DEA-C01 Practice Test 45 — 15 Questions

Question 1

Refer to the exhibit. A data engineer is troubleshooting an AWS Lambda function that reads from an S3 bucket and writes to a Kinesis Data Stream. The Lambda function fails with an AccessDeniedException when calling the kinesis:PutRecords API. Which change is needed to the IAM policy?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Change the resource ARN for Kinesis to include the correct stream name. The Lambda function's IAM policy grants kinesis:PutRecords permission but the resource ARN does not match the target Kinesis Data Stream. The AccessDeniedException occurs because IAM evaluates the resource ARN against the stream's ARN and denies access on mismatch. The correct fix is to change the resource ARN to include the correct stream name (option C). While using a wildcard (option B) would also resolve the error, it is not the recommended approach because it violates the principle of least privilege. Option A is incorrect because the error is from Kinesis, not S3. Option D is incorrect because the kinesis:PutRecords action is already present in the policy.

Answer

Add s3:PutObject permission to the policy

Answer

Change the resource ARN for Kinesis to a wildcard

Answer

Add kinesis:PutRecords permission to the policy

Question 2

A data engineer needs to share a dataset stored in an S3 bucket with a partner AWS account. The partner should be able to read the data without needing to authenticate with the engineer's account. The engineer must not share any secret keys. Which approach should be used?

Accepted Answer

Write a bucket policy that grants access to the partner account's IAM role.. S3 bucket policies can grant cross-account access to a specific IAM role in the partner account, allowing the partner to read data without authentication or shared secrets. Option B is wrong because presigned URLs are temporary and require ongoing generation for each access, not a persistent solution. Option C is wrong because making the bucket public violates security principles and exposes data to everyone. Option D is wrong because sharing access keys is insecure and against best practices; keys should never be shared.

Answer

Generate presigned URLs and share them with the partner.

Answer

Make the bucket publicly readable.

Answer

Create an IAM user with access keys and share them with the partner.

Question 3

A company is building a data lake on AWS and must encrypt data at rest. Which services can provide server-side encryption for data stored in Amazon S3? (Choose TWO.)

Accepted Answer

SSE-S3. SSE-S3 (Option A) and SSE-KMS (Option E) are the two server-side encryption options for Amazon S3. SSE-S3 uses Amazon-managed keys, while SSE-KMS uses AWS KMS-managed keys. Option B (SSL/TLS) is encryption in transit, not at rest. Option C (AWS SDK client-side encryption) encrypts data before it reaches S3, so it is client-side, not server-side. Option D (AWS CloudHSM) is a hardware security module for managing keys, but it is not a direct server-side encryption option for S3; S3 does not natively integrate with CloudHSM for SSE.

Answer

SSL/TLS

Answer

AWS SDK client-side encryption

Answer

AWS CloudHSM

Question 4

A company is using Amazon S3 to store log files. The security team requires that all data be encrypted in transit. Which of the following ensures encryption in transit for S3?

Accepted Answer

Use HTTPS (SSL/TLS) when accessing S3 endpoints.. Encryption in transit for S3 is achieved by using HTTPS (SSL/TLS) when accessing S3 endpoints (option A). Option B (Transfer Acceleration) speeds up uploads but does not provide encryption in transit by itself. Option C (client-side encryption) protects data at rest and during transit only if combined with HTTPS. Option D (SSE-S3) is at-rest encryption. Therefore, the correct answer is A.

Answer

Use Amazon S3 Transfer Acceleration.

Answer

Enable client-side encryption before uploading to S3.

Answer

Use server-side encryption with S3 managed keys (SSE-S3).

Question 5

A data engineer needs to ensure that an Amazon Redshift cluster encrypts data at rest using a customer-managed AWS KMS key. Which configuration step is required?

Accepted Answer

Create a new cluster and specify a customer-managed KMS key for encryption.. To use a customer-managed KMS key for encryption at rest in Amazon Redshift, you must specify the key when creating a new cluster. Encryption cannot be enabled on an existing cluster (option D is incorrect). Option A is incorrect because the default AWS managed key is not customer-managed. Option C is incorrect because AWS CloudHSM is not used for Redshift encryption; Redshift integrates directly with AWS KMS for key management.

