DEA-C01 Practice Test 46 — 15 Questions

Question 1

A data engineer is troubleshooting an AWS Glue ETL job that fails with a 'java.lang.OutOfMemoryError: Java heap space' error. The job processes a 50 GB Parquet file from an S3 bucket. The job uses a G.1X DPU (16 GB memory) and default parameters. Which action should the engineer take to resolve the issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Change the worker type to G.2X (32 GB memory).. Changing the worker type to G.2X (32 GB memory) doubles the memory per worker, directly addressing the Java heap space error. Option B is incorrect because increasing the number of workers does not increase memory per worker; each G.1X DPU still has only 16 GB. Option C is incorrect because increasing the batch size would increase the amount of data loaded into memory per worker, potentially worsening the memory issue. Option D is incorrect because converting from Parquet to JSON typically increases file size and memory usage due to lack of compression and columnar storage.

Answer

Increase the number of workers from 2 to 4.

Answer

Increase the 'batch size' parameter in the DynamicFrame reader.

Answer

Convert the input data from Parquet to JSON format.

Question 2

A data engineer maintains an Amazon Redshift cluster where a nightly COPY job loads data into a large fact table. After the load, analysts run queries that filter on a `sale_date` column and join to a small dimension table. Query performance degrades over time as the fact table grows. The engineer wants to improve performance for these recurring queries without changing the query text. Which combination of actions should the engineer take?

Accepted Answer

Apply a compound sort key on `sale_date` and enable automatic vacuum and analyze, then distribute the dimension table as ALL.. The recurring workload filters on `sale_date` and joins to a small dimension. A compound sort key on the filter column enables zone-map block skipping, while an ALL distribution on the small dimension removes network redistribution during joins. Automatic vacuum and analyze keep the physical layout and statistics healthy as nightly loads accumulate, so the planner keeps producing efficient plans without query changes.

Answer

Enable concurrency scaling on the cluster and increase the number of slices per node.

Answer

Add an interleaved sort key on every column of the fact table and distribute the dimension table as EVEN.

Answer

Convert the fact table to a view over the raw staging table and rely on Redshift Spectrum for all reads.

Question 3

A data engineer maintains an Amazon Kinesis Data Firehose delivery stream that writes JSON records to Amazon S3 and then invokes an AWS Lambda function for transformation. The Lambda function occasionally times out, causing records to be delivered untransformed. The engineer must ensure failed records are captured for later reprocessing without blocking delivery. What should the engineer do?

Accepted Answer

Enable the Kinesis Data Firehose data transformation failure option to send failed records to a separate S3 bucket for later reprocessing.. Kinesis Data Firehose transformation supports a failure destination for records that the Lambda function cannot process. Enabling it sends failed records to a separate S3 bucket for later reprocessing while successful records continue to the primary destination. The other options either mask timeouts, change the destination without capturing failures, or use a dead-letter queue mechanism that does not apply to synchronous Firehose invocations.

Answer

Increase the Lambda function's timeout to 15 minutes and memory to 10 GB so transformations always complete.

Answer

Configure the delivery stream to use Amazon Redshift as the destination and enable S3 backup for all records.

Answer

Attach a dead-letter queue to the Lambda function and configure Kinesis Data Firehose to read from that queue.

Question 4

A company stores regulated records in an Amazon S3 bucket and must prove that individual objects cannot be deleted or overwritten for 365 days after creation, even by the account root user. The compliance team also needs to retain the ability to delete the bucket itself after the retention window expires. Which configuration meets these requirements?

Accepted Answer

Enable S3 Versioning and apply an S3 Object Lock default retention rule in compliance mode with a 365-day period.. S3 Object Lock in compliance mode provides write-once-read-many protection that no principal, including the root user, can override before the retention date. A default retention rule applies the period automatically to newly created object versions. Since the lock applies to object versions, the bucket itself can still be deleted after retention lapses and versions are removed.

Answer

Enable S3 Object Lock in governance mode with a 365-day retention period and grant s3:BypassGovernanceRetention to the security team.

