DEA-C01 Practice Exam 52 — 20 Questions

Question 1

A company runs a data pipeline that uses AWS Glue to process data from an Amazon DynamoDB table and write results to Amazon S3. The Glue job runs on a schedule every hour. Recently, the job started failing intermittently with 'ProvisionedThroughputExceededException' errors from DynamoDB. What is the BEST solution?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Implement exponential backoff and retries in the Glue job for DynamoDB operations.. Implementing exponential backoff and retries in the Glue job is a best practice to handle transient throttling errors from DynamoDB such as ProvisionedThroughputExceededException. This approach allows the job to automatically retry failed operations with increasing delays, reducing the likelihood of sustained failures without requiring changes to the DynamoDB table's provisioned capacity. Option A is incorrect because DynamoDB Accelerator (DAX) is an in-memory cache that can reduce read traffic for cached items, but it does not guarantee elimination of ProvisionedThroughputExceeded exceptions, especially for read operations that are not cached or when the underlying issue is read throughput limits. Option B is incorrect because running the job less frequently does not address the intermittent throttling; the job may still encounter the same error when it runs. Option D is incorrect because, although increasing read capacity units could directly address read throttling, it is not the most cost-effective or best practice for dealing with occasional throttling. The recommended approach is to first implement exponential backoff and retries, only increasing provisioned capacity if throttling persists. Moreover, the ProvisionedThroughputExceededException in this scenario is due to read throughput limits, and increasing write capacity would not help.

Answer

Use DynamoDB Accelerator (DAX) to reduce read latency.

Answer

Change the Glue job schedule to run every 2 hours.

Answer

Increase the read capacity units of the DynamoDB table.

Question 2

A company is designing a data lake on Amazon S3. The security policy requires that all data be encrypted at rest using AWS KMS with automatic key rotation. Which encryption option meets these requirements? (Select THREE.)

Accepted Answer

Enable automatic key rotation on the KMS key.. AWS KMS customer-managed keys (CMKs) support automatic key rotation, which can be enabled to rotate the key material annually. This satisfies the security policy requirement for automatic key rotation. SSE-KMS with a CMK (Option D) is also required because AWS managed keys (Option B) do not support automatic key rotation, and SSE-C (Option E) does not use KMS at all. Setting default encryption on the S3 bucket to SSE-KMS with the CMK (Option C) ensures all objects are encrypted with that key, meeting the encryption-at-rest requirement.

Answer

Use SSE-KMS with an AWS managed key.

Answer

Use SSE-C with a customer-provided key.

Question 3

A data engineer needs to ingest data from an external HTTP API into Amazon S3. The API returns JSON data for a list of users, updated hourly. The engineer wants to use a serverless solution with minimal operational overhead. Which AWS service should the engineer use?

Accepted Answer

Amazon AppFlow with an HTTP connector on a scheduled flow.. Amazon AppFlow with an HTTP connector on a scheduled flow is the correct choice because it provides a fully managed, serverless integration that directly connects to external HTTP APIs, retrieves JSON data, and writes it to Amazon S3 on a scheduled basis (e.g., hourly) without requiring any custom code or infrastructure management. This minimizes operational overhead while meeting the ingestion requirements.

Answer

Amazon Kinesis Data Firehose with a custom HTTP endpoint.

Answer

AWS Lambda function triggered by CloudWatch Events.

Answer

AWS Glue ETL job triggered by EventBridge.

Question 4

A data engineer is designing a data lake on Amazon S3. Data is ingested from multiple sources in JSON format. The engineer needs to optimize query performance for Amazon Athena while minimizing storage costs. Which storage strategy should the engineer use?

Accepted Answer

Convert data to Parquet format and partition by date.. Parquet is a columnar storage format that significantly reduces data scan volume in Amazon Athena, which charges per byte scanned. Partitioning by date further limits the data scanned to only relevant partitions, optimizing both query performance and cost. JSON and CSV are row-based formats that require full scans, and Glacier is unsuitable for interactive querying.

Answer

Store data as CSV files in a single S3 bucket without prefixes.

Answer

Store data as JSON files in a single prefix without partitioning.

Answer

Store compressed JSON files in Amazon S3 Glacier.

Question 5

A company uses Amazon RDS for MySQL to store transactional data. The database contains sensitive financial information. The company's security policy requires that all data at rest be encrypted using a customer-managed KMS key. The database was originally launched without encryption at rest. The security team now needs to enable encryption without significant downtime. What should they do?

