DEA-C01 Practice Questions 2 — 50 Questions

Question 1

Refer to the exhibit. A data engineer has attached this bucket policy to an S3 bucket named data-lake-bucket. The engineer wants to allow only GET requests from the corporate network (10.0.0.0/16) over HTTPS. However, users report that they cannot access objects even when connected to the corporate network. What is the issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The Deny statement blocks all requests that are not using HTTPS, including those from the corporate network.. The Deny statement with `aws:SecureTransport` set to `false` blocks all HTTP requests. Since the Allow statement only permits GET requests from the corporate network (10.0.0.0/16) but does not require HTTPS, any request from that network that uses HTTP is denied by the explicit Deny. The Deny statement overrides the Allow, so even legitimate corporate users are blocked if they use HTTP.

Answer

The Deny statement should include a condition on the source IP.

Answer

The Allow statement should include a condition for SecureTransport.

Answer

The Allow statement should specify s3:GetObject instead of s3:GetObject.

Question 2

A data engineer needs to transfer 10 TB of data from an on-premises Hadoop cluster to Amazon S3. The network bandwidth is limited to 100 Mbps, and the transfer must be completed within 48 hours. Which solution meets the requirements?

Accepted Answer

Use AWS Snowball Edge device to transfer data offline. The on-premises Hadoop cluster has 10 TB of data to transfer, but the network bandwidth is only 100 Mbps. At 100 Mbps, the theoretical maximum transfer rate is about 12.5 MB/s, which would take approximately 10 TB / 12.5 MB/s ≈ 800,000 seconds ≈ 222 hours — far exceeding the 48-hour window. AWS Snowball Edge is an offline, physical device that bypasses network constraints entirely, allowing you to transfer the data by shipping the device, which completes within days regardless of bandwidth.

Answer

Use AWS DataSync to transfer data online

Answer

Use S3 Transfer Acceleration over the internet

Answer

Set up AWS Direct Connect to increase bandwidth

Question 3

A data engineer needs to monitor Amazon DynamoDB table metrics to detect throttled requests. Which CloudWatch metric should the engineer set an alarm on?

Accepted Answer

ThrottledRequests. `ThrottledRequests` is the specific Amazon CloudWatch metric that tracks the number of requests to a DynamoDB table that are throttled due to exceeding the provisioned throughput capacity. This metric directly reflects throttling events, making it the appropriate choice for setting an alarm to detect throttled requests.

Answer

ReadThrottleEvents

Answer

SuccessfulRequestLatency

Answer

ConsumedWriteCapacityUnits

Question 4

A data engineer is monitoring a Redshift cluster that is experiencing slow query performance. The cluster has 4 dc2.large nodes. The engineer notices that disk space usage is at 85% across all nodes. Which action would MOST likely improve query performance?

Accepted Answer

Increase the number of nodes to 8.. At 85% disk usage on dc2.large nodes, the cluster is approaching the threshold where Redshift begins to automatically offload data to Amazon S3, causing significant performance degradation due to increased I/O and network latency. Adding more nodes (option C) increases both compute capacity and total disk space, reducing per-node disk pressure and allowing the cluster to keep more data local for faster query execution.

Answer

Change the table design to use DISTKEY and SORTKEY.

Answer

Enable compression on all columns.

Answer

Run the VACUUM command to reclaim space.

Question 5

A company wants to audit all data access events in their S3 buckets, including who accessed objects and from which IP address. Which AWS service should be used to capture these events?

Accepted Answer

AWS CloudTrail with data events enabled. AWS CloudTrail can log S3 API calls such as GetObject, PutObject, and ListObjects when data events are enabled, capturing details like who accessed an object and from which IP address. Option D is incorrect because S3 Server Access Logs provide object-level logs but do not include IAM user or role details. Option B is incorrect because Amazon CloudWatch Logs can store and monitor logs but does not capture S3 data events directly. Option C is incorrect because AWS Config records resource configuration changes, not data access events.

Answer

Amazon CloudWatch Logs

Answer

AWS Config

Answer

Amazon S3 Server Access Logs

Question 6

A company needs to ingest data from a relational database into Amazon S3 for analytics. The database is an Amazon RDS MySQL instance. Which AWS service should be used for a one-time historical data load?

Accepted Answer

AWS Database Migration Service (DMS). AWS Database Migration Service (DMS) is the correct choice for a one-time historical data load from Amazon RDS MySQL to Amazon S3. DMS supports full-load migrations from relational databases to S3, making it ideal for this use case. AWS Glue ETL can also perform similar tasks but is more suited for complex transformations and scheduled jobs, and DMS is the dedicated service for database migrations. Amazon Athena is a query service, not an ingestion tool. Amazon Kinesis Data Firehose is designed for streaming data, not one-time loads.