Answer

Create a new cluster and select the default AWS managed key for encryption.

Answer

Use AWS CloudHSM to generate a key and attach it to the cluster.

Answer

Enable encryption on the existing cluster by modifying the cluster configuration.

Question 6

Refer to the exhibit. A data engineer is troubleshooting an IAM policy attached to a user who cannot list objects in the S3 bucket 'example-bucket'. What is the most likely reason?

Accepted Answer

The bucket policy explicitly denies access to the user.. The IAM policy shown in the exhibit grants s3:ListBucket on the bucket and s3:GetObject on objects, which should allow listing. However, if the user still cannot list objects, the most likely reason is that a bucket policy explicitly denies access to that user. Bucket policies are evaluated separately from IAM policies, and an explicit deny in a bucket policy overrides any allow. Options B, C, and D are incorrect because the IAM policy in the exhibit includes the correct resource ARN (arn:aws:s3:::example-bucket for the bucket and arn:aws:s3:::example-bucket/* for objects), includes s3:ListBucket action, and does not require s3:GetObject for listing.

Answer

The resource ARN for the bucket is incorrect; it should be 'arn:aws:s3:::example-bucket/*'.

Answer

The policy includes s3:GetObject but not s3:ListObjects.

Answer

The policy does not include the s3:ListBucket action.

Question 7

A data engineer is investigating why Amazon Athena queries on the 'my-data-lake' bucket are slow. The table is partitioned by year/month/day. The exhibit shows the objects in one partition. What is the MOST likely cause of poor query performance?

Accepted Answer

The files are too small, causing excessive read overhead. The exhibit shows tiny files (50 bytes), which cause excessive metadata overhead and read operations in Athena, leading to poor query performance. Option B (compression) is not indicated as the primary issue. Option C (partition columns) is likely appropriate given the partition structure. Option D (CSV format) is not necessarily the cause; while Parquet may improve performance, the main issue here is the file size, not the format.

Answer

The files are not compressed

Answer

The partition columns are not appropriately chosen

Answer

The data format is CSV instead of Parquet

Question 8

A company uses Amazon Kinesis Data Firehose to deliver streaming data to Amazon S3. The delivery stream is failing with 'Insufficient capacity' errors. Which THREE actions should the data engineer take to resolve this issue? (Choose THREE.)

Accepted Answer

Increase the buffer size and buffer interval in the Firehose delivery stream configuration.. Options B, D, and E are correct. B: Increasing buffer size and interval allows Firehose to batch more records before delivery, reducing the rate of PUT requests and alleviating temporary capacity issues. D: Requesting a service quota increase for Kinesis Data Firehose raises the default limits on data delivery throughput, directly addressing insufficient capacity errors caused by throttling. E: Increasing the number of shards in the source Kinesis data stream provides higher write throughput to Firehose, reducing backpressure and 'Insufficient capacity' errors. Option A is incorrect because S3 bucket versioning handles object versioning, not write capacity or Firehose throughput. Option C is incorrect because CloudWatch alarms only monitor and alert, they do not resolve capacity issues.

Answer

Enable S3 bucket versioning to handle concurrent writes.

Answer

Configure a CloudWatch alarm to monitor the error rate.

Question 9

A company uses Amazon Kinesis Data Firehose to deliver streaming data to Amazon S3. The data is in JSON format, and each record is approximately 5 KB. The company has set the buffer interval to 60 seconds and the buffer size to 5 MB. However, the data engineer observes that the delivery to S3 is delayed by up to 5 minutes during peak traffic. The engineer wants to reduce the delivery latency to under 1 minute. Which TWO actions should the engineer take? (Choose TWO.)

Accepted Answer

Reduce the buffer size to 1 MB.. Reducing the buffer size to 1 MB triggers delivery sooner once the smaller size threshold is met, reducing latency. Option E is correct because reducing the buffer interval to 10 seconds forces Firehose to deliver data more frequently, also reducing latency. Option A is wrong because GZIP compression reduces data volume but does not directly reduce delivery latency; it may even add processing time. Option C is wrong because increasing the buffer size would make it take longer to fill, increasing latency. Option D is wrong because converting to Parquet requires additional processing and does not directly reduce latency; it may increase it.