Accepted Answer

Create a snapshot of the database, copy the snapshot with encryption enabled, and restore a new DB instance from the encrypted snapshot.. You cannot enable encryption on an existing RDS instance directly. To encrypt an unencrypted RDS instance, you must create a snapshot, copy it with encryption enabled using a customer-managed KMS key, and then restore a new encrypted DB instance. This method minimizes downtime. Options B and D are incorrect because modifying the DB instance's storage settings does not allow enabling encryption in place. Option C (using DMS) could also achieve encryption but involves more downtime and complexity than the snapshot approach.

Answer

Enable encryption by modifying the DB instance's storage type to 'encrypted'.

Answer

Use the AWS DMS (Database Migration Service) to migrate data to a new encrypted RDS instance.

Answer

Modify the DB instance and enable encryption under the 'Storage' settings.

Question 6

A company stores sensitive data in Amazon S3 and requires that all data be encrypted at rest. The data is accessed by multiple AWS services. Which solution meets the encryption requirement with the LEAST operational overhead?

Accepted Answer

Enable S3 default encryption with SSE-S3. Enabling S3 default encryption with SSE-S3 provides server-side encryption automatically without any key management overhead. Option A is wrong because SSE-KMS requires managing KMS keys. Option B is wrong because client-side encryption requires managing keys on the client side. Option C is wrong because SSE-C requires managing your own keys.

Answer

Use server-side encryption with AWS KMS (SSE-KMS)

Answer

Use client-side encryption with AWS KMS

Answer

Use server-side encryption with customer-provided keys (SSE-C)

Question 7

An organization is using AWS Glue to process sensitive data. The data is stored in S3 with server-side encryption using AWS KMS (SSE-KMS). The Glue job fails with an error indicating that it cannot read the data. The IAM role used by Glue has the following policy. What is missing?

Accepted Answer

The kms:Decrypt permission on the KMS key. The Glue job fails because the IAM role lacks the kms:Decrypt permission on the KMS key. While s3:GetObject is also required, the role already has that permission (or it is not the missing permission causing the error). The key missing permission for decrypting SSE-KMS encrypted data is kms:Decrypt. Option A is incorrect because s3:GetObject is present. Option B is correct. Options C and D are incorrect because they are not required for read operations.

Answer

The s3:GetObject permission on the bucket

Answer

The kms:GenerateDataKey permission on the KMS key

Answer

The kms:ReEncrypt permission on the KMS key

Question 8

A data engineer is monitoring an Amazon Kinesis Data Stream used to ingest clickstream data. The engineer notices that the stream's 'WriteProvisionedThroughputExceeded' metric is frequently above zero. Which TWO actions could help mitigate this issue? (Choose TWO.)

Accepted Answer

Increase the number of shards in the stream.. Options A and D are correct. Increasing the number of shards in the stream increases the write capacity, reducing the 'WriteProvisionedThroughputExceeded' metric. Implementing a random prefix for the partition key helps distribute data writes evenly across all shards, preventing hot shards. Option B is incorrect because reducing the data retention period does not affect write throughput; it only changes how long data is stored. Option C is incorrect because decreasing the number of shards would reduce write capacity, potentially worsening the issue. Option E is incorrect because enabling enhanced fan-out increases read capacity, not write capacity.

Answer

Reduce the data retention period to free up capacity.

Answer

Decrease the number of shards to reduce overhead.

Answer

Enable enhanced fan-out on the stream.

Question 9

Refer to the exhibit. A data engineer is troubleshooting an AWS Lambda function that processes data from Amazon S3. The function is triggered by S3 events, but no logs appear in CloudWatch Logs. The engineer runs the AWS CLI command shown. What is the MOST likely reason for the missing logs?

Accepted Answer

The Lambda execution role does not have permissions to create log groups and write logs.. The CLI command output shows the log group exists but `storedBytes: 0`, meaning no logs have been written. The most common cause is that the Lambda execution role lacks the required permissions (`logs:CreateLogStream`, `logs:PutLogEvents`). Option B is incorrect because even if the function logged to a different group, logs for this group would still be written if permissions allowed. Option C is incorrect because the function could be invoked but unable to write logs. Option D is incorrect because a retention policy does not prevent logs from being written; it only determines how long they are kept.

Answer

The Lambda function is configured to log to a different log group.

Answer

The Lambda function is not being invoked by S3 events.

Answer

The log retention policy is set to 7 days, causing logs to expire immediately.

Question 10

A data engineer needs to monitor the number of records processed by an AWS Glue ETL job and send an alert if the count drops below a threshold. Which AWS service should be used to create this custom metric?

