DEA-C01 Practice Test 49 — 15 Questions

Question 1

A data engineer needs to transform JSON data from an S3 bucket using AWS Glue. The JSON contains nested arrays and objects. Which Glue transform is best suited for flattening nested structures?

Accepted Answer

Relationalize. The Relationalize transform is specifically designed to flatten nested JSON structures (arrays and objects) into a set of related tables, making it ideal for this use case. It automatically handles complex nesting by creating separate DataFrames for each nested level and linking them via foreign keys, which is exactly what is needed when ingesting JSON with nested arrays and objects into a relational format.

Answer

Unnest

Answer

ResolveChoice

Answer

Map

Question 2

A company uses AWS Lake Formation to manage data lake permissions. A data engineer notices that a user can query tables in Athena even though the user does not have SELECT permission on the table in Lake Formation. What could be the cause?

Accepted Answer

The IAMAllowedPrincipals group has been granted Super permission on the database. The IAMAllowedPrincipals group is a special group in Lake Formation that, when granted permissions (such as Super), allows IAM users and roles to bypass Lake Formation permissions and access data directly via services like Athena. This is a common misconfiguration that leads to unintended data access. Option A is incorrect because Redshift Spectrum uses its own permissions, not Athena. Option B is incorrect because S3 permissions allow reading the underlying data but not querying via Athena without proper Lake Formation grants. Option C is incorrect because an IAM policy granting Athena access does not override Lake Formation permissions; the IAMAllowedPrincipals group is the key bypass mechanism.

Answer

The user is using Redshift Spectrum

Answer

The user has S3 permissions to read the underlying data

Answer

The user has an IAM policy that allows Athena access

Question 3

A company has an Amazon RDS for PostgreSQL DB instance with a large table that is frequently updated. The data engineer needs to reduce storage costs by archiving old records that are no longer accessed. The archived records must be retained for 7 years due to compliance requirements. Which solution is MOST cost-effective?

Accepted Answer

Export old records using pg_dump and store in S3 Glacier Deep Archive.. Exporting old records via pg_dump and storing them in S3 Glacier Deep Archive provides the lowest-cost storage for data that must be retained for 7 years but is never accessed. S3 Glacier Deep Archive offers retrieval times of 12–48 hours at a storage cost of approximately $0.00099/GB/month, far cheaper than any RDS storage tier. This approach removes the archived data from the RDS instance, reducing provisioned storage costs while meeting compliance requirements.

Answer

Use RDS native backup and restore to keep a separate backup.

Answer

Enable storage autoscaling on the RDS instance.

Answer

Move old records to a separate table in the same RDS instance.

Question 4

A company wants to use AWS Lake Formation to manage permissions on a data lake. What is the primary benefit of using Lake Formation for data security?

Accepted Answer

Centralized fine-grained access control to data in S3, Redshift, and RDS.. AWS Lake Formation centralizes fine-grained access control for data lakes, allowing administrators to define column-level, row-level, and cell-level permissions on data stored in Amazon S3, and also extend those policies to Amazon Redshift and Amazon RDS via integrated resource links. This eliminates the need to manage separate IAM policies for each service, providing a single point of governance for data security across the data lake ecosystem.

Answer

Automatically encrypts data at rest and in transit.

Answer

Replaces IAM for all data access policies.

Answer

Provides a unified view of data across all AWS regions.

Question 5

Refer to the exhibit. A data engineer runs this CLI command to check an object's metadata. The engineer wants to verify if the object is eligible for lifecycle transition to S3 Glacier based on its age. What additional information is needed?

Accepted Answer

The current date. The CLI command output provides the last modified date of the object. To determine if the object is eligible for lifecycle transition to S3 Glacier based on its age, the engineer needs the current date to compute the object's age. The age is calculated as the difference between the current date and the last modified date. Option A is correct because without the current date, the engineer cannot verify the age condition. Option B (ETag) is used for integrity checking and not for age calculations. Option C (metadata archive flag) is not relevant; the archive flag indicates storage class but not age. Option D (ContentLength) is the object size and does not affect lifecycle age eligibility.

Answer

The ETag value

Answer

The metadata archive flag

Answer

The ContentLength value

Question 6

A company runs a streaming application on Amazon EC2 instances that writes data to an Amazon DynamoDB table (us-east-1). The data is later consumed by a reporting job that runs every hour. Recently, the reporting job has been failing with ProvisionedThroughputExceededException errors during peak hours. The DynamoDB table uses provisioned capacity with 1000 read capacity units (RCU) and 500 write capacity units (WCU). The reporting job performs scans and reads using eventually consistent reads. The application's write traffic is steady, but the reporting job's reads spike at the top of the hour. The data engineer needs to resolve the throughput exceptions without affecting the application's writes. Which solution should the data engineer implement?