Answer

Enable GZIP compression for the delivery stream.

Answer

Increase the buffer size to 50 MB.

Answer

Convert the data format to Apache Parquet before delivery.

Question 10

A data engineer is troubleshooting a DMS task that is replicating data from an on-premises Oracle database to an RDS for MySQL instance. The task is failing with 'ORA-1555: snapshot too old' error. What is the best course of action?

Accepted Answer

Increase the UNDO tablespace size and set UNDO_RETENTION to a higher value.. The ORA-1555 'snapshot too old' error occurs when a long-running query (such as Change Data Capture (CDC) in AWS DMS) needs to read consistent data from undo segments, but the undo information has been overwritten or retained for too short a period. Increasing the UNDO tablespace size and setting UNDO_RETENTION to a higher value ensures that undo data is preserved longer, allowing CDC to read consistent snapshots without encountering this error. Option A (disabling supplemental logging) would prevent CDC from capturing changes, thus is incorrect. Option B (increasing redo logs) does not address the undo retention issue. Option C (enabling batch optimized apply) may improve apply performance but does not resolve the source-side undo problem.

Answer

Disable full supplemental logging on the source tables.

Answer

Increase the size of the redo logs on the source database.

Answer

Enable batch optimized apply on the DMS task.

Question 11

A data engineer is setting up a new Amazon Redshift cluster for a data warehouse. The engineer wants to ensure data durability and high availability. Which THREE features should the engineer consider? (Choose three.)

Accepted Answer

Cross-Region snapshot copy.. Options B, C, and E are correct. B: Cross-Region snapshot copy allows copying snapshots to another AWS Region, protecting against regional disasters. C: Multi-node clusters with data replication within the cluster provide high availability by distributing data across nodes and automatically mirroring data. E: Automated snapshots to Amazon S3 enable point-in-time recovery for durability. Option A is incorrect because S3 Cross-Region Replication applies to S3, not directly to Redshift data. Option D is incorrect because Redshift does not support Multi-AZ deployments; it relies on automatic failover within the cluster using multiple nodes.

Answer

S3 Cross-Region Replication for Redshift data.

Answer

Multi-AZ deployment for automatic failover.

Question 12

A company runs a data ingestion pipeline that uses AWS Glue to read 500 GB of JSON files from an S3 bucket (s3://raw-data/) every hour. The Glue ETL job transforms the data and writes Parquet files to another S3 bucket (s3://processed-data/). The job is triggered by a time-based CloudWatch Events rule. Recently, the job has started taking over 2 hours to complete, causing delays in downstream processes. The data volume has been consistent, and no changes have been made to the job code or infrastructure. The S3 bucket 's3://raw-data/' receives new files continuously, but the Glue job reads all files in the bucket each run (no incremental processing). The engineer suspects that the job is reprocessing old data. Which action should the engineer take FIRST to reduce the job duration?

Accepted Answer

Enable Glue job bookmarking and configure the job to process only new data.. Enabling job bookmarking in Glue allows the job to process only new files since the last run, dramatically reducing processing time. Option D (increasing DPUs) would help with resource constraints but does not address the root cause of reprocessing old data. Option B (increasing parallelism) may help but not as much as eliminating reprocessing. Option C (using partition pruning) assumes the data is partitioned, but the stem says all files are read; partitioning might not help if files are not organized by time. The most impactful first step is to enable bookmarking.

Answer

Increase the parallelism of the Spark job by repartitioning the data.

Answer

Add partition pruning by modifying the S3 path to include date-based partitions.

Answer

Increase the number of DPUs for the Glue job to 100.

Question 13

A startup is ingesting event data from a mobile app into an Amazon Kinesis Data Streams stream with 2 shards. Each shard can ingest up to 1 MB/s or 1000 records/s. The app sends about 800 records per second with an average record size of 1.5 KB. The data engineer notices that the stream is throttling some records, resulting in data loss. The engineer needs to ensure that all records are ingested without changing the application code. What should the data engineer do?