Accepted Answer

Amazon CloudWatch. Amazon CloudWatch is the correct service for creating custom metrics because it allows you to publish your own data points, such as the number of records processed by an AWS Glue ETL job. You can use the CloudWatch PutMetricData API or the AWS Glue job script to emit a custom metric, then set an alarm on that metric to trigger an alert when the count drops below a threshold.

Answer

Amazon S3

Answer

AWS Config

Answer

AWS CloudTrail

Question 11

A data engineer needs to store JSON documents that are accessed by a key-value pattern. The workload requires single-digit millisecond latency at any scale. Which AWS service is most appropriate?

Accepted Answer

Amazon DynamoDB. Amazon DynamoDB is a fully managed NoSQL key-value and document database that delivers single-digit millisecond latency at any scale. It is optimized for key-value access patterns, making it the ideal choice for storing and retrieving JSON documents by a primary key with consistent low latency.

Answer

Amazon DocumentDB (with MongoDB compatibility)

Answer

Amazon RDS for PostgreSQL

Answer

Amazon Neptune

Question 12

A company uses AWS KMS to encrypt sensitive data in S3. The security team requires that the KMS key must be rotated automatically every year. Which key type should be used?

Accepted Answer

Customer managed key with automatic rotation enabled. Customer managed keys can be configured with automatic rotation every year, meeting the security team's requirement. Option B is incorrect because AWS managed keys (aws/s3) rotate automatically every 3 years, not annually. Option A is incorrect because asymmetric keys do not support automatic rotation. Option C is incorrect because custom key stores backed by CloudHSM do not offer automatic rotation.

Answer

Asymmetric customer managed key

Answer

AWS managed key (aws/s3)

Answer

Custom key store backed by CloudHSM

Question 13

A company uses Amazon Kinesis Data Firehose to deliver streaming data to Amazon S3. The data is in JSON format. The delivery stream is configured with a buffer size of 5 MB and a buffer interval of 60 seconds. However, the data engineer notices that S3 objects are being created with sizes much smaller than 5 MB. What is a likely cause?

Accepted Answer

The incoming data rate is too low, causing the buffer interval to trigger before reaching the buffer size.. Kinesis Data Firehose delivers data to S3 when either the buffer size (5 MB) or the buffer interval (60 seconds) is reached, whichever occurs first. If the incoming data rate is low, the buffer interval will expire before accumulating 5 MB of data, resulting in smaller S3 objects.

Answer

The data is being compressed before delivery, reducing object size.

Answer

The data transformation lambda is splitting records into smaller ones.

Answer

The S3 bucket is configured with a lifecycle policy that splits objects.

Question 14

A data engineer is designing a data pipeline that uses AWS Glue to process data from an RDS MySQL database. The pipeline must capture only incremental changes (inserts and updates) and run every hour. Which approach is most cost-effective and reliable?

Accepted Answer

Use Glue job bookmarks to track and process only new and updated records. AWS Glue job bookmarks track processed data and enable incremental processing by automatically storing state information about previously processed data, so only new and updated records are processed in subsequent runs. This approach is cost-effective because it avoids full table scans and reduces data processing. Option B is not optimal because AWS DMS with CDC adds extra cost and operational overhead for a simple hourly incremental load, and it is not directly integrated with Glue. Option C can work but is less reliable if timestamps are not updated on changes or if there are late-arriving records, and it may require additional indexing. Option D is inefficient because full table scans each hour are costly and slow, especially for large tables.

Answer

Use AWS DMS with change data capture (CDC) to replicate changes to S3

Answer

Add a timestamp column and query rows where timestamp > last run

Answer

Perform a full table scan each hour and compare with previous snapshot

Question 15

Refer to the exhibit. An IAM policy for an AWS Lambda function. The Lambda function is triggered by an S3 event (object created) and needs to read from a Kinesis stream. However, the function fails with access denied when trying to read from Kinesis. What is the most likely cause?

Accepted Answer

The Kinesis stream is encrypted with a customer managed KMS key, and the Lambda function lacks kms:Decrypt permission. When a Kinesis stream is encrypted with a customer managed KMS key, the Lambda function must have the `kms:Decrypt` permission on that key to read data from the stream. Without this permission, the Lambda function will receive an access denied error even if it has the necessary Kinesis actions (e.g., `kinesis:GetRecords`) allowed in its IAM policy. The S3 event trigger only invokes the function; it does not grant Kinesis access.

