DEA-C01 Practice Exam 52 — 20 Questions

Question 1

A company wants to centrally manage access to multiple AWS accounts for its data engineers. The company already uses AWS Organizations. Which AWS service should be used to define fine-grained permissions across accounts?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS IAM Identity Center (AWS Single Sign-On). AWS IAM Identity Center (formerly AWS Single Sign-On) is designed to centrally manage access to multiple AWS accounts within AWS Organizations. It allows you to define fine-grained permissions using permission sets and assign them to users or groups across accounts.

Answer

AWS IAM

Answer

AWS Resource Access Manager (AWS RAM)

Answer

AWS Key Management Service (AWS KMS)

Question 2

Refer to the exhibit. A data engineer is troubleshooting a Kinesis Data Streams consumer that is falling behind. The stream has 2 shards and is receiving data at a rate of 2 MB/s. The consumer is an AWS Lambda function with a batch size of 100 records. What should the engineer do to improve consumer throughput?

Accepted Answer

Increase the number of shards in the stream to 4. Increasing the number of shards to 4 doubles the stream's total ingestion capacity to 4 MB/s, which directly increases the number of concurrent Lambda invocations and thus consumer throughput. With 2 shards, each shard can support up to 1 MB/s input and 2 MB/s output, so the current 2 MB/s load is at the shard-level output limit, causing the consumer to fall behind.

Answer

Decrease the Lambda batch size to 10 records

Answer

Increase the retention period of the stream to 168 hours

Answer

Increase the memory allocation of the Lambda function

Question 3

A company uses AWS Glue to transform data stored in S3. The Glue job runs daily and processes data in the range of hundreds of GB. The data engineer wants to optimize the job for cost and performance. Which THREE actions should be taken? (Choose THREE.)

Accepted Answer

Increase the number of DPUs for the job. Increasing the number of DPUs (Data Processing Units) for an AWS Glue job can improve performance by enabling parallel processing of large datasets (hundreds of GB). AWS Glue allocates resources in increments of DPUs, where each DPU provides 4 vCPU and 16 GB of memory; scaling out DPUs reduces execution time, which can lower overall cost if the job runs fewer minutes, balancing cost and performance.

Answer

Store intermediate data in HDFS on Amazon EMR

Answer

Reduce the number of DPUs to save cost

Question 4

A data engineer needs to transfer 10 TB of data from an on-premises data center to Amazon S3. The network bandwidth is limited to 100 Mbps, and the data transfer must be completed within 5 days. What is the most cost-effective solution?

Accepted Answer

Use AWS Snowball Edge to physically ship the data.. With 10 TB of data and a 100 Mbps link, the theoretical transfer time over the internet is approximately 10 days (10 TB * 8 / 100 Mbps = 800,000 seconds ≈ 9.26 days), which exceeds the 5-day requirement. AWS Snowball Edge is the most cost-effective solution because it bypasses the network bottleneck entirely by physically shipping the data, and it is designed for large-scale data transfers where network constraints make online transfer impractical.

Answer

Use S3 Transfer Acceleration to speed up the transfer over the internet.

Answer

Use AWS DataSync over the internet to transfer the data.

Answer

Set up an AWS Direct Connect connection to increase bandwidth.

Question 5

A company is building a data lake on Amazon S3 and needs to ingest data from multiple sources. Which of the following AWS services can be used to ingest and transform data in near real-time? (Select TWO.)

Accepted Answer

AWS Glue. AWS Glue is correct because it provides a serverless ETL (Extract, Transform, Load) service that can ingest data from various sources and transform it in near real-time using its streaming ETL capabilities. Glue can consume data from Amazon Kinesis Data Streams or Apache Kafka, apply transformations using Apache Spark, and write the results to Amazon S3 or other destinations, making it suitable for near real-time data ingestion and transformation.

Answer

Amazon Athena

Answer

AWS Step Functions

Answer

Amazon Simple Queue Service (SQS)

Question 6

A company uses Amazon Kinesis Data Streams to ingest clickstream data. The data must be transformed and stored in Amazon S3 for batch analytics. The engineer wants to use AWS Lambda for transformation. Which TWO configurations are required? (Choose two.)