Accepted Answer

Create a global secondary index (GSI) with enough RCU for the reporting job and have the job query the index instead of scanning the table.. The reporting job is failing due to ProvisionedThroughputExceededException because it performs full table scans, consuming read capacity from the table's provisioned RCU. Since the write traffic is steady and must not be affected, increasing the table's RCU (Option B) is not ideal because it would also allow more reads, potentially impacting writes if capacity is shared. Switching to on-demand (Option D) would eliminate throttling but could significantly increase costs and does not provide dedicated read capacity for the reporting job. A read replica (Option C) is not a native DynamoDB feature. Creating a global secondary index (GSI) with its own provisioned read capacity dedicated for the reporting job (Option A) offloads the read traffic from the main table, preventing interference with writes. The job can query the GSI with eventually consistent reads, effectively using the allocated RCU on the GSI without affecting the table's capacity.

Answer

Increase the table's RCU to 2000.

Answer

Create a read replica of the DynamoDB table in a different region.

Answer

Switch the table to on-demand capacity mode.

Question 7

A company wants to grant read-only access to an S3 bucket for a data analyst. The analyst should be able to list objects and read object content. Which IAM policy effect and action combination is correct?

Accepted Answer

Effect: Allow, Actions: s3:ListBucket, s3:GetObject. S3:ListBucket allows listing objects in the bucket, and s3:GetObject allows reading object content. This combination provides read-only access. Option A is incorrect because s3:DeleteObject grants delete permissions. Option B is incorrect because s3:ListAllMyBuckets lists all buckets, not bucket contents. Option C is incorrect because s3:PutObject grants write access.

Answer

Effect: Allow, Actions: s3:GetObject, s3:DeleteObject

Answer

Effect: Allow, Actions: s3:ListAllMyBuckets, s3:GetObject

Answer

Effect: Allow, Actions: s3:PutObject, s3:GetObject

Question 8

A data engineer is troubleshooting a Kinesis Data Firehose delivery stream that sends data to an Amazon S3 bucket. The delivery stream has a buffer size of 5 MB and a buffer interval of 60 seconds. The data ingestion rate is 2 MB per second. The engineer notices that S3 objects are created every 60 seconds but each object is only about 2 MB. What should the engineer do to reduce the number of small S3 objects?

Accepted Answer

Increase the buffer size to 10 MB.. Increasing the buffer size to 10 MB will allow the stream to buffer more data before writing to S3, resulting in larger objects. Option B is wrong because decreasing the buffer interval would create objects more frequently, making the problem worse. Option C is wrong because reducing the buffer size would create even smaller objects. Option D is wrong because switching to Kinesis Data Streams does not solve the buffering issue.

Answer

Decrease the buffer interval to 30 seconds.

Answer

Reduce the buffer size to 2 MB.

Answer

Switch to Kinesis Data Streams and use a Lambda function to write to S3.

Question 9

A data engineer is configuring an Amazon Redshift cluster to encrypt data at rest. The company policy requires that encryption keys be stored in AWS CloudHSM. Which integration should the engineer use to meet this requirement?

Accepted Answer

Configure Redshift to use an HSM for encryption.. The correct integration is to configure Amazon Redshift to use an HSM (Hardware Security Module) for encryption. Amazon Redshift supports AWS CloudHSM as an external HSM to store encryption keys. Option A (AWS KMS with a customer managed key) is not the integration for CloudHSM; it uses KMS, not CloudHSM. Option C (SSL/TLS) is for encryption in transit, not at rest. Option D (automatic key rotation) is a feature of Redshift encryption but does not integrate with CloudHSM for key storage.

Answer

Use AWS KMS with a customer managed key.

Answer

Enable encryption using the AWS Redshift SSL/TLS feature.

Answer

Use Redshift automatic key rotation.

Question 10

Refer to the exhibit. A data engineer creates an external table in AWS Glue Data Catalog pointing to an S3 bucket that contains encrypted objects (SSE-S3). The CREATE TABLE statement fails with an error. What change should be made to fix the error?

Accepted Answer

Set 'has_encrypted_data' to 'true'.. When creating an external table in AWS Glue Data Catalog that references an S3 bucket with SSE-S3 encrypted objects, you must set the table property 'has_encrypted_data' to 'true'. This allows Glue to properly read the encrypted data. Option A is unnecessary; Option B is not required for encryption; Option C is for SSE-KMS, not SSE-S3. Therefore, Option D is the correct change.

Answer

Change the SERDE to 'org.apache.hadoop.hive.serde2.lazy.LazySimpleSerDe'.

Answer

Add 'aws_iam_role' as a table property.

Answer

Include the KMS key ARN in the LOCATION.

Question 11

A financial services company is ingesting real-time stock trade data into Amazon Kinesis Data Streams. The data is then processed by a Kinesis Data Analytics application for fraud detection. The company must ensure that the data is processed in the correct order for each stock symbol. Which TWO configuration steps should be taken? (Choose two.)

