DEA-C01 Practice Test 50 — 15 Questions

Question 1

A data engineer creates an IAM policy as shown in the exhibit. The engineer then attaches this policy to an IAM role used by an application that uploads objects to the S3 bucket 'my-bucket'. When the application uploads an object without specifying server-side encryption, what happens?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The upload fails with a 403 Access Denied error.. The IAM policy includes a condition that requires the `s3:x-amz-server-side-encryption` header to be present and set to `AES256`. If the application uploads an object without specifying server-side encryption, this condition is not met, so the request is denied with a 403 Access Denied error. Options A, C, and D are incorrect because the upload fails and the object is not stored at all.

Answer

The object is uploaded with SSE-S3 encryption by default.

Answer

The object is uploaded without encryption.

Answer

The object is uploaded with SSE-C encryption.

Question 2

A data engineer needs to store clickstream data from a web application in Amazon S3. Each event is about 5 KB, and the application generates 1 million events per hour. The data is used for real-time analytics and also for batch processing. The engineer wants to minimize storage costs while ensuring that data is available for real-time queries as soon as it is written. Which storage class should the engineer use for the S3 bucket?

Accepted Answer

S3 Standard.. S3 Standard is the correct choice because it offers low-latency (milliseconds) first-byte-out performance, making data available for real-time queries immediately after writing. It also supports both real-time analytics and batch processing without retrieval fees, and at 5 KB per event with 1 million events per hour (approximately 5 GB/hour or 120 GB/day), the storage cost is manageable compared to the frequent access pattern. S3 Standard is optimized for frequently accessed data and provides the durability and availability needed for clickstream analytics.

Answer

S3 Intelligent-Tiering.

Answer

S3 Standard-IA.

Answer

S3 Glacier Instant Retrieval.

Question 3

A company needs to ingest data from an on-premises Hadoop cluster into Amazon S3 for archival and analysis. The total data volume is 50 TB. The migration must be completed within one week. The on-premises network has a 1 Gbps connection to AWS. Which AWS service should be used?

Accepted Answer

AWS Snowball Edge. AWS Snowball Edge is the correct choice because it is designed for large-scale data transfers (50 TB) over slow or unreliable networks. With a 1 Gbps connection, transferring 50 TB would take approximately 5 days under ideal conditions, but real-world factors (e.g., network congestion, protocol overhead) make it risky to complete within one week. Snowball Edge physically ships the data, bypassing network constraints entirely.

Answer

AWS Transfer Family

Answer

AWS Glue

Answer

AWS DataSync

Question 4

A company is building a data lake on S3. They have a large volume of CSV files (hundreds of GB) in a source bucket. They need to convert them to Parquet, partition by date, and ensure the data is encrypted at rest with SSE-KMS. The pipeline must be triggered automatically when new files arrive. Which THREE steps should be part of the solution? (Choose THREE.)

Accepted Answer

Configure S3 Event Notification to send events to an SQS queue. S3 Event Notifications can be configured to send events to an SQS queue when new CSV files arrive. This decouples the ingestion pipeline, allowing the Glue job to poll the queue for new file notifications and trigger processing without tight coupling or polling the S3 bucket directly. SQS provides reliable, scalable message delivery that can trigger downstream ETL workflows.

Answer

Use Amazon Kinesis Data Firehose to ingest new files

Answer

Use Amazon Athena CTAS query to convert files in batch

Question 5

A company needs to store JSON documents that are frequently read and written by a web application. The data must be highly available and durable across multiple Availability Zones. Which AWS database service meets these requirements?

Accepted Answer

Amazon DynamoDB. Amazon DynamoDB is a fully managed NoSQL key-value and document database that provides single-digit millisecond performance at any scale. It stores JSON documents natively, supports frequent reads and writes, and offers built-in high availability and durability by automatically replicating data across multiple Availability Zones (AZs) in an AWS Region. This makes it the ideal choice for the described web application workload.

Answer

Amazon RDS for PostgreSQL

Answer

Amazon S3

Answer

Amazon ElastiCache for Redis

Question 6

A company uses Amazon Redshift to store customer data. The security team requires that all queries are logged for auditing purposes. Which step should be taken to meet this requirement? (Select ONE.)