Answer

AWS Glue ETL

Answer

Amazon Athena

Answer

Amazon Kinesis Data Firehose

Question 7

A company uses AWS Lake Formation to manage data lake permissions. A data analyst cannot query a table in Athena, although the table appears in the catalog. The analyst has IAM permissions to run Athena. What is the MOST likely cause?

Accepted Answer

The analyst lacks Lake Formation permissions on the table.. Lake Formation permissions are separate from IAM; even if the analyst has IAM permissions to run Athena, they also need specific Lake Formation permissions (e.g., SELECT) on the table to query it. The table appears in the catalog because the analyst has DESCRIBE permission on the database or table, but querying requires additional data access permissions. Option A is incorrect because the table appears in the catalog, so it is registered. Option B is incorrect because the S3 bucket policy might allow access, but Lake Formation can override it. Option D is incorrect because the workgroup output location affects where query results are stored, not the ability to query a specific table.

Answer

The Glue Data Catalog does not have the table registered.

Answer

The S3 bucket policy denies access to the analyst's IAM role.

Answer

The Athena workgroup is not configured with the correct output location.

Question 8

A data engineer needs to transform CSV files in S3 to Parquet format using a serverless solution. The files are large (up to 5 GB each) and arrive irregularly. Which TWO services can accomplish this with minimal operational overhead? (Choose TWO.)

Accepted Answer

AWS Glue ETL job. AWS Glue ETL job is correct because it is a fully managed, serverless service that can automatically convert CSV to Parquet without provisioning infrastructure. It handles large files (up to 5 GB) by scaling Spark executors dynamically, and can be triggered by S3 events for irregular arrivals, minimizing operational overhead.

Answer

Amazon EC2 with a script

Answer

Amazon EMR cluster

Answer

Amazon Redshift Spectrum

Question 9

A data engineering team is ingesting data from multiple sources into Amazon S3 using AWS Glue ETL jobs. The jobs are failing intermittently with the error: 'Task ran out of memory'. The input data size varies widely from 100 MB to 10 GB per job. Which configuration change would best mitigate this issue?

Accepted Answer

Enable job bookmarking to process only incremental data. Enabling job bookmarking allows the Glue ETL job to process only incremental (new or changed) data, which directly addresses the intermittent out-of-memory errors caused by widely varying input sizes (100 MB to 10 GB). By skipping previously processed data, the job consistently handles smaller data volumes per run, reducing memory pressure on the Spark executors.

Answer

Increase the number of workers in the Glue job

Answer

Reduce the batch size in the S3 source node

Answer

Change the job type from Spark to Python shell

Question 10

A company is streaming data from an application to Amazon Kinesis Data Streams. The data must be transformed in real time and then stored in Amazon S3 in Parquet format. Which AWS service should be used for the transformation step?

Accepted Answer

Amazon Kinesis Data Analytics for Apache Flink.. Amazon Kinesis Data Analytics for Apache Flink is a serverless service that can run Apache Flink applications to perform real-time transformations on streaming data. Option A (Amazon Kinesis Data Firehose with a Lambda transformation) is primarily for loading data and has limitations for complex transformations. Option B (Amazon EMR running Apache Spark Streaming) can work but adds management overhead and is not the simplest managed service. Option D (AWS Lambda with a Kinesis trigger) is suitable for lightweight transformations but may hit execution time limits for complex or long-running transformations.

Answer

Amazon Kinesis Data Firehose with a Lambda transformation.

Answer

Amazon EMR running Apache Spark Streaming.

Answer

AWS Lambda with a Kinesis trigger.

Question 11

A data engineer is troubleshooting a Glue ETL job that reads from an S3 bucket and writes to a Redshift table. The job fails with a 'MemoryError' when processing a large dataset. Which TWO actions should the engineer take to resolve this issue? (Choose TWO.)

Accepted Answer

Increase the number of DPUs and set 'spark.sql.shuffle.partitions' to a higher value.. Increasing the number of DPUs (Data Processing Units) provides more memory and compute resources to the Glue job, directly addressing the MemoryError. Setting 'spark.sql.shuffle.partitions' to a higher value reduces the amount of data shuffled per partition, preventing out-of-memory errors during wide transformations like joins or aggregations.

Answer

Increase the number of DPUs and set 'coalesce(1)' in the script.

Answer

Decrease the number of DPUs and increase 'spark.shuffle.partitions'.

Answer

Set the 'RedshiftTempDir' parameter to a larger S3 bucket.

Question 12

A data engineer is designing a streaming ingestion pipeline using Amazon Kinesis Data Streams. The stream has 10 shards, and the data volume is expected to grow by 50% over the next month. The engineer needs to ensure that the pipeline can scale without manual intervention. Which approach should be used?