Answer

Apply a bucket policy that denies s3:DeleteObject and s3:PutObject to all principals for 365 days using a date condition.

Answer

Enable S3 Versioning and add a lifecycle rule that transitions objects to S3 Glacier Deep Archive after 365 days.

Question 5

A data engineer is optimizing an AWS Glue ETL job that processes large Parquet files in Amazon S3. The job currently takes several hours to complete. The engineer wants to improve performance by tuning the job's execution parameters. Which TWO actions will MOST effectively reduce the job's runtime? (Choose two.)

Accepted Answer

Partition the input data in Amazon S3 and use predicate pushdown in the Glue job.. To reduce the runtime of a Glue ETL job processing large Parquet files, increasing DPUs provides more compute resources for parallel processing, and partitioning the input data with predicate pushdown reduces the amount of data read. These two actions directly address performance bottlenecks. Job bookmarks, DynamicFrames, and timeout adjustments do not effectively reduce runtime for a single large job run.

Answer

Use the Glue DynamicFrame instead of Spark DataFrame for all transformations.

Answer

Increase the Glue job's timeout value to allow more time for completion.

Answer

Enable job bookmarks to track processed data.

Question 6

A data engineer is using Amazon Athena to query data stored in Amazon S3 in Parquet format. The engineer notices that a specific query is scanning much more data than expected, resulting in high costs and slow performance. The query filters on a column named 'event_date' which is a string in 'YYYY-MM-DD' format. The table is partitioned by 'year', 'month', and 'day' as separate string columns. The engineer wants to reduce the amount of data scanned. Which action should the engineer take?

Accepted Answer

Use the partition columns 'year', 'month', and 'day' in the WHERE clause instead of 'event_date'.. The table is partitioned by year, month, and day, so filtering on those partition columns in the WHERE clause enables Athena's partition pruning. This limits the data scanned to only the relevant partitions, significantly reducing cost and improving performance. Filtering on a non-partition column like event_date does not provide the same benefit.

Answer

Compress the Parquet files using Snappy compression.

Answer

Enable Amazon Athena query result reuse to cache the results.

Answer

Convert the 'event_date' column to a date type and use it in the WHERE clause.

Question 7

A data engineer manages an AWS Lake Formation governed data lake. Analysts in the finance department must query only the rows in a shared Amazon S3 table where the region column equals 'EMEA', while analysts in the marketing department must see all rows but must not see the customer_email column. Which TWO Lake Formation configurations should the data engineer implement to meet these requirements? (Choose two.)

Accepted Answer

Create a data filter on the table that excludes the customer_email column and grant SELECT on the table with that data filter to the marketing analyst role.. Lake Formation data filters are the native mechanism for row-level and column-level security. A data filter with a row expression scopes which rows a principal can read, and a data filter with an included column list scopes which columns are visible. Granting SELECT with the appropriate data filter to each analyst role enforces both requirements across integrated engines without copying or duplicating the underlying S3 objects.

Answer

Define an AWS Glue Data Catalog table property named column.filter with the value customer_email and a table property row.filter with the value region='EMEA', then grant DESCRIBE to both roles.

Answer

Register the S3 location with Lake Formation in hybrid access mode and grant the analysts ALL permissions so that IAM policies alone control row and column visibility.

Answer

Attach an IAM policy to the finance analyst role that denies s3:GetObject on any S3 prefix whose object metadata does not contain a region tag of EMEA.

Question 8

A company is ingesting real-time financial transactions into Amazon Kinesis Data Streams. The data is then consumed by a Kinesis Data Analytics for Apache Flink application that calculates running totals. The application is experiencing high latency and checkpoint failures. Which TWO steps should the engineer take to improve performance and reliability? (Select TWO.)