Accepted Answer

Create an event source mapping from the Kinesis stream to the Lambda function.. Option D is correct because AWS Lambda consumes records from Kinesis Data Streams through an event source mapping, which polls the stream using the enhanced fan-out or standard iterator and invokes the function with batches of records. Option E is correct because the Lambda execution role must include IAM permissions for the required actions, such as kinesis:GetRecords, kinesis:GetShardIterator, kinesis:DescribeStream, and kinesis:ListShards to read the stream, plus s3:PutObject to store the transformed data in Amazon S3. Option A is not required because Kinesis Data Firehose is a separate delivery service; the Lambda function can write directly to S3 using the AWS SDK, and Firehose is not a mandatory intermediary. Option B is incorrect because a Kinesis data stream cannot send records directly to Amazon S3; it requires a consumer such as Lambda or Firehose. Option C is incorrect because an SQS dead-letter queue for Lambda errors is an optional reliability configuration, not a required configuration for transforming and storing the data.

Answer

Configure the Lambda function to write to S3 via Kinesis Data Firehose.

Answer

Configure the Kinesis stream to send records directly to S3.

Answer

Set up an SQS queue as a destination for Lambda errors.

Question 7

A data engineer is setting up Amazon S3 bucket policies for a data lake. Which TWO statements are true regarding S3 bucket policies? (Choose TWO.)

Accepted Answer

Bucket policies can grant access to accounts in other AWS Organizations. S3 bucket policies can grant cross-account access to principals in other AWS accounts, including those in different AWS Organizations, by specifying the target account ID or organization ID in the Principal element. This enables centralized data lake access management across organizational boundaries without requiring IAM roles or resource-based policies in each account.

Answer

Bucket policies are the only way to control access to S3

Answer

Bucket policies can be applied to individual objects

Answer

The Principal element in a bucket policy is optional

Question 8

A company uses Amazon Kinesis Data Streams to ingest clickstream data. The data is then processed by a Kinesis Data Analytics application running SQL queries. The analytics application is falling behind and processing records with increasing latency. The stream has 4 shards, and the average record size is 5 KB. What is the MOST effective way to improve processing latency?

Accepted Answer

Increase the parallelism of the Kinesis Data Analytics application.. Increasing the parallelism of the Kinesis Data Analytics application (e.g., by increasing the number of in-application streams or ParallelismPerKPU) allows it to consume from the stream faster, reducing latency. Option A is wrong because 5 KB is well below the 1 MB/s shard limit, so increasing shards is unnecessary. Option B is wrong because enhanced fan-out is for consumers that need low latency, but does not help if the application is CPU-bound. Option D is wrong because increasing the retention period does not affect processing speed; it only keeps data longer.

Answer

Increase the number of shards in the Kinesis stream to 8.

Answer

Enable enhanced fan-out on the Kinesis stream for the analytics application.

Answer

Increase the retention period of the Kinesis stream to 7 days.

Question 9

Refer to the exhibit. A data engineer creates an Amazon Redshift table with the above DDL. The engineer runs a query to find all orders for a specific customer within a date range. Which statement about query performance is correct?

Accepted Answer

The query will benefit from both the distribution key and the sort key to minimize data scanned.. The DDL defines customer_id as the distribution key and order_date as the sort key. When the query filters on both customer_id (distribution key) and order_date (sort key), Redshift can use partition pruning via the sort key to skip blocks that don't match the date range, and the distribution key ensures that data for the same customer is co-located on the same node slice, minimizing data movement. This combination reduces the amount of data scanned and improves query performance.

Answer

The query will be inefficient because the distribution key is not the same as the sort key.

Answer

The table should use DISTSTYLE EVEN to improve performance.

Answer

The sort key will not help because the query filters on customer_id first.

Question 10

A data engineer is troubleshooting a slow-running query on an Amazon Redshift cluster. The query involves joining two large tables. The engineer notices that the query plan shows a large number of distribution and broadcast operations. Which design change would most likely improve query performance?

Accepted Answer

Change the distribution style of both tables to KEY on the join column. Changing the distribution style of both tables to KEY on the join column ensures that rows with the same join key value are co-located on the same node. This eliminates the need for expensive broadcast or redistribution operations during the join, as Redshift can perform the join locally on each slice without moving data across the network.