Accepted Answer

Switch the Kinesis stream to on-demand capacity mode. Kinesis Data Streams on-demand capacity mode automatically scales the number of shards based on the incoming traffic pattern, eliminating the need for manual intervention. Option A is incorrect because CloudWatch Alarms can trigger a Lambda function to add shards via the UpdateShardCount API, but this approach requires custom code and does not provide automatic scaling without manual setup. Option B is incorrect because Auto Scaling groups are used for EC2 instances, not for Kinesis stream shards. Option D is incorrect because Lambda functions can be used to scale shards programmatically, but this still requires custom implementation and is not a native automatic scaling feature.

Answer

Set up a CloudWatch Alarm to trigger a Lambda function to add shards

Answer

Use an Auto Scaling group to add more shards

Answer

Configure the stream to use a Lambda function that scales shards

Question 13

A logistics company ingests real-time GPS location data from thousands of delivery vehicles into Amazon Kinesis Data Streams. Each vehicle sends a JSON payload every 10 seconds containing vehicle_id, latitude, longitude, timestamp, and speed. The data must be stored in Amazon S3 for historical analysis, but the company wants to first aggregate the data per vehicle per minute (average speed, min/max coordinates) to reduce storage costs. The solution must be serverless and handle potential duplicate records without double-counting. What should the engineer do?

Accepted Answer

Use Amazon Kinesis Data Analytics for Apache Flink to aggregate data in a 1-minute tumbling window with deduplication logic, then output to Kinesis Data Firehose for delivery to S3.. Amazon Kinesis Data Analytics for Apache Flink can process streaming data with tumbling windows (1-minute) to aggregate per vehicle per minute, and Flink's stateful processing allows deduplication to avoid double-counting. The output is then sent to Kinesis Data Firehose for persistent storage in Amazon S3, all serverless. Option A (EMR with Spark Streaming) is not serverless. Option C (Kinesis Data Firehose with Lambda transformation) cannot perform stateful windowed aggregation and deduplication efficiently—it processes events individually without maintaining state across records. Option D (AWS Glue streaming ETL job) is serverless but adds higher latency and complexity compared to Kinesis Data Analytics, and is not as optimized for low-latency streaming aggregations with deduplication.

Answer

Use Amazon EMR with Spark Streaming to perform the aggregation and write to S3.

Answer

Use Kinesis Data Firehose with a Lambda transformation to aggregate records in a 1-minute window.

Answer

Use an AWS Glue streaming ETL job with Spark Structured Streaming to aggregate and deduplicate.

Question 14

A data engineer needs to transfer 50 TB of data from an on-premises HDFS cluster to Amazon S3. The on-premises network has a 1 Gbps link to AWS. Which AWS service should be used to perform the transfer efficiently?

Accepted Answer

AWS DataSync. AWS DataSync is the correct choice because it is designed for large-scale data transfers over the network, handling 50 TB efficiently over a 1 Gbps link by parallelizing transfers and automating scheduling. Amazon S3 Transfer Acceleration only improves upload speed over long distances but is not a dedicated transfer service. AWS Snowball Edge would be slower due to shipping and is unnecessary since the network link is sufficient. AWS Direct Connect provides a dedicated network connection but is not a data transfer service.

Answer

Amazon S3 Transfer Acceleration

Answer

AWS Snowball Edge

Answer

AWS Direct Connect

Question 15

A company ingests streaming data from social media APIs into Kinesis Data Streams. Each record is approximately 5 KB. The data must be enriched with geolocation information from a DynamoDB table before being stored in S3. The enrichment process takes about 200 ms per record. Which architecture minimizes latency and cost?

Accepted Answer

Use Kinesis Data Firehose with a Lambda function that queries DynamoDB. Kinesis Data Firehose can invoke a Lambda function for per-record enrichment, providing automatic scaling and low operational overhead. Option A is wrong because an EC2 instance adds significant operational overhead and requires manual scaling, increasing complexity and cost. Option B is wrong because AWS Glue ETL jobs are optimized for batch processing, not continuous streaming with low latency per record. Option C is wrong because Kinesis Data Analytics (SQL) is designed for real-time analytics on streaming data, not for per-record enrichment involving external lookups like DynamoDB.

Answer

Use an EC2 instance running a custom application to consume from Kinesis, enrich, and write to S3

Answer

Use AWS Glue ETL jobs running continuously on the stream

Answer

Use Kinesis Data Analytics to perform enrichment with SQL

Question 16

A data engineer is migrating an on-premises Apache HBase workload to Amazon DynamoDB. The application requires strongly consistent reads and the ability to query by a composite key (partition key + sort key). Which DynamoDB table design should be used?

Accepted Answer

Create a table with a partition key and sort key, and use ConsistentRead parameter.. DynamoDB natively supports strongly consistent reads when you use the `ConsistentRead` parameter set to `true` on GetItem, Query, or Scan operations. By defining a table with a partition key and sort key, you can directly query by the composite key (partition key + sort key) with strong consistency, meeting both requirements without additional infrastructure.