Accepted Answer

Use the stock symbol as the partition key when putting records into the stream.. To ensure data is processed in the correct order for each stock symbol, the partition key must group all records for the same symbol into the same shard. Using the stock symbol as the partition key (C) guarantees that all trades for a given symbol go to the same shard, preserving order within that shard. Additionally, the Kinesis Client Library (KCL) processes records within a shard in the order they arrive (E), so enabling this ensures ordered processing. Options A and B are incorrect: a random partition key (A) would distribute records across shards, breaking order; increasing shards (B) does not affect ordering. Option D is wrong because DynamoDB Streams is for change data capture, not for real-time streaming order.

Answer

Use a random partition key to distribute the load evenly.

Answer

Increase the number of shards to reduce latency.

Answer

Use AWS Lambda with DynamoDB Streams instead of Kinesis Data Analytics.

Question 12

A company uses AWS Lake Formation to manage data lake permissions. The data engineer notices that a user with SELECT permission on a table can also query the underlying data in Amazon S3 directly. How can the engineer enforce that access to the S3 data is only through Lake Formation?

Accepted Answer

Grant the user permissions only through Lake Formation and remove any IAM policies that allow direct S3 access to the data location. When using Lake Formation, you should grant permissions only through Lake Formation and remove any IAM policies that allow direct S3 access. This ensures that users cannot bypass Lake Formation's fine-grained access controls. Option A (S3 Access Points) can restrict access but does not inherently enforce Lake Formation-only access unless properly configured with a policy that specifically allows only Lake Formation, which is more complex and not the recommended approach. Option C (S3 Block Public Access) only prevents public access but does not prevent authorized IAM users from direct access. Option D (bucket policy denying all except Lake Formation) could work but is not the simplest or most standard method; the recommended practice is to use Lake Formation's integration and manage permissions centrally.

Answer

Use S3 Access Points with a policy that restricts access to only Lake Formation

Answer

Enable S3 Block Public Access on the bucket

Answer

Change the S3 bucket policy to deny all access except from Lake Formation

Question 13

A data engineer runs the describe-table command shown in the exhibit. The application frequently queries by CustomerID alone. Currently, these queries result in full table scans. Which action should the engineer take to improve query performance?

Accepted Answer

Create a global secondary index on CustomerID. The `describe-table` output shows CustomerID is the partition key, but the application frequently queries by CustomerID alone, which currently causes full table scans because there is no index supporting that query pattern. Creating a global secondary index (GSI) on CustomerID allows efficient querying by CustomerID without scanning the entire table, as the GSI provides a separate data structure with its own read/write capacity that can be queried directly.

Answer

Change the sort key to OrderID

Answer

Create a local secondary index on CustomerID

Answer

Increase the read capacity units to 500

Question 14

A company ingests streaming data from multiple sources into a single Kinesis Data Streams stream. Each source produces records with a different schema. The data must be routed to different S3 prefixes based on the source. Which approach minimizes transformation overhead?

Accepted Answer

Use a single Kinesis Data Firehose with a Lambda transformation that reads schema metadata from DynamoDB to determine the S3 prefix.. Using a single Kinesis Data Firehose delivery stream with a Lambda transformation that reads schema metadata from DynamoDB to determine the S3 prefix minimizes transformation overhead by routing data in real-time without additional storage or processing steps. Option B is wrong because ingesting all data into S3 first and then using AWS Glue ETL jobs to partition and route data to different prefixes adds latency and transformation overhead due to the need for batch processing. Option C is wrong because using separate Kinesis Data Streams for each source with separate Firehose delivery streams increases cost and complexity, and does not minimize transformation overhead as it requires managing multiple streams. Option D is wrong because using Kinesis Data Analytics to run SQL queries for routing adds unnecessary complexity and overhead, as Kinesis Data Analytics is better suited for real-time analytics, not simple routing.

Answer

Ingest all data into S3 and use AWS Glue ETL jobs to partition and route data to different prefixes.

Answer

Use separate Kinesis Data Streams for each source and configure separate Firehose delivery streams.

Answer

Use Kinesis Data Analytics to run SQL queries that route data to different Firehose streams.

Question 15

A data pipeline ingests daily CSV files from an FTP server into an Amazon S3 bucket. The files must be converted to Parquet format and partitioned by date for efficient querying using Amazon Athena. Which AWS service is most suitable for this transformation?

Accepted Answer

AWS Glue. AWS Glue is the most suitable service because it provides a fully managed ETL (Extract, Transform, Load) capability that can natively read CSV files from S3, convert them to Parquet format, and write the output partitioned by date. Glue's built-in transform 'ConvertToParquet' and dynamic frame partitioning make this a straightforward, serverless solution without needing to manage infrastructure.

Answer

Amazon Kinesis Data Firehose

Answer

Amazon EMR

Answer

AWS Lambda