DEA-C01 Practice Test 48 — 15 Questions

Question 1

A data engineer is using AWS Glue to transform data stored in Amazon S3. The security team requires that data in transit between AWS Glue and Amazon S3 be encrypted. The engineer wants to ensure that all connections use TLS. Which action should the engineer take to enforce encryption in transit for AWS Glue jobs accessing S3?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Attach a bucket policy to the S3 bucket that denies requests where aws:SecureTransport is false.. Enforcing encryption in transit for S3 is done by adding a bucket policy that denies requests when aws:SecureTransport is false. This ensures that all clients, including AWS Glue, must use HTTPS/TLS when accessing the bucket. Other options either address encryption at rest or do not enforce TLS.

Answer

Enable SSL/TLS for the Glue connection and set the require_ssl parameter to true in the JDBC URL.

Answer

Configure the Glue job to use a VPC endpoint for S3 and enable encryption on the endpoint.

Answer

Set the Glue job parameter --encryption-mode to SSE-S3.

Question 2

A data engineer is configuring an AWS Lake Formation permissions model for a data lake in Amazon S3. Analysts must query a table through Amazon Athena and see only rows where the 'region' column equals 'EU'. The engineer has already registered the S3 location with Lake Formation and created the table in the AWS Glue Data Catalog. Which action should the engineer take to enforce the row-level restriction?

Accepted Answer

Create a Lake Formation data filter that includes the expression region='EU' and grant SELECT on the table with that data filter to the analysts' IAM role.. Lake Formation data filters are the correct mechanism for row-level security. By creating a data filter with the expression region='EU' and granting SELECT with that filter, the analyst's queries through Athena automatically receive the filter condition. This enforcement happens at the Lake Formation permission layer, so it applies consistently regardless of how the query is written, and the underlying data remains unchanged.

Answer

Create an IAM policy that allows Athena StartQueryExecution only when the query string contains region='EU'.

Answer

Create an S3 bucket policy that denies GetObject for objects whose keys do not start with 'EU/'.

Answer

Create a separate Athena workgroup for the analysts and configure the workgroup to append a WHERE clause to every query.

Question 3

A data engineer manages an Amazon S3 data lake that ingests millions of small JSON files daily from an IoT fleet. Query performance in Amazon Athena has degraded significantly, and each query scans far more data than expected. The engineer wants to reduce per-query cost and improve performance without changing the raw data. Which solution should the engineer implement?

Accepted Answer

Convert the JSON files to Apache Parquet, partition the data, and compact small files with AWS Glue ETL jobs.. Athena performance and cost are driven by how many bytes a query scans, so converting row-oriented JSON to columnar Parquet, partitioning on common filter columns, and compacting small files directly reduce scanned data. These three changes work together: columnar storage reads only referenced columns, partitions prune entire prefixes, and compaction removes per-object overhead. The result is faster queries at lower cost without altering the source data in S3.

Answer

Move the data into an Amazon Redshift cluster and query it with Redshift Spectrum.

Answer

Increase the Athena workgroup data usage control limit and rerun the queries.

Answer

Enable S3 Transfer Acceleration on the ingestion bucket.

Question 4

A data engineer is responsible for an Amazon Redshift cluster that stores financial data. The security team requires that all connections to the cluster from outside the VPC use SSL, and that the cluster's audit logs capture connection and user activity. The engineer has already enabled audit logging to Amazon S3. Which additional configuration should the engineer apply to meet the SSL requirement?

Accepted Answer

Set the Redshift cluster parameter 'require_ssl' to true in the parameter group associated with the cluster.. The require_ssl parameter in the Redshift parameter group is the correct way to enforce SSL for all connections to the cluster. When set to true, any client that attempts to connect without SSL is rejected. This directly meets the security team's requirement for encrypted connections from outside the VPC and works alongside audit logging, which the engineer has already enabled.

Answer

Attach an IAM policy to the Redshift cluster that denies connections without the 'aws:SecureTransport' condition.

