the table cannot provision enough read capacity units quickly enough. This leads to throttling of requests. The AWS SDKs are designed to retry throttled requests, and under certain conditions, they may fall back to eventually consistent reads to reduce latency, which can return stale data. This explains why stale data appears even when the application explicitly requests strongly consistent reads. Option B is incorrect: write sharding does not inherently cause read-after-write inconsistencies; DynamoDB's strong consistency guarantees hold if capacity is sufficient. Option C is incorrect: DAX is a caching layer that provides eventual consistency by default; strongly consistent reads bypass DAX and go directly to the table, so DAX is not involved. Option D is incorrect: global tables replicate data asynchronously, but the statement says the application uses a single table; moreover, reading from a replica region would use eventually consistent reads only if configured, but the question states strongly consistent reads are used.

Answer

The application uses write sharding, causing read-after-write inconsistencies.

Answer

The application is using DynamoDB Accelerator (DAX) which caches data and may return stale values.

Answer

The table is part of a DynamoDB global table, and the application reads from a replica in a different region.

Question 3

A company uses Amazon S3 to store raw data files. An AWS Glue crawler creates metadata in the Data Catalog. The data engineer discovers that the crawler is not detecting new partitions after new data is added to the S3 bucket. What is the MOST likely cause?

Accepted Answer

The IAM role used by the crawler does not have kms:Decrypt permission for the KMS key that encrypts the new partitions.. When new partitions are added to an S3 bucket encrypted with AWS KMS (SSE-KMS), the AWS Glue crawler needs the kms:Decrypt permission to read the object metadata and detect the new partitions. Without this permission, the crawler cannot list the objects or determine the partition structure, so it fails to update the Data Catalog. Option B is incorrect because the crawler's partition detection is not disabled by default; the 'Crawl all folders' setting is for crawling subfolders, not for partition detection. Option C is incorrect because AWS Glue crawlers can handle large numbers of objects, and there is no specific limit that would prevent partition detection. Option D is incorrect because S3 event notifications are not required for crawling; the crawler periodically scans the S3 location and does not rely on events to detect changes.

Answer

The crawler configuration has 'Crawl all folders' disabled.

Answer

The S3 bucket has too many objects, exceeding the crawler's limit.

Answer

The crawler does not have S3 event notifications enabled.

Question 4

A company uses Amazon Redshift for data warehousing. The security team requires that all queries be logged for audit and that sensitive columns be masked for non-privileged users. Which THREE steps should the data engineer take? (Choose 3)

Accepted Answer

Implement row-level security using Redshift's row-level security feature.. The correct answers are A, B, and E. Option A: Redshift supports row-level security, which restricts access to rows based on user authorization, meeting the requirement to mask sensitive data for non-privileged users. Option B: Enabling audit logging on the Redshift cluster captures all queries for audit purposes, satisfying the logging requirement. Option E: Creating views that expose only non-sensitive columns and granting access to those views is a common method to implement column-level masking in Redshift. Option C is incorrect because AWS CloudTrail logs API calls to Redshift (e.g., cluster operations) but does not log SQL queries; for query logging, audit logging must be enabled. Option D is incorrect because IAM roles control access to the Redshift database itself but cannot restrict access to specific columns; column-level control is achieved through views or column-level security.

Answer

Enable CloudTrail logging for Redshift data events.

Answer

Use IAM roles to restrict access to specific columns.

Question 5

A data engineer is monitoring an Amazon Redshift cluster and notices that the 'WLM query wait time' metric is consistently high during peak hours. The cluster uses automatic WLM. The engineer wants to reduce query wait times without changing the cluster size. Which action is MOST effective?

Accepted Answer

Enable concurrency scaling.. Enabling concurrency scaling (Option A) is the most effective action because it automatically adds transient cluster capacity during peak loads, allowing more queries to run concurrently without increasing wait times. This is specifically designed to reduce WLM query wait time. Option B (manual WLM) requires tuning and does not add capacity. Option C (increasing max queries per queue) could increase concurrency but may lead to resource contention and longer wait times if the cluster is already saturated. Option D (short query acceleration) prioritizes short queries, which does not address overall wait times for all queries. Therefore, A is correct.

Answer

Change WLM to manual mode and increase the number of queues.

Answer

Increase the maximum number of queries per queue.

Answer

Enable short query acceleration (SQA).

Question 6

A data engineer receives the error shown in the exhibit when trying to upload a file to my-bucket. The engineer uses the AWS CLI with the following command: aws s3 cp file.txt s3://my-bucket/. What is the most likely cause of the error?