Answer

Change the distribution style of both tables to ALL

Answer

Change the distribution style of both tables to EVEN

Answer

Add a sort key on the join column

Question 11

A company uses Amazon DynamoDB with on-demand capacity for a gaming application that experiences unpredictable traffic spikes. The application reads the same set of 'hot' items frequently. Users report high latency during peak hours. Which action would MOST effectively reduce read latency for the hot items?

Accepted Answer

Enable DynamoDB Accelerator (DAX) for the table.. DynamoDB Accelerator (DAX) is an in-memory cache that sits between the application and DynamoDB, providing microsecond read latency for frequently accessed items. Since the application reads the same set of 'hot' items repeatedly, DAX can serve these reads from its cache, bypassing the storage layer and reducing latency during traffic spikes without requiring any table schema changes.

Answer

Switch to provisioned capacity with auto-scaling.

Answer

Increase the read capacity units for the table.

Answer

Enable DynamoDB Global Tables for multi-region replication.

Question 12

A company is ingesting real-time clickstream data into Amazon S3 using Amazon Kinesis Data Firehose. The data is semi-structured and the company wants to transform the data into Parquet format and partition it by year, month, day, and hour. Which TWO steps should be taken to achieve this? (Choose TWO.)

Accepted Answer

Enable dynamic partitioning in Kinesis Data Firehose and specify the partition keys as year, month, day, hour extracted from the data.. Kinesis Data Firehose's dynamic partitioning feature allows you to specify partition keys (year, month, day, hour) extracted from the incoming data, and Firehose will automatically create the corresponding S3 prefix structure (e.g., year=2024/month=01/day=15/hour=10/) during delivery. Option D is correct because to convert semi-structured data to Parquet format, you can attach an AWS Lambda function as a data transformation to Firehose, which converts each record to Parquet before delivery to S3. Option E is incorrect because while Kinesis Data Firehose does support converting data to Parquet format using a schema from the AWS Glue Data Catalog, this approach requires a pre-defined Glue schema and is less flexible for semi-structured data. Moreover, the question does not mention any existing Glue Data Catalog, and the Lambda transformation in option D is a more direct and customizable method for the transformation needed.

Answer

Set up an Amazon S3 event notification to trigger an AWS Lambda function that partitions the data after delivery.

Answer

Use an AWS Glue Crawler to infer the schema and automatically partition the data in S3.

Answer

Configure Kinesis Data Firehose to convert the data to Parquet format using a schema from the AWS Glue Data Catalog.

Question 13

A company uses AWS DMS to migrate a 2 TB Oracle database to Amazon RDS for PostgreSQL. The migration is taking longer than expected. The task status shows 'Full load in progress' with a low 'Table throughput (rows/s)'. Which action would MOST improve throughput?

Accepted Answer

Increase the number of parallel tasks in the DMS task settings. The low 'Table throughput (rows/s)' during the full load phase indicates that the DMS task is not processing tables with enough parallelism. Increasing the number of parallel tasks in the DMS task settings allows the replication instance to load multiple tables concurrently, which directly improves throughput by utilizing available CPU and memory resources more efficiently.

Answer

Enable Multi-AZ on the DMS replication instance

Answer

Change the target table preparation mode to 'Do nothing'

Answer

Increase the number of shards in the source database

Question 14

A company has an S3 bucket that stores logs for compliance. The compliance team requires that objects are retained for 7 years and cannot be deleted or overwritten. Which S3 feature should be used?

Accepted Answer

Enable S3 Object Lock with retention mode COMPLIANCE and a retention period of 7 years. S3 Object Lock in COMPLIANCE mode enforces a WORM (Write Once Read Many) model where no user, including the root account, can delete or overwrite the object version until the retention period expires. Setting a 7-year retention period directly satisfies the compliance requirement that objects cannot be deleted or overwritten for 7 years. COMPLIANCE mode is the strictest retention mode and is specifically designed for regulatory retention scenarios.

Answer

Enable MFA Delete on the bucket

Answer

Configure an S3 bucket policy that denies delete and overwrite actions

Answer

Enable S3 Versioning and configure a lifecycle policy to expire objects after 7 years

Question 15

A company is using AWS Glue to run ETL jobs that transform data from Amazon DynamoDB to Amazon S3. The DynamoDB table has a large number of items (over 10 million) and is heavily used by production applications. The Glue job reads the entire DynamoDB table each time it runs, causing increased read capacity consumption and affecting production performance. The team wants to reduce the impact on the source DynamoDB table while still keeping the S3 data up-to-date. What should the team do?