Answer

Create a VPC endpoint for Redshift and require that all clients use the endpoint's private IP address.

Answer

Enable Redshift Spectrum and configure it to use SSL for all external table access.

Question 5

A data engineer has set up an AWS Lambda function that processes files uploaded to an S3 bucket. The function is triggered by S3 event notifications. However, the function is not being invoked when a file is uploaded. The engineer checks the Lambda function's CloudWatch Logs and finds no execution logs. What should the engineer check FIRST?

Accepted Answer

Verify that the S3 bucket has an event notification configured for the Lambda function.. The symptom is that the Lambda function is not invoked at all and there are no CloudWatch execution logs — meaning the function never ran. The first thing to verify is whether the S3 bucket actually has an event notification configured to trigger the Lambda function, since without that configuration no invocation occurs. This is the most direct cause of 'no invocation, no logs.'

Answer

Check the Lambda function's code for errors.

Answer

Verify that the Lambda function's IAM role has permissions to read from S3.

Answer

Check if the Lambda function is attached to a VPC.

Question 6

A data engineer is building a data pipeline that ingests sensitive data into Amazon S3 and then processes it with AWS Glue. The security team requires that the data be encrypted at rest using a customer managed key in AWS KMS, and that the engineer be able to audit all key usage. The engineer creates a KMS customer managed key and configures the S3 bucket to use SSE-KMS with that key. The Glue job's IAM role has been granted kms:Decrypt and kms:GenerateDataKey permissions on the key. However, when the Glue job runs, it fails with an access denied error related to KMS. Which additional action should the engineer take to resolve the error?

Accepted Answer

Update the KMS key policy to allow the Glue job's IAM role to use the key for cryptographic operations.. KMS key policies must explicitly allow the principal to use the key for cryptographic operations. Even with IAM permissions granting kms:Decrypt and kms:GenerateDataKey, the key policy is the ultimate gatekeeper. The Glue job's role must be listed in the key policy with the necessary permissions. Updating the key policy resolves the access denied error while adhering to the requirement for customer managed keys and auditable key usage.

Answer

Enable automatic key rotation on the KMS key to ensure the Glue job can retrieve the latest key material.

Answer

Change the S3 bucket encryption to SSE-S3 so that KMS permissions are no longer required.

Answer

Grant the Glue job's IAM role kms:CreateGrant permission on the KMS key.

Question 7

A financial services company stores sensitive transaction data in an Amazon S3 bucket. The security team requires that all data be encrypted at rest using AWS Key Management Service (AWS KMS) customer managed keys, and that the encryption keys be automatically rotated every year. A data engineer needs to configure the S3 bucket to meet these requirements with minimal ongoing operational effort. Which solution should the engineer implement?

Accepted Answer

Enable default encryption on the S3 bucket using SSE-KMS with a customer managed key that has automatic key rotation enabled.. To meet the requirements, the engineer should use server-side encryption with AWS KMS customer managed keys (SSE-KMS) and enable automatic key rotation on the key. This ensures data is encrypted at rest with a key the customer controls, and rotation occurs annually without manual intervention. The bucket default encryption setting ensures all new objects are encrypted automatically.

Answer

Enable default encryption on the S3 bucket using SSE-S3 (AES-256).

Answer

Use S3 client-side encryption with a customer-provided key stored in AWS Secrets Manager, and rotate the key annually using a Lambda function.

Answer

Enable default encryption on the S3 bucket using SSE-KMS with an AWS managed key (aws/s3).

Question 8

A data engineer is building a data lake on Amazon S3 and needs to catalog metadata for a large number of CSV files stored in a folder structure. The engineer wants to use AWS Glue crawlers to automatically infer schemas and create tables in the AWS Glue Data Catalog. The crawler should run daily to detect new files and schema changes. Which configuration should the engineer use for the crawler?

