DEA-C01 Practice Test 45 — 15 Questions

Question 1

A company uses Amazon RDS for PostgreSQL with encryption at rest using AWS KMS. The company needs to share a database snapshot with a different AWS account. What must be done to allow the target account to restore the snapshot?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Share the snapshot and update the KMS key policy to allow the target account to use the key. Cross-account snapshot sharing of an encrypted snapshot requires both sharing the snapshot and granting the target account permission to use the KMS key via the key policy. Option A is incorrect because copying does not grant the necessary key access. Option B is incorrect because IAM roles are not used for this purpose; KMS key policies are the mechanism for cross-account access. Option D is incorrect because encryption cannot be disabled on an existing encrypted snapshot.

Answer

Copy the snapshot to the target account's region and share it

Answer

Create an IAM role in the source account that allows cross-account snapshot access

Answer

Disable encryption on the snapshot before sharing

Question 2

A data pipeline uses AWS Glue to process large CSV files. The team notices that some jobs fail with out-of-memory errors. Which TWO configuration changes can help mitigate this issue?

Accepted Answer

Increase the number of DPUs for the Glue job.. Options B and C are correct: increasing the number of DPUs provides more memory, and enabling autoscaling allows the job to automatically scale resources as needed. Option A (reducing DPUs) would worsen the problem by limiting resources. Option D (converting to Parquet) can improve performance but is not a direct configuration change for the Glue job itself. Option E (job bookmarks) is for incremental processing and does not affect memory.

Answer

Reduce the number of DPUs to limit concurrency.

Answer

Convert input files from CSV to Parquet.

Answer

Enable job bookmarks.

Question 3

A data engineer is managing an Amazon Redshift cluster and needs to load data from Amazon S3. The engineer uses the COPY command but encounters the error: 'S3ServiceException: Access Denied.' The Redshift cluster has an IAM role attached with permissions to access the S3 bucket. What is the most likely cause of this error?

Accepted Answer

The S3 bucket policy does not grant access to the IAM role used by Redshift.. The Access Denied error from S3 during a COPY operation typically indicates that the IAM role used by Redshift does not have sufficient permissions, or the S3 bucket policy does not allow the role. Even if the role has an S3 policy, an explicit deny or missing allow in the bucket policy can cause this. The engineer should verify both the IAM role's policies and the S3 bucket policy.

Answer

The IAM role attached to the Redshift cluster does not have the correct trust relationship with Redshift.

Answer

The Redshift cluster is not in the same AWS Region as the S3 bucket.

Answer

The COPY command is missing the CREDENTIALS parameter.

Question 4

A startup is building a mobile application that requires a database to store user profiles and preferences. The database must scale automatically with minimal administration. Which AWS service should they use?

Accepted Answer

Amazon DynamoDB. Amazon DynamoDB is a fully managed NoSQL key-value and document database that delivers single-digit millisecond performance at any scale. It supports automatic scaling of throughput capacity and storage with no downtime, making it ideal for a mobile application that requires minimal administrative overhead. The serverless, pay-per-request billing model aligns perfectly with the startup's need for automatic scaling and low operational burden.

Answer

Amazon Redshift

Answer

Amazon Aurora

Answer

Amazon RDS for PostgreSQL

Question 5

A data engineer is using Amazon Kinesis Data Firehose to deliver streaming data to Amazon S3. The data is in JSON format, and the engineer needs to convert it to Parquet before storage to optimize Athena queries. The Firehose delivery stream is configured with an AWS Lambda function for record transformation. However, the transformed data is still in JSON format in S3. What is the likely cause?

Accepted Answer

The Firehose delivery stream is not configured with the 'Convert record format' option to convert JSON to Parquet using an AWS Glue table.. Kinesis Data Firehose can convert JSON to Parquet using the record format conversion feature, which relies on an AWS Glue table for schema. This option must be enabled in the delivery stream; otherwise, data remains in JSON even if a Lambda function transforms records. The Lambda function cannot perform the conversion itself, so enabling the Firehose setting is the correct fix.

Answer

The Lambda function is missing the necessary IAM permissions to write Parquet files to S3.

Answer

The Lambda function is not correctly converting the JSON to Parquet; it must output Parquet-formatted records.

Answer

The S3 bucket is configured with an S3 Lifecycle policy that converts objects to Parquet after a certain period.

Question 6

A data engineer is designing a data ingestion pipeline for IoT sensor data. The data is generated at a high velocity and must be processed in near real-time. The pipeline must also handle bursty traffic. Which TWO AWS services should be combined to achieve this? (Choose TWO.)

Accepted Answer

Amazon Kinesis Data Analytics. Amazon Kinesis Data Streams is designed for real-time, high-velocity data ingestion, providing durable, ordered data streams that can handle bursty traffic by scaling shard capacity. Amazon Kinesis Data Analytics can process these streams in near real-time using SQL or Apache Flink, enabling immediate transformations and analytics without needing to store data first.