Accepted Answer

Use DynamoDB Streams and AWS Lambda to capture changes and write them to S3, then run incremental Glue jobs.. Using DynamoDB Streams and AWS Lambda to capture changes and write them to S3, then running incremental Glue jobs, reduces the read load on the DynamoDB table because only changed data is processed. This approach keeps S3 data up-to-date without scanning the entire table, minimizing impact on production performance.

Answer

Increase the DynamoDB read capacity units to handle the Glue job's read load.

Answer

Use the DynamoDB console to export the table to S3 in Parquet format.

Answer

Reduce the parallelism of the Glue job to lower the read throughput.

Question 16

A company uses Amazon S3 to store log files. The security team notices that some objects are being accessed from an unexpected AWS account. The data engineer needs to identify which specific IAM user or role is accessing the objects. Which AWS service should be used to get this information?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records API activity in your AWS account, including S3 data events such as GetObject, PutObject, and DeleteObject. To identify the specific IAM user or role accessing S3 objects, you need to enable S3 data events in CloudTrail, which will log the identity of the caller. CloudTrail is the correct service for auditing and tracking user activity.

Answer

AWS Trusted Advisor

Answer

Amazon S3 server access logs

Answer

AWS Config

Question 17

A data engineer needs to troubleshoot why an AWS Glue job is failing with a 'Insufficient Memory' error. The job processes a 10 GB dataset. Which step should the engineer take FIRST?

Accepted Answer

Increase the number of DPUs allocated to the job.. The FIRST step when a Glue job fails with 'Insufficient Memory' is to increase the number of DPUs (Data Processing Units) allocated to the job. More DPUs provide more executors and memory, directly addressing the memory constraint. This is the most direct, low-risk remediation before considering code or job-type changes.

Answer

Switch from using Apache Spark to Python shell.

Answer

Repartition the data into more partitions within the job.

Answer

Change the job type from Python to Java.

Question 18

A data engineer needs to restrict access to an Amazon S3 bucket so that only objects encrypted with a specific AWS KMS key can be uploaded. Which S3 bucket policy condition should be used?

Accepted Answer

s3:x-amz-server-side-encryption-aws-kms-key-id. The correct condition is s3:x-amz-server-side-encryption-aws-kms-key-id (option A). This condition key allows you to require that objects uploaded to the S3 bucket are encrypted with a specific AWS KMS key by checking the key ID used in the encryption header. Option B (kms:ViaService) restricts KMS key usage to specific AWS services but does not enforce a key ID on S3 objects. Option C (s3:x-amz-server-side-encryption) only checks whether server-side encryption is enabled, not the specific key. Option D (kms:EncryptionContext) is used to enforce encryption context, not the key ID.

Answer

kms:ViaService

Answer

s3:x-amz-server-side-encryption

Answer

kms:EncryptionContext

Question 19

A data engineer creates an Amazon DynamoDB table using the CloudFormation snippet in the exhibit. The application writes 200 items per second to the table. The engineer notices that many write requests are being throttled. What is the MOST likely reason?

Accepted Answer

The provisioned write capacity is too low for the application's write rate.. The DynamoDB table is provisioned with a fixed write capacity, and the application writes 200 items per second. If the provisioned write capacity units (WCUs) are less than required, throttling occurs. Each write of an item up to 1 KB consumes 1 WCU, so 200 writes per second require at least 200 WCUs. If the table's provisioned write capacity is below this, requests will be throttled.

Answer

The table does not have a sort key, causing hot partitions.

Answer

The attribute type for OrderID should be numeric for better performance.

Answer

The table name 'Orders' conflicts with an existing table.

Question 20

Match each AWS Glue component to its role.

Accepted Answer

Data Catalog: Central metadata repository for storing table definitions and schema.. AWS Glue components work together for ETL. The Data Catalog stores metadata, Crawlers populate the catalog, Classifiers infer schema, and ETL Jobs execute transformations. Connections provide connectivity but are not listed here.

Answer

Data Catalog: Executes transformation scripts.

Answer

Crawler: Stores configuration for connecting to data stores.