Accepted Answer

The object is not encrypted with SSE-KMS. The error indicates that the upload was denied because the object is not encrypted with SSE-KMS. The bucket policy likely requires SSE-KMS for all PutObject requests, but the AWS CLI command `aws s3 cp file.txt s3://my-bucket/` does not specify the `--sse aws:kms` flag, so the object is uploaded without the required encryption header. This causes the policy condition to evaluate to false, resulting in an access denied error. Option A is wrong because the command does not specify any KMS key; the error is about encryption header, not key validity. Option B is wrong because the error is not related to VPC endpoint policies. Option D is wrong because a default encryption configuration would automatically apply encryption, but the error suggests the upload attempted to skip encryption entirely, which is denied by the explicit policy requirement.

Answer

The KMS key specified in the command is incorrect

Answer

The VPC endpoint policy is blocking the request

Answer

The bucket does not have a default encryption configuration

Question 7

A company runs a real-time analytics platform that ingests data from thousands of sensors via Amazon Kinesis Data Streams. Each sensor sends a JSON payload every second. The data is consumed by a fleet of EC2 instances running a custom consumer application. Recently, the consumer has been falling behind, with the iterator age exceeding 10 minutes. The company has already increased the number of shards to 100, but the problem persists. The consumer application is single-threaded per shard and uses the Kinesis Client Library (KCL). The CPU utilization on the EC2 instances is below 30%. What should the data engineer do to reduce the iterator age?

Accepted Answer

Modify the consumer to use multiple worker threads per shard. The correct solution. The consumer is single-threaded per shard, which limits processing throughput despite low CPU utilization. Using multiple worker threads per shard allows concurrent processing of records from the same shard, reducing iterator age. Option A (more shards) was already tried and did not resolve the issue. Option B (larger EC2 instances) is unlikely to help because CPU is not the bottleneck. Option D (Lambda) may not handle the high-frequency sensor data efficiently and can introduce additional latency.

Answer

Increase the number of shards to 200

Answer

Use larger EC2 instances with more vCPUs

Answer

Replace the EC2 consumer with AWS Lambda functions

Question 8

A data engineer is troubleshooting a slow Amazon Redshift query. The EXPLAIN plan shows a 'Seq Scan' on a large table. What is the most likely cause?

Accepted Answer

The table does not have a proper sort key defined.. A 'Seq Scan' in the EXPLAIN plan indicates a full table scan, which typically occurs when the table does not have a proper sort key defined. Without a sort key, Redshift cannot use zone maps to skip blocks, resulting in a sequential scan. Option A (too many nodes) would not cause a Seq Scan; it might improve performance if properly distributed. Option B (concurrent queries) can cause slowdown but not specifically a Seq Scan. Option D (WLM queue misconfiguration) affects query queuing and concurrency, not the scan type.

Answer

The cluster has too many nodes.

Answer

There are too many concurrent queries.

Answer

The workload management (WLM) queue is misconfigured.

Question 9

A data engineer is migrating a legacy data warehouse to Amazon Redshift. The engineer needs to load data from multiple sources efficiently. Which THREE services can be used to load data into Redshift? (Choose THREE.)

Accepted Answer

Use the COPY command to load from Amazon DynamoDB.. The COPY command can load data from Amazon DynamoDB (A) and Amazon S3 (E) directly into Amazon Redshift. AWS DMS (C) can continuously replicate data from multiple sources into Redshift, making it a valid service for loading data. Option B (Kinesis Data Firehose) does not deliver data directly to Redshift; it writes to S3 first, then Redshift uses COPY. Option D (S3 Transfer Acceleration) accelerates uploads to S3, not loading into Redshift.

Answer

Use Kinesis Data Firehose to deliver data directly to Redshift.

Answer

Use S3 Transfer Acceleration.

Question 10

A data engineer is troubleshooting a nightly ETL job that reads data from an RDS MySQL instance and writes to an S3 bucket in Parquet format. The job runs on an EMR cluster and uses PySpark. Recently, the job started failing with 'OutOfMemoryError' in the executor logs. The data volume has grown 30% in the last month. Which is the MOST efficient solution to resolve this issue without changing the code?

Accepted Answer

Increase the executor memory and memoryOverhead in the Spark configuration.. The OutOfMemoryError in executors indicates insufficient memory per executor to handle the increased data volume. Increasing 'spark.executor.memory' and 'spark.executor.memoryOverhead' directly addresses this by providing more heap and off-heap memory without any code changes. Option A is wrong because the RDS instance size does not affect executor memory; the bottleneck is in Spark processing. Option B is wrong because switching to AWS Glue would require code changes and may still need memory tuning, making it less efficient. Option D is wrong because adding core nodes increases parallelism but does not increase memory per executor, so the OOM could still occur.

Answer

Change the RDS instance to a larger size to reduce load.

Answer

Switch the ETL job to use AWS Glue with a larger WorkerType.

Answer

Increase the number of core nodes in the EMR cluster.

Question 11

A company needs to protect sensitive data stored in Amazon S3 from unauthorized access. Which TWO actions should the data engineer take? (Choose two.)