Answer

Use a secondary index with strongly consistent reads.

Answer

Use a local secondary index (LSI) with the composite key.

Answer

Create a global secondary index (GSI) with the composite key.

Question 17

Refer to the exhibit. A data engineer is troubleshooting an IAM policy attached to a user. The user reports that they cannot upload objects to the S3 bucket 'data-lake-bucket' unless they explicitly specify the 'x-amz-server-side-encryption' header with value 'AES256'. The engineer wants to modify the policy to allow uploads without requiring encryption headers, but still enforce encryption on the bucket itself. Which change should the engineer make?

Accepted Answer

Remove the entire Deny statement.. Removing the Deny statement eliminates the explicit denial that blocks uploads without the 'x-amz-server-side-encryption' header set to 'AES256'. The Allow statement already grants s3:PutObject, and by removing the Deny, users can upload without specifying encryption headers. The bucket's default encryption setting (e.g., AES256) will then automatically encrypt objects at rest, enforcing encryption without requiring the header in the request.

Answer

Remove the Condition block from the Allow statement.

Answer

Change the Condition in the Allow statement to use aws:kms instead of AES256.

Answer

Set the bucket's default encryption to AES256 and keep the policy unchanged.

Question 18

A company runs a daily batch processing job on Amazon EMR that reads data from Amazon S3 and writes results back to S3. The job takes longer than expected. The engineer wants to monitor the job's resource utilization. Which AWS service should be used to collect and visualize metrics such as CPU and memory usage of the EMR cluster's nodes?

Accepted Answer

Amazon CloudWatch with the CloudWatch Agent installed on the EMR nodes.. Amazon CloudWatch with the CloudWatch Agent installed on EMR nodes can collect CPU, memory, and other system-level metrics, which can be visualized in CloudWatch dashboards. Option A is incorrect because AWS Config records configuration changes, not resource utilization. Option B is incorrect because Amazon Athena is a query service for data in S3, not a monitoring service. Option D is incorrect because AWS CloudTrail logs API calls, not performance metrics.

Answer

AWS Config to record configuration changes in the EMR cluster.

Answer

Amazon Athena to query EMR job logs stored in S3.

Answer

AWS CloudTrail to log API calls made by the EMR job.

Question 19

A marketing analytics team needs to ingest customer transaction data from an on-premises PostgreSQL database into Amazon S3 for analysis. The data volume is about 10 GB daily, and the team wants to perform full refresh daily (truncate and load) into S3 as Parquet files. The company has a Direct Connect connection to AWS. The team needs a simple, managed solution that minimizes operational overhead. What should the team use?

Accepted Answer

Use an AWS Glue ETL job with a JDBC connection to the PostgreSQL database, extract data, and write to S3 in Parquet format.. AWS Glue ETL job is the best choice for this scenario. It is a fully managed service that can connect to on-premises PostgreSQL via a JDBC connection (using an AWS Glue connection with the appropriate network configuration over Direct Connect). It can perform a full extract (truncate and load) each day and write the data directly to S3 in Parquet format, minimizing operational overhead. Option A (AWS DMS) is designed for ongoing change data capture (CDC) and continuous replication, not for daily full refreshes without incremental changes. Option B (Amazon EMR with Spark) requires managing clusters and is more complex than necessary for a simple daily load. Option D (AWS Data Pipeline) requires custom scripting and more configuration compared to Glue's built-in ETL capabilities. Therefore, option C is correct.

Answer

Set up AWS Database Migration Service (DMS) to continuously replicate data to S3 in Parquet format.

Answer

Use Amazon EMR with a Spark job that reads from PostgreSQL and writes to S3.

Answer

Use AWS Data Pipeline with a SQLActivity to extract data and copy to S3.

Question 20

A data engineer is implementing a CDC (Change Data Capture) pipeline from a relational database to Amazon S3 using AWS Database Migration Service (DMS). Which TWO configurations are required for continuous replication?

Accepted Answer

Enable binary logging on the source database.. For continuous CDC replication with AWS DMS, two key configurations are required: enabling binary logging on the source database (option B) and selecting both 'Full load' and 'Ongoing replication' in the DMS task (option D). Binary logging (e.g., binlog for MySQL) captures ongoing changes, while enabling both full load and ongoing replication ensures that the initial data load is completed before continuous change capture begins. Option A (transformation rules) is optional, not required. Option C (VPC endpoint) is not necessary because DMS can connect to the source database over the internet, VPN, or VPC peering without a VPC endpoint. Option E (pre-creating the target table in S3) is not needed because DMS can create the target table automatically or you can let DMS handle the schema.

Answer

Define transformation rules in the DMS task.

Answer

Configure a VPC endpoint for DMS.

Answer

Pre-create the target table in S3.