Answer

Amazon S3

Answer

Amazon Simple Queue Service (SQS)

Answer

AWS Glue

Question 7

A company uses AWS Glue to process sensitive data stored in S3. The security team requires that all data be encrypted at rest using customer-managed KMS keys. The data engineers are encountering 'Access Denied' errors when running Glue ETL jobs. What is the most likely cause?

Accepted Answer

The Glue service role does not have kms:Decrypt and kms:Encrypt permissions for the KMS key.. To decrypt S3 objects encrypted with a customer-managed KMS key, the AWS Glue job's service role must have kms:Decrypt and kms:Encrypt permissions in its IAM policy, and the KMS key policy must grant that role access. The most likely cause of the Access Denied error is missing KMS permissions on the Glue service role (A). Option B is a possible KMS key policy denial, but it is less likely than missing IAM KMS permissions in this scenario and is not as direct. Option C is irrelevant because Data Catalog encryption uses a different key and does not prevent S3 object access. Option D would be an S3 bucket policy denial, not a KMS 'Access Denied'; the issue here is KMS permissions.

Answer

The KMS key policy does not allow the AWS Glue service to use the key.

Answer

The Glue Data Catalog is encrypted with a different KMS key.

Answer

The S3 bucket policy denies access to the Glue service role.

Question 8

A company runs an Amazon RDS for PostgreSQL instance for an OLTP application. The database size is 500 GB. The company wants to minimize downtime during backups and ensure point-in-time recovery (PITR) for the last 7 days. Which TWO features should the company use? (Choose TWO.)

Accepted Answer

Enable Multi-AZ deployment for high availability.. Multi-AZ deployment for Amazon RDS provides high availability by automatically provisioning and maintaining a synchronous standby replica in a different Availability Zone. This minimizes downtime during backups by allowing automated backups to be taken from the standby instance, eliminating I/O suspension on the primary. Option C is correct because enabling automated backups with a retention period of 7 days enables point-in-time recovery (PITR) within that window, restoring the database to any second within the retention period using transaction logs.

Answer

Create a read replica in a different Availability Zone.

Answer

Create daily manual snapshots and copy them to another region.

Answer

Enable Enhanced Monitoring to track backup progress.

Question 9

A data engineer is designing a pipeline that ingests streaming data into Amazon S3 using Amazon Kinesis Data Firehose. The data must be delivered to S3 in Parquet format and partitioned by date. The engineer needs to configure the Firehose delivery stream. Which two actions are required to meet these requirements? (Choose two.)

Accepted Answer

Enable record format conversion in the Firehose delivery stream and select Apache Parquet as the output format.. To deliver Parquet, Firehose must use record format conversion, which requires selecting Parquet and referencing a Glue Data Catalog table for the schema. To partition by date, Firehose must use dynamic partitioning with a JQ expression that extracts the date from each record and includes it in the S3 prefix. Together, these two configurations satisfy the format and partitioning requirements.

Answer

Enable Amazon CloudWatch Logs for the Firehose delivery stream.

Answer

Set the Firehose buffer size to 128 MB and buffer interval to 900 seconds.

Answer

Attach an IAM role to Firehose that allows s3:PutObject and glue:GetTable.

Question 10

A data engineer manages an AWS Glue ETL job that reads JSON files from Amazon S3, transforms the data, and writes to an Amazon Redshift table. The job recently started failing with the error 'Communication link failure: connection reset'. The Redshift cluster is healthy and the IAM role used by the Glue job has the necessary permissions. The engineer notices that the job runs longer than before and the Redshift cluster's WLM queue is often full. Which action should the engineer take to resolve the failure?

Accepted Answer

Modify the Redshift WLM configuration to increase concurrency or add a new queue for the Glue job.. The failure is caused by Redshift's workload management (WLM) queue being full, which leads to connection timeouts and resets when the AWS Glue job attempts to write data. Adjusting the WLM configuration to increase concurrency or create a dedicated queue for the Glue job reduces wait times and prevents the connection resets. This directly addresses the root cause without unnecessary changes to the Glue job or architecture.

Answer

Configure the Glue job to use the Redshift JDBC driver with a longer connection timeout and retry logic.

Answer

Increase the number of AWS Glue DPUs allocated to the job to speed up processing.

Answer

Switch the Glue job to write to Amazon S3 first, then use a Redshift COPY command to load the data.

Question 11

A data engineer is building an AWS Glue ETL job that reads from an Amazon S3 bucket containing nested JSON files. The job must flatten the nested structure and write the output to Amazon Redshift. The engineer notices that some JSON records have missing fields and inconsistent schemas. Which AWS Glue feature should be used to handle these inconsistencies and ensure the job does not fail?

