DEA-C01 Practice Exam 53 — 20 Questions

Question 1

A company uses Amazon Kinesis Data Firehose to deliver data to an S3 bucket. The data contains personally identifiable information (PII) that must be redacted before storage. Which TWO actions can achieve this requirement? (Choose TWO.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use AWS Glue ETL to read from the S3 bucket and write redacted data to another S3 bucket.. Option A is correct because AWS Glue ETL jobs can read the raw data from the S3 bucket, apply transformation logic (such as masking or removing PII fields), and write the redacted output to another S3 bucket, satisfying the requirement that PII be redacted before storage in the destination. Option E is correct because Kinesis Data Firehose supports Lambda-based record transformation, where a Lambda function is invoked on each incoming record to redact PII before Firehose delivers the data to S3, which is the most direct in-stream solution. Option B is not correct because Amazon Athena is a query service that reads data already stored in S3; it cannot redact PII before storage. Option C is not correct because Amazon Macie discovers and classifies sensitive data but does not automatically redact or modify it. Option D is not correct because AWS DMS is designed for database migration and replication, not for transforming and redacting PII in a Firehose-to-S3 data pipeline.

Answer

Use Amazon Athena to query the data and redact PII on the fly.

Answer

Use Amazon Macie to discover and automatically redact PII before storage.

Answer

Use AWS Database Migration Service (AWS DMS) to replicate data and apply transformations.

Question 2

A company uses Amazon DynamoDB for a gaming leaderboard. The table has a partition key of 'GameId' and a sort key of 'Score'. The application needs to query the top 10 scores for a given game. Which DynamoDB feature should be used for optimal performance?

Accepted Answer

Use a Query operation on the base table with ScanIndexForward set to false.. The base table already has 'GameId' as partition key and 'Score' as sort key. A Query operation on the base table with ScanIndexForward set to false retrieves items in descending order by Score, so the first 10 items are the top scores. This is efficient without additional cost or complexity. Option D is unnecessary and incurs extra storage cost.

Answer

Enable DynamoDB Streams and use a Lambda function to compute the leaderboard.

Answer

Use DynamoDB Accelerator (DAX) to cache the results of a Scan operation.

Answer

Create a Global Secondary Index with the same partition key and sort key, then query with ScanIndexForward false.

Question 3

A data engineer is designing a data lake on Amazon S3. The data is ingested from multiple sources in Parquet format, and the schema evolves over time. Which approach allows querying the data with Amazon Athena while supporting schema evolution?

Accepted Answer

Use AWS Glue Data Catalog with crawlers to automatically update the table schema.. AWS Glue Data Catalog with crawlers automatically infers and updates the table schema as new Parquet files with evolving schemas are ingested into S3. This allows Athena to query the data using the latest schema without manual intervention, making it the ideal solution for schema evolution in a data lake.

Answer

Define Hive-style partitions in Athena and manually update the schema.

Answer

Use S3 Select to query the data directly without a schema.

Answer

Use Amazon Redshift Spectrum with external tables and update the schema manually.

Question 4

Which THREE factors should a data engineer consider when choosing between Amazon RDS and Amazon DynamoDB for a new application? (Choose three.)

Accepted Answer

Whether the workload requires serverless scaling.. Amazon RDS is a relational database service that requires provisioning and managing server capacity, while DynamoDB is a fully managed NoSQL key-value and document database that supports serverless scaling. Option A is correct because DynamoDB can automatically scale throughput capacity up or down based on traffic patterns, making it suitable for unpredictable workloads, whereas RDS requires manual scaling or the use of Auto Scaling with predefined policies.

Answer

Whether the data must be encrypted at rest by default.

Answer

Whether the application requires VPC isolation.

Question 5

A healthcare company uses AWS Lake Formation to manage access to a data lake in Amazon S3. The data lake contains a table with patient records, and the company needs to ensure that only users in the 'Cardiology' department can query columns containing sensitive information such as patient name and diagnosis. Other departments should be able to query non-sensitive columns like patient ID and visit date. The company wants to implement this with the least operational overhead. What should the data engineer do?

Accepted Answer

Use Lake Formation column-level security to grant SELECT on the sensitive columns only to the Cardiology department role, and grant SELECT on non-sensitive columns to all other department roles.. Lake Formation column-level security allows granular access control at the column level, enabling the company to grant SELECT on sensitive columns only to the Cardiology department while allowing other departments to query non-sensitive columns. This approach centralizes permission management and requires no data duplication or custom ETL, minimizing operational overhead. It is the intended solution for fine-grained access control in a data lake.