Accepted Answer

Set the crawler's data source to the specific S3 folder containing the CSV files, configure it to create a single schema for each S3 path, and set a daily schedule.. The crawler should be pointed to the specific S3 folder to avoid scanning irrelevant data. Configuring it to create a single schema for each S3 path groups files with the same schema into one table, which is ideal for a data lake with partitioned folders. A daily schedule ensures the catalog stays up to date with new files and schema changes.

Answer

Set the crawler's data source to the specific S3 folder and disable the crawler schedule, running it manually when needed.

Answer

Set the crawler's data source to the specific S3 folder and configure it to create a separate table for each file, with a daily schedule.

Answer

Set the crawler's data source to the S3 bucket root and enable 'Update the table definition in the Data Catalog' with a schedule of daily.

Question 9

A data engineer is building an AWS Glue ETL job that reads from an Amazon S3 bucket and writes to an Amazon Redshift cluster. The security team requires that the data be encrypted in transit between Glue and Redshift. Which configuration should the engineer implement to meet this requirement?

Accepted Answer

Enable SSL in the Redshift connection by setting the sslmode parameter to 'require' in the JDBC URL used by the Glue job.. To encrypt data in transit between AWS Glue and Amazon Redshift, the Glue job must establish an SSL connection to Redshift. This is done by adding sslmode=require to the JDBC URL in the Glue connection. This ensures that the connection uses SSL and rejects non-SSL connections. Other options either address encryption at rest or are not applicable to the scenario.

Answer

Use AWS Glue's built-in encryption feature by setting the --encryption-type parameter to 'ssl' in the job configuration.

Answer

Enable encryption on the Redshift cluster by turning on cluster encryption, which automatically encrypts data in transit.

Answer

Configure the Glue job to write to Redshift using the Redshift Spectrum feature, which automatically encrypts data in transit.

Question 10

A company is using AWS Glue to run ETL jobs that transform data from Amazon S3 to Amazon Redshift. The jobs are failing intermittently with 'Out of Memory' errors. The team wants to resolve this issue without increasing costs significantly. Which TWO actions should the team take?

Accepted Answer

Change the worker type from 'G.1x' to 'G.2x' to double memory per worker.. Switching from G.1x to G.2x workers doubles the memory (and vCPU) per worker while keeping the same worker count, which directly addresses OOM conditions in memory-intensive transformations and is a targeted, cost-controlled change rather than scaling out to maximum workers. Option A is not correct because AWS Glue does not provide a 'Spark memory overhead parameter' in the job configuration; memory overhead is not a user-configurable Glue job setting, so this action cannot be taken as described. Option B is not correct because DynamicFrame vs Spark DataFrame is an API choice for schema handling and does not by itself reduce memory pressure enough to fix OOM errors. Option C is not correct because increasing workers to the maximum allowed raises cost significantly and does not fix per-executor memory limits. Option D is not correct because a Python shell job cannot run distributed Spark ETL at the scale needed for S3-to-Redshift transformations and would not resolve Spark executor OOM issues.

Answer

Increase the Spark memory overhead parameter in the Glue job configuration.

Answer

Use DynamicFrame instead of Spark DataFrame for transformations.

Answer

Increase the number of workers to maximum allowed.

Answer

Switch from a Spark job to a Python shell job.

Question 11

A data engineer is using AWS Glue to catalog data stored in Amazon S3. The data is in Apache Parquet format and partitioned by year, month, and day. The engineer notices that AWS Glue crawlers are taking a long time to run and are not correctly identifying new partitions. The engineer needs to improve the crawler performance and ensure new partitions are added automatically. Which action should the engineer take?

Accepted Answer

Use AWS Glue partition projection instead of crawling for partitions.. Partition projection in AWS Glue allows you to specify the partitioning scheme directly in the table properties, so the crawler does not need to discover partitions. This reduces crawler runtime and ensures that new partitions are immediately available for query engines like Athena. It is the most efficient solution for regularly partitioned data.