Accepted Answer

Use a Glue DynamicFrame with the resolveChoice transform to handle schema inconsistencies.. AWS Glue DynamicFrames are specifically built to handle semi-structured data with evolving schemas. The resolveChoice transform lets you resolve ambiguous or conflicting schema types, such as choosing a specific data type or dropping nulls. This ensures the ETL job can process nested JSON with missing fields without failing, making it the correct choice for this scenario.

Answer

Use a Glue DataFrame with a predefined schema and set the job to ignore malformed records.

Answer

Use Amazon Kinesis Data Firehose to transform the JSON before the Glue job reads it.

Answer

Use AWS Glue crawlers to infer the schema and then manually edit the Data Catalog table to add missing columns.

Question 12

A data engineer notices that an AWS Glue ETL job is failing with an OutOfMemory error when processing a large dataset. The job uses a Standard worker type. Which action is MOST effective to resolve this issue without changing the job script?

Accepted Answer

Change to G.2X worker type. The most effective action is to switch to the G.2X worker type (Option C). AWS Glue worker types determine the vCPU, memory, and disk allocated per worker. Standard and G.1X both provide 4 vCPU and 16 GB memory per worker (1 DPU); G.1X does not increase memory over Standard, only disk. G.2X doubles resources to 8 vCPU and 32 GB memory (2 DPU), directly resolving the OutOfMemory error without changing the script. Option A increases the number of workers but not per-worker memory. Option B (G.1X) does not increase memory, so it is not effective. Option D is invalid because DPUs per worker is not a configurable parameter; it is defined by the worker type.

Answer

Increase the number of workers

Answer

Switch to G.1X worker type

Answer

Increase the number of DPUs per worker

Question 13

A data engineer is using AWS Step Functions to orchestrate a daily ETL pipeline that includes an AWS Glue job, an Amazon EMR step, and an Amazon Redshift stored procedure. The pipeline occasionally fails with the error 'States.TaskFailed' from the Glue job, but the Glue job's own logs show that it completed successfully. The Step Functions execution history shows that the Glue job task timed out after 15 minutes, while the Glue job actually ran for 18 minutes. The Step Functions state machine uses the optimized Glue service integration with a TaskTimeout of 900 seconds. Which change will allow the pipeline to complete successfully without reducing the Glue job's runtime?

Accepted Answer

Increase the Step Functions TaskTimeout to a value greater than the Glue job's maximum expected runtime, such as 3600 seconds.. The Step Functions task failed because its TaskTimeout was shorter than the Glue job's actual runtime. The optimized Glue service integration waits for the job to complete, but if the task exceeds the TaskTimeout, Step Functions marks it as failed even though the Glue job continues. Setting the TaskTimeout to a value greater than the job's maximum expected runtime ensures the state machine waits for the job to finish successfully.

Answer

Change the Step Functions integration from the optimized Glue service integration to the AWS SDK integration with a longer timeout.

Answer

Add a Retry policy with a maximum of 3 attempts and an interval of 60 seconds to the Glue job task.

Answer

Reduce the Glue job's runtime by increasing the number of DPUs so it finishes within 15 minutes.

Question 14

A company is using AWS Glue ETL to transform and load data from Amazon S3 to Amazon Redshift. The data engineer notices that the job is taking longer than expected. Which TWO actions can improve the job performance?

Accepted Answer

Partition the source data in S3.. Options B and C are correct because partitioning the source data in S3 reduces the amount of data scanned by Glue, improving I/O efficiency, and increasing the number of DPUs adds more parallelism for transformations. Option A is incorrect because Redshift Spectrum is for querying data in S3 directly from Redshift, not for Glue ETL jobs. Option D is incorrect because S3 Transfer Acceleration speeds up uploads to S3 but does not affect Glue job performance during ETL processing. Option E is incorrect because larger Redshift node types do not impact Glue job execution; they only affect Redshift query performance.

Answer

Use Amazon Redshift Spectrum to query data directly.

Answer

Enable S3 Transfer Acceleration.

Answer

Use a larger Redshift node type.

Question 15

A data engineer is troubleshooting an AWS Glue ETL job that suddenly started failing with 'An error occurred while calling o103.pyWriteDynamicFrame. Unknown error'. The job writes data to an Amazon Redshift table. Which step should the engineer take FIRST?

Accepted Answer

Review the job's CloudWatch Logs for detailed error messages.. The error message 'An error occurred while calling o103.pyWriteDynamicFrame. Unknown error' is a generic wrapper thrown by the Glue DynamicFrame writer when the underlying cause is not surfaced. The first and most reliable step is to inspect the job's CloudWatch Logs, where the full stack trace, Redshift error code, and driver-level messages are recorded. This aligns with standard AWS troubleshooting guidance: always check logs before making changes. Reviewing logs is non-destructive, fast, and directly reveals the root cause (e.g., permission issue, connection timeout, schema mismatch).

Answer

Recreate the Redshift table with a different distribution style.

Answer

Test the job with a small sample dataset to isolate the issue.

Answer

Update the Redshift JDBC driver version in the Glue job.