Answer

Create an AWS Glue ETL job that reads the table, filters out sensitive columns based on the user's department, and writes the results to separate S3 buckets for each department. Grant each department access to its respective bucket.

Answer

Use AWS Identity and Access Management (IAM) policies to deny access to the sensitive columns for all departments except Cardiology. Attach these policies to the IAM roles used by each department.

Answer

Configure an Amazon Athena workgroup for each department and use Athena's column-level access control to restrict sensitive columns. Grant each department's users access to their workgroup.

Question 6

A data engineer needs to ingest data from an Amazon S3 bucket into an Amazon Redshift table on a daily schedule. The data is in CSV format and the schema matches. Which service is simplest for this batch ingestion?

Accepted Answer

Amazon Redshift COPY command. The Amazon Redshift COPY command is the simplest and most efficient method for batch loading data from Amazon S3 into Redshift when the schema matches and the data is in CSV format. It leverages Redshift's massively parallel processing (MPP) architecture to read data directly from S3, automatically handling compression, encryption, and error logging without requiring any intermediate services or custom code.

Answer

AWS Glue ETL job with JDBC connection

Answer

AWS Data Pipeline

Answer

Amazon Athena CREATE TABLE AS SELECT

Question 7

A data engineer needs to automate the backup of an Amazon RDS for PostgreSQL database. Which AWS service can be used to schedule and manage the backups?

Accepted Answer

AWS Backup. AWS Backup is a fully managed backup service that can automate backups of RDS databases. Option A (Amazon S3) is incorrect because S3 is an object storage service, not a backup scheduling service. Option B (AWS Lambda) is incorrect because while Lambda can be used for custom automation, it is not the primary managed service for backup scheduling. Option D (Amazon CloudWatch) is incorrect because CloudWatch is for monitoring and observability, not backup management.

Answer

Amazon S3

Answer

AWS Lambda

Answer

Amazon CloudWatch

Question 8

A data engineer is troubleshooting a data pipeline that uses Amazon Kinesis Data Firehose to deliver data to Amazon S3. The engineer notices that the S3 bucket contains many small files (less than 1 MB). This is causing performance issues in downstream processing. What is the BEST way to reduce the number of small files?

Accepted Answer

Increase the buffer size to at least 128 MB in the Firehose delivery stream configuration.. Increasing the Firehose buffer size to at least 128 MB allows more data to accumulate before delivery, resulting in fewer, larger files in S3. This directly addresses the small file problem by batching more records per delivery.

Answer

Use an AWS Lambda function to transform the data before delivery.

Answer

Change the compression format from GZIP to Snappy.

Answer

Decrease the buffer interval in the Firehose delivery stream configuration.

Question 9

A data engineering team is using Amazon EMR to process large datasets stored in Amazon S3. The cluster uses Spot Instances for cost savings. During processing, the team notices that tasks are failing due to Spot Instance interruptions. The team needs to make the EMR job resilient to Spot interruptions without increasing costs significantly. Which solution should they implement?

Accepted Answer

Use EMR instance fleets with a mix of Spot and On-Demand, setting the allocation strategy to 'diversified' and using On-Demand for core nodes.. Using EMR instance fleets with a mix of Spot and On-Demand instances, setting the allocation strategy to 'diversified' and using On-Demand for core nodes, provides resilience against Spot interruptions while controlling costs. The 'diversified' strategy spreads Spot instances across multiple instance pools and Availability Zones, reducing the impact of a single Spot interruption. Core nodes, which handle HDFS data and run tasks, are kept on On-Demand to ensure stability, while task nodes can use Spot for cost savings.

Answer

Use EMR instance fleets with a mix of Spot and On-Demand, but set the allocation strategy to 'lowest price'.

Answer

Increase the number of core nodes using On-Demand instances.

Answer

Use only Spot Instances but enable automatic termination and checkpointing.

Question 10

Which TWO statements are true about Amazon Redshift distribution styles? (Choose TWO.)

Accepted Answer

ALL distribution copies the entire table to every node.. The ALL distribution style in Amazon Redshift copies the entire table to every node in the cluster. This is ideal for small, slowly changing dimension tables (like date or location tables) that need to be joined with large fact tables, as it eliminates the need to redistribute data across nodes during query execution.

Answer

KEY distribution is always the best choice to minimize data skew.

Answer

AUTO distribution always selects EVEN distribution.

Answer

Redshift automatically assigns a ROUND ROBIN distribution style by default.