Answer

Enable the crawler option to update the Data Catalog with new partitions only, and set a partition index.

Answer

Increase the number of data processing units (DPUs) for the crawler.

Answer

Configure the crawler to use a custom classifier for Parquet.

Question 12

A data engineer needs to store JSON documents that are frequently updated and require ACID transactions. Which AWS database service is most appropriate?

Accepted Answer

Amazon DocumentDB. Amazon DocumentDB (with MongoDB compatibility) is the correct choice because it is a fully managed document database designed to store, query, and index JSON-like documents. It supports multi-document ACID transactions, providing atomicity, consistency, isolation, and durability for frequently updated JSON documents. DocumentDB also offers a MongoDB-compatible API, making it a natural fit for JSON document workloads. While Amazon DynamoDB supports ACID transactions via TransactWriteItems and TransactGetItems and can store JSON-like items, it is primarily a key-value and document store with a different data model and is not the AWS service purpose-built for general-purpose JSON document storage with complex querying and multi-document transactions. Amazon Neptune is a graph database, and Amazon S3 is object storage without ACID transactional semantics, so neither is appropriate.

Answer

Amazon Neptune

Answer

Amazon DynamoDB

Answer

Amazon S3

Question 13

A data engineer runs a weekly AWS Glue ETL job that processes data from Amazon DynamoDB to Amazon S3. The job reads the entire table every time, which is slow and expensive. The job needs to process only items that changed since the last run. Which solution should the engineer implement?

Accepted Answer

Enable DynamoDB Streams and process change events with AWS Lambda to write to S3. DynamoDB Streams captures item-level changes (inserts, updates, deletes) in near real-time. An AWS Lambda function can process these change events and write only the incremental data to Amazon S3, eliminating the need to scan the entire DynamoDB table. This approach is both cost-effective and efficient for incremental data ingestion.

Answer

Use DynamoDB Scan with a LastEvaluatedKey to paginate and store the last scanned key to resume next time

Answer

Add a Global Secondary Index (GSI) on a timestamp attribute and query only new records

Answer

Use AWS Database Migration Service (DMS) with ongoing replication from DynamoDB to S3

Question 14

A company stores application logs in Amazon S3 and uses AWS Glue crawlers to populate the AWS Glue Data Catalog. A data engineer needs to query the logs with Amazon Athena. The logs are partitioned by year/month/day in S3, but Athena queries are scanning all partitions and returning errors about missing partitions. What should the engineer do to enable partition pruning?

Accepted Answer

Run the AWS Glue crawler with the option to update the table's partition metadata and ensure the crawler has permission to list the partition folders.. For Athena to use partition pruning, the AWS Glue Data Catalog must contain accurate partition metadata. The crawler needs permission to list the S3 partition folders and must be configured to update partitions. Once partitions are registered, Athena can prune and avoid scanning irrelevant data, resolving the errors and improving performance.

Answer

Convert the logs to Parquet format and re-crawl the data.

Answer

Increase the Athena query timeout and retry the queries.

Answer

Move the logs to a single prefix without date partitions and update the crawler.

Question 15

A data engineer is designing a data warehouse on Amazon Redshift. The workload includes many ad-hoc queries that filter on a high-cardinality column, such as customer_id, and join large dimension tables. The engineer wants to improve query performance by choosing an appropriate distribution style and sort key. Which combination should the engineer use?

Accepted Answer

Use KEY distribution on customer_id and set the sort key to customer_id.. For a workload that frequently filters and joins on a high-cardinality column like customer_id, distributing the fact table by that key colocates matching rows and minimizes network traffic during joins. Using the same column as the sort key further speeds up range scans and merge joins. Together, they reduce data movement and I/O, improving ad-hoc query performance.

Answer

Use AUTO distribution and set the sort key to the date column with a compound sort key.

Answer

Use EVEN distribution and set the sort key to the date column.

Answer

Use ALL distribution on the fact table and set the sort key to the join key of the largest dimension.