Accepted Answer

Increase the number of shards in the Kinesis data stream.. Option C is correct because increasing the number of shards in the Kinesis data stream raises the stream's read throughput capacity (each shard supports up to 2 MB/sec read and 1 MB/sec write, or 1,000 records/sec), which relieves the ingestion bottleneck that causes high latency in the Flink application. Option D is correct because increasing KPUs adds parallel processing resources (each KPU provides 1 vCPU and 4 GB memory) to the Kinesis Data Analytics for Apache Flink application, allowing it to consume and process records faster and complete checkpoints more reliably. Option A is not correct because enhanced fan-out is a Kinesis Data Streams consumer feature that gives dedicated 2 MB/sec read throughput per consumer via HTTP/2, but it does not address the Flink application's internal processing or checkpointing bottlenecks. Option B is not correct because reducing the batch size per checkpoint does not improve throughput and can actually increase checkpoint overhead and latency. Option E is not correct because decreasing the checkpoint interval makes checkpoints more frequent, increasing overhead and state I/O rather than reducing state size or improving reliability.

Answer

Enable enhanced fan-out for the Flink application.

Answer

Reduce the batch size of records processed per checkpoint.

Answer

Decrease the checkpoint interval to reduce state size.

Question 9

A data engineer is building a streaming pipeline using Amazon Kinesis Data Streams and AWS Lambda. The Lambda function processes records and writes to Amazon DynamoDB. The engineer notices that the Lambda function is throttled during high traffic. Which action should the engineer take to reduce throttling?

Accepted Answer

Increase the number of shards in the Kinesis data stream. Increasing the number of shards in the Kinesis data stream increases the overall throughput of the stream, which allows the Lambda event source mapping to poll more shards concurrently. Each shard is processed by one Lambda invocation at a time, so more shards mean more concurrent Lambda executions, reducing the per-invocation load and the likelihood of throttling.

Answer

Increase the Lambda function timeout

Answer

Disable retries on the Lambda function

Answer

Use an Amazon SQS queue as an intermediate buffer

Question 10

A data engineer is building an AWS Glue Data Catalog table that references an Amazon S3 bucket containing CSV files. The security team requires that column-level access be restricted so that only specific IAM principals can view the column containing personally identifiable information (PII). The engineer needs to implement this restriction without modifying the underlying data. Which combination of actions should the engineer take?

Accepted Answer

Use AWS Lake Formation to define column-level permissions on the table and grant access to the specific IAM principals.. AWS Lake Formation is designed for fine-grained access control on Data Catalog tables, including column-level permissions. It allows granting or denying access to specific columns for specific IAM principals without changing the data. IAM policies, S3 bucket policies, and Glue transforms operate at different levels and cannot achieve column-level restriction on the existing table.

Answer

Create an IAM policy that denies access to the S3 prefix containing the PII column.

Answer

Use AWS Glue Studio to create a transform that masks the PII column and write a new table.

Answer

Apply an S3 bucket policy that restricts access to objects based on object tags.

Question 11

A data engineer is designing a data lake on Amazon S3. The data includes customer PII that must be encrypted at rest. The company also requires that the encryption keys be rotated automatically every year. Which encryption solution should the engineer use?

Accepted Answer

SSE-KMS with automatic key rotation enabled. SSE-KMS with automatic key rotation enabled meets both requirements: it encrypts data at rest in S3 and allows the company to automatically rotate the customer master key (CMK) every year. AWS KMS supports automatic annual rotation for symmetric CMKs, which satisfies the compliance need without manual intervention.

Answer

SSE-S3

Answer

SSE-C

Answer

Client-side encryption with AWS KMS

Question 12

A data engineer is configuring an AWS Glue ETL job that reads from an Amazon S3 bucket containing sensitive customer records. The security team requires that the job's data be encrypted at rest using a customer managed AWS KMS key, and that the key policy restrict usage to the specific IAM role used by the Glue job. The engineer has already created the KMS key and attached the necessary IAM policy to the Glue job role. What additional step is required to ensure the Glue job can decrypt the S3 data using the customer managed key?