Question 11

A company stores its application logs in Amazon S3. The logs are generated daily and need to be retained for 3 years for compliance. The logs are accessed frequently for the first 30 days, occasionally for the next 6 months, and rarely after that. The data engineering team wants to minimize storage costs while ensuring that logs are available for retrieval within 12 hours for the first 6 months and within 48 hours after that. The team also wants to automatically delete logs after 3 years. Which lifecycle policy should the team implement?

Accepted Answer

Transition to S3 Standard-IA after 30 days, to S3 Glacier Deep Archive after 6 months, delete after 3 years.. It aligns with the access patterns and retrieval requirements: S3 Standard-IA after 30 days for occasional access with immediate retrieval, then S3 Glacier Deep Archive after 6 months for rare access with a 12-hour retrieval time (via expedited or standard retrieval), and deletion after 3 years. This minimizes storage costs while meeting the 48-hour retrieval window for older logs.

Answer

Transition to S3 One Zone-IA after 30 days, delete after 6 months.

Answer

Transition to S3 Standard-IA after 30 days, delete after 3 years.

Answer

Transition to S3 Standard-IA after 30 days, to S3 Glacier after 6 months, delete after 3 years.

Question 12

A company uses Amazon S3 to store sensitive data. The security team wants to ensure that all objects uploaded to a specific S3 bucket are automatically encrypted at rest using server-side encryption with AWS KMS managed keys (SSE-KMS). Which bucket policy statement should be added to enforce this requirement?

Accepted Answer

Deny put requests where 's3:x-amz-server-side-encryption' is not 'aws:kms'. It denies any S3 PUT request that does not include the `x-amz-server-side-encryption` header set to `aws:kms`, thereby enforcing SSE-KMS encryption for all objects uploaded to the bucket. This bucket policy condition ensures that only requests specifying AWS KMS-managed keys are allowed, meeting the security team's requirement for automatic encryption at rest with SSE-KMS.

Answer

Deny put requests where 's3:x-amz-server-side-encryption' is 'aws:kms'

Answer

Deny put requests where 's3:x-amz-server-side-encryption' is not 'AES256'

Answer

Deny put requests where 's3:x-amz-server-side-encryption' is not set

Question 13

A data engineer needs to ensure that data stored in Amazon S3 is automatically deleted after 30 days. Which S3 feature should be used?

Accepted Answer

S3 Lifecycle policy. S3 Lifecycle policies can automatically delete objects after a specified time period, such as 30 days. Option B (MFA Delete) requires multi-factor authentication for deletion but does not automate deletion. Option C (Versioning) keeps multiple versions but does not delete. Option D (Object Lock) prevents deletion or modification but does not schedule automatic deletion.

Answer

S3 MFA Delete

Answer

S3 Versioning

Answer

S3 Object Lock

Question 14

A company uses AWS Lambda to process messages from an Amazon SQS queue. The messages contain JSON payloads that need to be transformed and written to an Amazon DynamoDB table. Recently, the Lambda function has been timing out and messages are being sent to the dead-letter queue (DLQ). What is the BEST way to troubleshoot and resolve this issue?

Accepted Answer

Increase the Lambda function timeout and monitor DynamoDB write capacity to ensure it is not throttling.. The Lambda function is timing out, which suggests the function's execution duration is exceeding its configured timeout. Increasing the timeout gives the function more time to process messages. Additionally, if DynamoDB write capacity is insufficient, throttling can cause retries that further delay processing, so monitoring and possibly increasing write capacity units addresses the root cause of timeouts.

Answer

Use a standard SQS queue instead of a DLQ to reprocess failed messages automatically.

Answer

Switch the SQS queue to a FIFO queue to ensure exactly-once processing.

Answer

Increase the visibility timeout of the SQS queue to 30 minutes.

Question 15

A company is using Amazon DynamoDB for a gaming application. They want to store player session data that expires after 24 hours. Which DynamoDB feature should be used?

Accepted Answer

Time to Live (TTL). Amazon DynamoDB Time to Live (TTL) allows you to define a per-item timestamp attribute that automatically deletes items after a specified duration. For the gaming session data that must expire after 24 hours, you can set the TTL attribute to the current time plus 24 hours, and DynamoDB will asynchronously delete expired items without any additional cost or write operations.

Answer

DynamoDB Streams

Answer

Global Tables

Answer

Point-in-Time Recovery

Question 16

A data engineer needs to store semi-structured JSON logs from multiple microservices in a cost-effective manner for later analysis using Amazon Athena. The logs are generated continuously, and the total volume is about 1 TB per day. The data must be queryable within minutes of arrival. Which storage solution is most appropriate?