Accepted Answer

Enable Amazon Redshift audit logging to an S3 bucket.. The requirement is to log all queries for auditing. Amazon Redshift's native audit logging captures connection logs, user activity logs, and query logs, and can be exported to an S3 bucket. This is the only step that directly logs SQL queries. AWS CloudTrail does not log SQL queries; it logs management API calls (e.g., CreateCluster, ModifyCluster). Therefore, only Option E meets the requirement.

Answer

Enable AWS CloudTrail database audit logging.

Answer

Use AWS CloudTrail to log Redshift API calls.

Answer

Enable logging on the Redshift security group.

Answer

Enable VPC Flow Logs for the Redshift cluster.

Question 7

A company is ingesting real-time financial transactions into Amazon Kinesis Data Streams. The data is then consumed by a Kinesis Data Analytics for Apache Flink application that calculates running totals. The application is experiencing high latency and checkpoint failures. Which TWO steps should the engineer take to improve performance and reliability? (Select TWO.)

Accepted Answer

Increase the number of shards in the Kinesis data stream.. Options C and D are correct. Increasing the number of shards (C) increases the throughput and parallelism of the stream, reducing latency. Increasing KPUs (D) provides more compute resources for the Flink application, helping to prevent checkpoint failures. Option A (enhanced fan-out) is designed for multiple consumers, not for a single Flink job. Option B (reducing batch size) may not improve overall throughput. Option E (decreasing checkpoint interval) could lead to more frequent checkpointing, increasing overhead and potentially causing more failures.

Answer

Enable enhanced fan-out for the Flink application.

Answer

Reduce the batch size of records processed per checkpoint.

Answer

Decrease the checkpoint interval to reduce state size.

Question 8

A data engineer is designing a data ingestion pipeline for a social media company. The pipeline ingests user posts from a REST API into Amazon S3. The API returns JSON data with an array of posts. The engineer needs to transform the data into individual JSON objects per post and store them in S3 with a partition structure of year/month/day/hour. The data should be available in S3 within 15 minutes of ingestion. The engineer decides to use AWS Lambda for transformation. Which combination of services should the engineer use to meet these requirements with minimal operational overhead?

Accepted Answer

Use Amazon CloudWatch Events to trigger an AWS Lambda function every 15 minutes. The Lambda function calls the API, transforms the data, and writes individual JSON objects to S3 with the required partition structure.. Using Amazon CloudWatch Events (or EventBridge) to trigger an AWS Lambda function every 15 minutes provides a simple, serverless solution with minimal operational overhead. The Lambda function can call the REST API, transform the array of posts into individual JSON objects, and write them to S3 with the partition structure year/month/day/hour. This meets the 15-minute latency requirement without managing infrastructure.

Option A (AWS Step Functions) adds unnecessary orchestration complexity for a simple scheduled task. Option C (AWS Glue ETL) is too heavyweight for this lightweight transformation and incurs additional cost and setup. Option D (Amazon Kinesis Data Firehose) is designed for streaming data, not periodic batch API calls; it cannot pull from an API on a schedule without custom logic, making it less suitable.

Answer

Use AWS Step Functions to orchestrate an API call and data transformation with Lambda, running every 15 minutes.

Answer

Use AWS Glue ETL jobs scheduled with AWS Glue triggers to run every 15 minutes.

Answer

Use Amazon Kinesis Data Firehose with a Lambda function for transformation. Configure Firehose to pull from the API every 15 minutes.

Question 9

A company is using Amazon Kinesis Data Firehose to ingest clickstream data from a website into an S3 bucket. The data is then analyzed using Amazon Athena. Recently, the company noticed that Athena queries are returning incomplete results for the last 30 minutes of data. The Firehose delivery stream is configured to buffer data for 60 seconds or 5 MB before delivering to S3. The S3 bucket has a lifecycle policy that transitions objects to Amazon S3 Glacier after 30 days. The IAM role for Firehose has permissions to write to S3 and access a CloudWatch Logs group. The engineer checks the Firehose monitoring and sees that the delivery rate is healthy, but the 'S3.Bytes' metric shows a spike in the last hour. The 'BackupToS3.Bytes' metric is zero. What is the MOST likely cause of the missing data?