Accepted Answer

Configure S3 bucket policies to require MFA for delete operations. S3 Block Public Access at the account level prevents any public access to S3 buckets, ensuring data is not exposed. Requiring MFA for delete operations via bucket policies adds an extra layer of security by requiring a second factor. Cross-region replication is for disaster recovery, not security. Lifecycle policies manage storage costs. Versioning protects against accidental deletion but does not prevent unauthorized access.

Answer

Enable cross-region replication for all buckets

Answer

Set up an S3 Lifecycle policy to transition objects to Glacier

Answer

Enable S3 Versioning on all buckets

Question 12

Refer to the exhibit. A data engineer sees this error in CloudWatch Logs from an AWS Glue ETL job. The job reads from an S3 location that contains both .parquet and .csv files. What is the most likely cause?

Accepted Answer

The job is reading a CSV file that was incorrectly placed in the directory with .parquet extension.. The error indicates that the job encountered an object that is not a valid Parquet file. Since the S3 location contains both .parquet and .csv files, the Glue job likely attempted to read a CSV file as if it were Parquet, causing the invalid Parquet error. Option C is correct because the CSV file was incorrectly placed in the directory with a .parquet extension (or the job's schema inference expects all files to be Parquet). Option A is incorrect because the error is about format, not a missing file. Option B is incorrect because the error is about the object's format, not a permissions issue. Option D is incorrect because insufficient memory would typically cause out-of-memory or capacity errors, not an invalid Parquet error.

Answer

The S3 object was deleted during the job execution.

Answer

The IAM role does not have permission to read the S3 object.

Answer

The Glue job does not have enough memory to parse the Parquet file.

Question 13

A data engineer is managing an Amazon RDS for PostgreSQL instance that serves as a source for change data capture (CDC) using AWS DMS. The DMS task is a full load followed by ongoing replication. The full load completed successfully, but the ongoing replication is failing with the error 'Value too long for character type'. The engineer has verified that the target database schema matches the source. The source table has a VARCHAR(256) column, and the target has VARCHAR(256) as well. However, some source rows contain values longer than 256 characters. What should the engineer do to resolve the issue?

Accepted Answer

Alter the target table column to a larger data type, such as VARCHAR(512).. The error indicates that source data exceeds the column length. The source column definition may not enforce the length, or the data was inserted bypassing constraints. The engineer should alter the target column to a larger size, such as VARCHAR(512), to accommodate the actual data. Option A is wrong because truncating data may cause data loss. Option B is wrong because renaming would cause mapping issues. Option C is wrong because the error is not about character set; using CLOB may not be compatible with the CDC process and would change the data type.

Answer

Modify the DMS task to truncate data that exceeds the column length.

Answer

Rename the target column to match a different source column.

Answer

Change the target column to a CLOB data type.

Question 14

A company runs a data processing pipeline using Amazon EMR with Spark. The pipeline reads from S3, processes data, and writes to S3. Recently, the job started failing with 'S3AccessDeniedException' even though the EMR role has appropriate S3 permissions. Which TWO actions should the data engineer take to resolve this issue? (Choose TWO.)

Accepted Answer

Verify that the EMR service role has the necessary S3 permissions in IAM.. Options B and D are correct. B: The EMR service role (and instance profile) must have an IAM policy granting S3 permissions; verifying these ensures the role has the necessary access. D: S3 bucket policies can include explicit deny statements that override IAM permissions, even if the IAM role allows access; checking the bucket policy can reveal such denies. Option A is wrong because S3 versioning does not affect access permissions. Option C is wrong because disabling S3 Block Public Access is unrelated to IAM-based access from EMR. Option E is wrong because an S3 VPC endpoint is not required if the cluster can access S3 via the internet or a NAT gateway.

Answer

Enable S3 versioning on the bucket to allow multiple access methods.

Answer

Disable S3 Block Public Access settings on the bucket.

Answer

Ensure the EMR cluster is launched in a VPC with an S3 VPC endpoint.

Question 15

A company is designing a data lake on AWS and must comply with GDPR requirements. The company needs to implement data masking for personally identifiable information (PII) columns in Amazon Redshift. Which feature should be used?

Accepted Answer

Create views in Redshift that apply masking functions. Amazon Redshift supports dynamic data masking through views that apply masking functions, such as using CASE statements or custom masking functions to obfuscate PII columns. Option A is incorrect because Amazon RDS Proxy is a connection proxy for RDS databases and does not provide data masking capabilities for Redshift. Option B is incorrect because Amazon S3 Object Lambda is used to transform data in S3, not to mask data in Redshift queries. Option D is incorrect because AWS Lake Formation row-level security filters rows based on permissions but does not mask or obfuscate column values; it is for access control, not data masking.

Answer

Use Amazon RDS Proxy to intercept queries

Answer

Amazon S3 Object Lambda to mask data on the fly

Answer

AWS Lake Formation row-level security