Accepted Answer

Amazon S3 bucket with partitioned folders. Amazon S3 with partitioned folders is the most appropriate solution because it provides a cost-effective, scalable storage layer for semi-structured JSON logs, and integrates natively with Amazon Athena for serverless querying. By partitioning the data by time (e.g., year/month/day/hour), Athena can use partition pruning to minimize scanned data, enabling queries within minutes of arrival. S3's low cost per GB and lifecycle policies further optimize storage for the 1 TB/day volume.

Answer

Amazon DynamoDB table with JSON attribute

Answer

Amazon RDS for PostgreSQL table with JSON column

Answer

Amazon Redshift cluster with JSON ingestion

Question 17

Arrange the steps to set up a streaming ETL pipeline using Amazon Kinesis Data Firehose to Amazon S3.

Accepted Answer

1. Create a Kinesis Data Firehose stream
2. Configure the data source
3. Set the S3 destination
4. Enable optional Lambda transformation
5. Test the pipeline. First, create the Firehose stream, configure source, set S3 destination, enable optional Lambda transformation, and test.

Answer

1. Configure the data source
2. Create a Kinesis Data Firehose stream
3. Enable optional Lambda transformation
4. Set the S3 destination
5. Test the pipeline

Answer

1. Create a Kinesis Data Firehose stream
2. Set the S3 destination
3. Configure the data source
4. Enable optional Lambda transformation
5. Test the pipeline

Answer

1. Configure the data source
2. Set the S3 destination
3. Create a Kinesis Data Firehose stream
4. Enable optional Lambda transformation
5. Test the pipeline

Question 18

A data engineer is troubleshooting an AWS Glue ETL job that fails with an 'Access Denied' error when trying to write to an S3 bucket. The IAM role used by the job has the policy shown in the exhibit. The bucket 'my-bucket' uses S3 default encryption with AWS KMS. What is the most likely missing permission?

Accepted Answer

kms:GenerateDataKey and kms:Decrypt. When an S3 bucket uses AWS KMS for default encryption, any write operation requires the IAM role to have kms:GenerateDataKey and kms:Decrypt permissions on the KMS key. The policy in the exhibit grants s3:PutObject but does not include any KMS actions, resulting in an 'Access Denied' error. Option A (s3:GetObjectVersion) is not needed for writing. Option B (glue:GetObject) is not a valid AWS action. Option C (s3:ListBucketMultipartUploads) is not required for a write operation. Option D (s3:PutObjectAcl) is unnecessary unless the job explicitly sets ACLs.

Answer

s3:GetObjectVersion

Answer

glue:GetObject

Answer

s3:ListBucketMultipartUploads

Answer

s3:PutObjectAcl

Question 19

A data engineer is designing a data lake on Amazon S3. The data is ingested from multiple sources and needs to be partitioned by year, month, day, and event type for efficient querying with Amazon Athena. Which S3 key prefix structure is most appropriate?

Accepted Answer

s3://bucket/event_type=events/year=2024/month=01/day=01/data.parquet. Uses Hive-style partitioning (event_type=events/year=2024/month=01/day=01), which Athena and other query engines natively support. This structure allows Athena to perform partition pruning, reading only the relevant directories based on WHERE clause filters, significantly reducing data scanned and improving query performance. Option D also uses Hive-style partitioning but with a different order of partition keys (day, month, year). While still valid, this non-standard order may cause issues with automatic partition discovery when using MSCK REPAIR TABLE, which expects the partition order to match the table definition. Therefore, option C is the most appropriate because it follows the common convention of listing partitions from coarse to fine granularity (year > month > day) and can be easily loaded into Athena without additional configuration.

Answer

s3://bucket/events/2024-01-01/event_type=data.parquet

Answer

s3://bucket/2024/01/01/event_type/events/data.parquet

Answer

s3://bucket/day=01/month=01/year=2024/event_type=events/data.parquet

Question 20

A company uses Amazon Kinesis Data Firehose to deliver data to an S3 bucket. The data contains personally identifiable information (PII) that must be redacted before storage. Which TWO actions can achieve this requirement? (Choose TWO.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure the Firehose delivery stream to send failed records to a backup S3 bucket. Amazon Kinesis Data Firehose natively supports a 'backup' or 'error output' configuration: when a Lambda transformation fails (e.g., throws an exception), Firehose can automatically route the failed records to a designated Amazon S3 bucket for failed data. This allows the engineer to capture and analyze the failed records without blocking or altering the main delivery pipeline, as the stream continues processing successfully transformed records.

Answer

Increase the buffer size of the Firehose stream

Answer

Disable the Lambda transformation and process all records in batch later

Answer

Modify the Lambda function to write failed records to Amazon DynamoDB