Accepted Answer

The data is still being buffered in Firehose and has not yet been delivered to S3.. The data is still being buffered in Firehose and has not yet been delivered to S3. The buffer settings (60 seconds or 5 MB) mean data can be held in the buffer for up to 60 seconds before being written to S3. For the last 30 minutes, some data may still be in the buffer and not yet delivered. Athena queries only see data that has been delivered to S3. Option A (lifecycle policy) would not affect recent data. Option B (backup) is unrelated and the 'BackupToS3.Bytes' metric is zero, indicating backup is not active. Option D (IAM permissions) would cause errors, not missing data.

Answer

The lifecycle policy is transitioning data before Athena can query it.

Answer

The backup is enabled and data is being sent to the backup bucket instead.

Answer

The IAM role for Firehose does not have permissions to write to the S3 bucket.

Question 10

A data engineer is troubleshooting a Lambda function that reads from the Kinesis stream 'my-data-stream'. The Lambda function is able to read data but occasionally fails with 'KMS.AccessDeniedException'. What is the most likely cause?

Accepted Answer

The Lambda function's execution role does not have kms:Decrypt permission for the KMS key.. The KMS.AccessDeniedException indicates that the Lambda function's execution role lacks the kms:Decrypt permission for the AWS KMS key used to encrypt the Kinesis stream. When a Kinesis stream is encrypted with a customer managed KMS key, the consumer (Lambda) must have explicit decrypt permissions on that key to read the data records.

Answer

The retention period is too short; increase it.

Answer

The stream has too few shards; increase shard count.

Answer

The Lambda function is not authorized to consume from Kinesis streams.

Question 11

A financial services company runs a critical data pipeline using AWS Step Functions to orchestrate multiple AWS Lambda functions and AWS Glue jobs. The pipeline processes transaction data and must complete within 15 minutes to meet a service-level agreement (SLA). Recently, the pipeline has been failing intermittently with a 'StateMachineExecutionLimitExceeded' error. The Step Functions state machine is configured with a Standard type. The company has a single state machine that runs on demand. The error occurs when multiple requests are submitted simultaneously. What should the team do to prevent this error?

Accepted Answer

Request a service quota increase for concurrent executions of Standard Workflows.. The 'StateMachineExecutionLimitExceeded' error indicates that the account-level limit for concurrent Standard Workflow executions has been reached. The default limit is 1,000 concurrent executions per account per region. To handle simultaneous submissions, requesting a service quota increase is the appropriate action. Option A (increasing timeout) does not affect concurrent execution limits. Option B (switching to Express Workflow) is not ideal because Express Workflows have a maximum duration of 5 minutes, which cannot meet the 15-minute SLA, and the error is not about throughput but about concurrency limits. Option D (increasing Lambda reserved concurrency) is unrelated to Step Functions execution limits.

Answer

Increase the state machine execution timeout to 30 minutes.

Answer

Switch the state machine type to Express Workflow to handle higher throughput.

Answer

Increase the Lambda function reserved concurrency to 100.

Question 12

A data analyst needs to query a large Amazon S3 bucket containing CSV files using Amazon Athena. The bucket has millions of small files (less than 1 MB each). The analyst reports that queries are very slow and often time out. The data is partitioned by date and the partition columns are defined in the table. What is the most effective way to improve query performance?

Accepted Answer

Run a compaction job to consolidate small files into fewer larger files (e.g., 128 MB each).. Many small files (under 1 MB) cause high overhead because each file requires a separate read operation and metadata call. Consolidating them into fewer larger files (e.g., 128 MB each) reduces the number of read operations and improves I/O efficiency, directly addressing the root cause of slowdowns and timeouts. Option A (converting to Parquet) improves storage efficiency and query performance but does not reduce the file count; it is a beneficial addition but not the most effective standalone fix for the small file problem. Option C (adding more partitions) would increase overhead by creating even more directories/files to scan. Option D (S3 Select) applies within individual files and does not mitigate overhead from file quantity.