Answer

The Lambda function is not in the same region as the Kinesis stream

Answer

The Lambda function does not have permission to list S3 buckets

Answer

The S3 bucket policy denies access to the Lambda function

Question 16

A data engineer is migrating an on-premises Apache HBase workload to Amazon DynamoDB. The HBase table has a row key with composite structure: customer_id (10 chars) + timestamp (10 digits). The access pattern is to query by customer_id and retrieve the latest entries. How should the DynamoDB table be designed to optimize performance?

Accepted Answer

Create a table with partition key = customer_id and sort key = timestamp.. DynamoDB's partition key (customer_id) evenly distributes data across partitions, while the sort key (timestamp) enables efficient range queries using Query with ScanIndexForward=false to retrieve the latest entries. This design directly maps the HBase composite row key pattern to DynamoDB's primary key structure, optimizing for the described access pattern.

Answer

Use Amazon S3 with customer_id as prefix and timestamp as object name.

Answer

Create a table with partition key = concatenated customer_id and timestamp.

Answer

Create a table with partition key = timestamp and sort key = customer_id.

Question 17

A data engineer ran the above CLI command to describe an Amazon DynamoDB table named 'Orders'. The table has a key schema with 'OrderID' as the partition key and 'CustomerID' as the sort key. The table currently has no items. The engineer wants to add a new attribute 'OrderDate' and then query all orders for a specific customer within a date range. Which of the following actions is the MOST efficient approach to support this query pattern?

Accepted Answer

Create a Global Secondary Index (GSI) with 'CustomerID' as partition key and 'OrderDate' as sort key.. A Global Secondary Index (GSI) allows querying on a different partition key ('CustomerID') and sort key ('OrderDate') without altering the base table's key schema. This supports efficient range queries on 'OrderDate' for a specific customer, as GSIs provide a separate index with its own provisioned throughput and can be created on existing tables with items. The base table's primary key remains unchanged, and the GSI enables the desired query pattern with low latency.

Answer

Modify the table's primary key to include 'OrderDate' as an additional sort key.

Answer

Use a Scan operation with a filter expression on 'CustomerID' and 'OrderDate' to retrieve the data.

Answer

Create a Local Secondary Index (LSI) with 'CustomerID' as partition key and 'OrderDate' as sort key.

Question 18

A data engineer needs to ingest data from an on-premises Oracle database into Amazon S3 on a nightly basis. The data volume is approximately 10 GB per night. The database is accessible over the internet. Which AWS service is MOST appropriate for this task?

Accepted Answer

AWS Glue ETL job with a JDBC connection. The most appropriate AWS service among the given options for nightly batch ingestion from an on-premises Oracle database into Amazon S3 is AWS Glue ETL job with a JDBC connection (A). AWS Glue can connect to the Oracle database via JDBC, extract data, and load it into S3 in a scheduled batch manner. While AWS Database Migration Service (DMS) is purpose-built for database migrations and would be the ideal service, it is not listed as an option. AWS DataSync (B) is used for file and object storage transfers, not for database connections. AWS Transfer Family (C) provides managed file transfer protocols and cannot directly query databases. Amazon Kinesis Data Streams (D) is designed for real-time streaming data ingestion, not nightly batch loads. Therefore, AWS Glue is the correct choice.

Answer

AWS DataSync

Answer

AWS Transfer Family

Answer

Amazon Kinesis Data Streams

Question 19

A company is ingesting large volumes of sensor data into Amazon S3. The data must be encrypted at rest using an AWS KMS customer managed key. Which TWO actions are required to enable server-side encryption with AWS KMS (SSE-KMS) on the S3 bucket?

Accepted Answer

Set the default encryption on the S3 bucket to AWS-KMS and specify the KMS key. Setting the default encryption on the S3 bucket to AWS-KMS and specifying the KMS key ensures that all objects uploaded to the bucket are automatically encrypted with SSE-KMS using that customer managed key. This is the primary configuration step to enforce server-side encryption at rest with a customer managed key.

Answer

Enable S3 Versioning on the bucket

Answer

Enable Amazon CloudWatch Logs for the bucket

Answer

Add a bucket policy that denies uploads without encryption

Question 20

A company uses Amazon Redshift for data warehousing. The data team notices that queries are slow due to high disk usage on the cluster. They need to free up space without deleting any data. What should they do?

Accepted Answer

Run a deep copy to re-sort and reclaim space. A deep copy recreates the table with optimal sort order and reclaims unused space by reorganizing data blocks. This process effectively frees up disk space without deleting any data, addressing the high disk usage issue.

Answer

Change the table's sort keys

Answer

Run VACUUM command

Answer

Add more nodes to the cluster