Accepted Answer

Add a KMS key policy statement granting kms:Decrypt and kms:GenerateDataKey permissions to the Glue job's IAM role.. A customer managed KMS key requires that both the IAM policy of the calling principal and the KMS key policy grant the necessary permissions. The IAM policy alone is insufficient; the key policy must explicitly allow the Glue job's IAM role to use the key for decryption and data key generation. Without this key policy statement, the Glue job cannot decrypt the S3 objects.

Answer

Configure the S3 bucket to use SSE-S3 instead of SSE-KMS, because Glue cannot use customer managed keys.

Answer

Enable AWS CloudTrail logging for the KMS key to allow Glue to decrypt the data.

Answer

Attach an S3 bucket policy that grants the Glue job role s3:GetObject and s3:PutObject permissions.

Question 13

A data engineer is using Amazon Athena to query data stored in Amazon S3. The engineer notices that queries are returning incorrect results, specifically missing some rows that are known to exist in the underlying data. The data is stored in Parquet format and is partitioned by date. The engineer runs a query with a WHERE clause on the date partition and finds that some dates are missing from the results. The S3 bucket contains folders for each date, but some folders are empty. What is the MOST likely cause of the missing rows?

Accepted Answer

The empty folders in S3 indicate that the data for those dates was never written or was deleted, so Athena correctly returns no rows for those dates.. The missing rows correspond to dates for which the S3 folders are empty. Athena queries data directly from S3, so if there are no files in a partition folder, no rows will be returned for that partition. This is not an Athena misconfiguration; it is a data availability issue. The engineer should check the upstream processes that write data to those partitions.

Answer

Athena is using a stale metadata cache and needs to be refreshed.

Answer

The Parquet files are corrupted, causing Athena to skip them.

Answer

The Athena table is not configured with the correct partition projection settings.

Question 14

A data engineer is designing a data lake on Amazon S3 that contains personally identifiable information (PII). The compliance team requires that all access to the data be logged and that any attempt to delete or modify data be detected and alerted. The engineer enables AWS CloudTrail data events for the S3 bucket and configures Amazon CloudWatch alarms. Which additional AWS service should the engineer use to automatically detect and remediate unauthorized changes to the S3 bucket's ACLs or policies?

Accepted Answer

AWS Config with managed rules and automatic remediation.. AWS Config is designed to assess, audit, and evaluate configurations of AWS resources. With managed rules for S3, it can detect changes to ACLs and policies, and trigger automatic remediation via SSM Automation. Other services like Macie, Trusted Advisor, and GuardDuty focus on data classification, recommendations, or threat detection, not configuration compliance and remediation.

Answer

AWS Trusted Advisor with S3 bucket permissions checks.

Answer

Amazon Macie with custom data identifiers.

Answer

Amazon GuardDuty with S3 protection.

Question 15

A healthcare company stores patient records in an Amazon S3 bucket encrypted with SSE-KMS using a customer managed key. A new AWS Glue ETL job must read these records and write transformed data to another S3 bucket that is also encrypted with the same KMS key. The company's security policy requires that the Glue job's access to the KMS key be least-privilege and auditable. Which TWO actions should the data engineer take to meet these requirements? (Choose two.)

Accepted Answer

Attach a key policy to the KMS key that allows the AWS Glue service role to use the key for decrypt and generateDataKey operations, scoped to the specific S3 buckets via encryption context conditions.. Access to SSE-KMS encrypted S3 objects requires permissions in both the KMS key policy and the IAM identity policy of the calling principal. The Glue service role must be granted only the necessary KMS operations (Decrypt and GenerateDataKey) on the specific key, with conditions to scope usage. This combination enforces least privilege and provides an auditable trail. Broad permissions or unrelated services do not meet the security policy.

Answer

Enable S3 Block Public Access on both S3 buckets and enable default encryption with SSE-S3 to simplify key management.

Answer

Grant the Glue service role kms:* permissions on all KMS keys in the account to ensure the job can read and write data without interruption.

Answer

Use AWS Lake Formation to grant the Glue job fine-grained access to the underlying S3 data and rely on Lake Formation to manage KMS permissions automatically.