Answer

Convert the files to Apache Parquet format using an AWS Glue ETL job.

Answer

Add more partitions by including hour and minute as partition keys.

Answer

Use S3 Select to push down filtering to S3 before Athena processes the data.

Question 13

A gaming company uses Amazon Redshift for analytics. The Redshift cluster stores user data that must be encrypted at rest using a customer-managed KMS key. The company has enabled audit logging using AWS CloudTrail. The security team wants to ensure that any attempt to disable or delete the KMS key is immediately detected and triggers an automated response. They have set up a CloudWatch Events rule that triggers an SNS notification when the KMS key is scheduled for deletion. However, they also want to prevent the key from being deleted accidentally. What should they do?

Accepted Answer

Add a statement to the KMS key policy that denies 'kms:ScheduleKeyDeletion' for all principals except the root user.. Adding a statement to the KMS key policy that denies 'kms:ScheduleKeyDeletion' for all principals except the root user explicitly prevents any user (including IAM users with full admin permissions) from scheduling deletion of the key. This is the most direct and authoritative control to prevent accidental deletion. Option A is incorrect because automatic key rotation does not prevent the key from being deleted; it only changes the backing key material. Option C is incorrect because an IAM policy attached to the Redshift cluster role does not affect permissions on the KMS key; the key policy is the authoritative control for actions on a customer-managed key. Option D is incorrect because CloudTrail monitoring only detects deletion events but does not prevent the deletion itself.

Answer

Enable automatic key rotation for the KMS key to ensure that even if the key is deleted, the data remains encrypted.

Answer

Attach an IAM policy to the Redshift cluster role that denies 'kms:ScheduleKeyDeletion'.

Answer

Set up a CloudTrail trail to monitor for 'ScheduleKeyDeletion' events and send an alert to the security team.

Question 14

A company is designing a data ingestion pipeline for clickstream data from a website. The data must be ingested in near real-time. Which TWO services can be used together to build this pipeline?

Accepted Answer

Amazon Kinesis Data Streams. Amazon Kinesis Data Streams can ingest clickstream data in near real-time. Option D is correct because Amazon Kinesis Data Firehose can deliver that streaming data to destinations like S3. Option B is wrong because SQS is a message queuing service, not a streaming ingestion service. Option C is wrong because S3 is a storage service, not a real-time ingestion service. Option E is wrong because DynamoDB is a NoSQL database, not a streaming ingestion service.

Answer

Amazon Simple Queue Service (SQS)

Answer

Amazon S3

Answer

Amazon DynamoDB

Question 15

A large e-commerce company uses Amazon DynamoDB to store shopping cart data. The table has a partition key of 'user_id' and a sort key of 'item_id'. The application performs frequent updates to the 'quantity' attribute for items in a user's cart. Recently, the operations team noticed that write requests are being throttled during peak shopping hours. The table is provisioned with 10,000 write capacity units (WCUs) and uses DynamoDB Accelerator (DAX) for read caching. The data engineer suspects that the throttling is due to hot partitions. The application uses a single AWS SDK client configured with retries. After reviewing the Amazon CloudWatch metrics, the engineer sees that the WriteThrottleEvents metric spikes for a few partition keys. The table has a high number of partitions. What should the data engineer do to resolve the throttling issue with minimal application changes?

Accepted Answer

Configure DynamoDB Auto Scaling with a maximum WCU setting of 20,000 and a target utilization of 70%.. DynamoDB Auto Scaling can dynamically adjust write capacity in response to traffic patterns, reducing throttling on hot partitions without requiring application changes. Option A is incorrect because permanently increasing WCUs does not adapt to variable demand and may lead to over-provisioning. Option B (Global Tables) replicates data across regions but does not increase write capacity for a single table, so it does not resolve hot partition throttling. Option C (DAX) is a read cache and does not offload write traffic; it only improves read performance.

Answer

Increase the provisioned write capacity to 20,000 WCUs permanently.

Answer

Enable DynamoDB Global Tables to distribute writes across regions.

Answer

Add more nodes to the DAX cluster to offload write traffic.