Accepted Answer

Increase the number of shards in the Kinesis stream to 3.. The current throughput is 800 records/s * 1.5 KB = 1.2 MB/s, which exceeds the per-shard limit of 1 MB/s. Adding a third shard increases the total write capacity to 3 MB/s, accommodating the current traffic. Option A is incorrect because reducing record size would require modifying the application code. Option B is incorrect because Kinesis Data Firehose is not designed for real-time ingestion and does not address the shard capacity issue. Option D is incorrect because enhanced fan-out improves consumer read throughput, not producer write throughput.

Answer

Reduce the average record size to below 1 KB by compressing data on the client side.

Answer

Switch from Kinesis Data Streams to Kinesis Data Firehose for ingestion.

Answer

Enable enhanced fan-out on the stream to provide dedicated throughput to each consumer.

Question 14

A company runs a data pipeline that ingests user activity logs from an API gateway into an Amazon Kinesis Data Firehose delivery stream. The Firehose stream writes data to an S3 bucket. The data is then processed by a scheduled AWS Glue job that runs every hour. Recently, the company noticed that the data in S3 is incomplete: some logs from the API are missing. The Glue job processes all files in the S3 bucket. The Firehose stream has a buffer size of 5 MB and a buffer interval of 60 seconds. The API sends data at a rate of approximately 2 MB per minute. What should the company do to reduce data loss?

Accepted Answer

Configure a Dead Letter Queue (DLQ) for the Firehose stream.. Configuring a Dead Letter Queue (DLQ) for the Kinesis Data Firehose delivery stream allows failed records to be captured and stored for later analysis and reprocessing. While Firehose automatically retries delivery, persistent failures can lead to data loss. A DLQ (or error backup destination) ensures that records that cannot be delivered are preserved. Option A: Decreasing the buffer interval from 60 to 30 seconds would cause more frequent deliveries, increasing the likelihood of transient failures affecting smaller batches and not reducing overall data loss. Option B: Increasing the buffer size to 10 MB does not prevent data loss; it only changes the threshold for flushing data. Since the data rate is 2 MB/min, the buffer size is rarely the trigger (interval is more likely). Option D: Enabling data transformation with AWS Lambda to compress data reduces the size of records but does not address delivery failures; it could even introduce additional failure points from the Lambda function. Thus, only C directly addresses data loss by capturing failed records.

Answer

Decrease the buffer interval to 30 seconds.

Answer

Increase the Firehose buffer size to 10 MB.

Answer

Enable data transformation with AWS Lambda to compress data.

Question 15

A data engineer is troubleshooting a failed AWS Glue ETL job that reads from Amazon S3 and writes to Amazon Redshift. The job fails with the error: 'ERROR: Cannot insert a duplicate key into unique index'. The Redshift table has a primary key on the 'id' column. The data in S3 contains multiple records with the same 'id'. The engineer needs to ensure that only the latest record for each 'id' is loaded into Redshift. The data has a 'timestamp' column. Which approach should the engineer take?

Accepted Answer

Use the 'dropDuplicates' transformation in the Glue ETL script, ordering by 'timestamp' descending to keep the latest record for each 'id'.. Using the AWS Glue 'dropDuplicates' transformation on the 'id' column, ordering by 'timestamp' descending, will remove duplicate 'id' values, keeping the latest record. This is the direct approach within the Glue ETL script. Option B is incorrect because using 'overwrite' mode would replace the entire Redshift table, which would discard existing data and is not a targeted solution for handling duplicates. Option C is incorrect because loading into a staging table and using MERGE requires additional setup and is not directly part of the Glue ETL script, making it less efficient for the stated requirement. Option D is incorrect because disabling primary key constraints only defers the duplicate key error, and it would compromise data integrity rather than properly deduplicating records.

Answer

Set the write mode to 'overwrite' in the Glue job to replace the entire Redshift table.

Answer

Load data into a staging table in Redshift and then use a MERGE operation to insert only new records.

Answer

Disable primary key constraints on the Redshift table before loading.