DEA-C01 Practice Exam 53 — 20 Questions

Question 1

A company is migrating an on-premises MongoDB database to Amazon DocumentDB. The migration must have minimal downtime. Which service should be used to perform the migration?

Accepted Answer

AWS Database Migration Service (DMS). AWS Database Migration Service (DMS) is the correct choice because it supports continuous replication from MongoDB to Amazon DocumentDB using change data capture (CDC), enabling near-zero downtime migrations. DMS can perform a full load of existing data and then apply ongoing changes from the source MongoDB oplog, keeping the target DocumentDB synchronized until the cutover.

Answer

AWS Glue

Answer

AWS DataSync

Answer

Amazon S3 Transfer Acceleration

Question 2

A data pipeline uses AWS Glue to read CSV files from an S3 bucket, transform them, and write Parquet back to S3. The pipeline runs daily and processes about 500 GB per run. The team wants to reduce costs without increasing runtime. Which approach is most effective?

Accepted Answer

Optimize the Glue script to select only required columns and filter rows early.. Optimizing the Glue script to use column pruning and predicate pushdown reduces the amount of data scanned, lowering costs without increasing runtime. Option A (pre-converting CSV to Parquet) adds an extra processing step and cost, making it less effective. Option B (enabling job bookmarks) tracks already processed data but does not reduce the cost per run. Option C (increasing DPUs) may actually increase costs and can cause unpredictable runtime.

Answer

Pre-convert the CSV files to Parquet in S3 using a separate process.

Answer

Enable job bookmarks to skip already processed data.

Answer

Increase the number of DPUs for the Glue job to improve parallelism.

Question 3

A company uses AWS Lake Formation to manage access to data in a data lake. A new data engineer has been granted SELECT permission on a table but receives an 'AccessDeniedException' when querying via Amazon Athena. The table is registered in Lake Formation and the data is encrypted with SSE-KMS. Which of the following is the MOST likely cause?

Accepted Answer

The IAM role used by Athena does not have kms:Decrypt permission on the KMS key.. The IAM role used by Athena does not have kms:Decrypt permission on the KMS key. When data is encrypted with SSE-KMS, Athena's IAM role requires kms:Decrypt to read the data from S3. Even if Lake Formation grants SELECT permission, the query fails without KMS access. Option A is incorrect because Lake Formation does not use resource-based policies on tables; it uses LF-Tags or resource links to grant permissions. Option B is incorrect because while an S3 bucket policy could block access, the most likely issue with encrypted data is missing KMS permissions. Option C is incorrect because the Glue Data Catalog does not enforce data access; Lake Formation is the service that manages fine-grained access.

Answer

The table's resource-based policy does not include the engineer's IAM role.

Answer

The S3 bucket policy denies access to the engineer's IAM role.

Answer

The AWS Glue Data Catalog has not been granted permission to the engineer's role.

Question 4

A company is ingesting streaming data from IoT devices into Amazon Kinesis Data Streams. The data is then processed by an AWS Lambda function that transforms the records and writes them to an Amazon S3 bucket. Recently, the Lambda function has been timing out and the S3 bucket is not receiving all expected data. The Kinesis stream is not throttling and has sufficient shards. Which step should the company take to resolve this issue?

Accepted Answer

Increase the Lambda function's timeout and memory allocation.. The Lambda function is timing out, indicating that it cannot process the records within the allotted time. Increasing the Lambda function's timeout and memory allocation (Option B) provides more execution time and CPU resources, which can help process larger or more frequent records before timing out. Option A is incorrect because reserved concurrency limits the maximum number of concurrent instances, not the execution duration of a single instance. Option C is incorrect because increasing shards is unnecessary; the stream is not throttling, and more shards do not resolve Lambda timeouts. Option D is incorrect because enhanced fan-out reduces latency for multiple consumers but does not prevent a single Lambda function from timing out due to processing time.

Answer

Increase the Lambda function's reserved concurrency.

Answer

Increase the number of shards in the Kinesis stream.

Answer

Enable enhanced fan-out on the Kinesis stream to reduce latency.

Question 5

A data engineer is designing a data lake on Amazon S3. The data must be immutable and support high-throughput streaming ingestion. Which THREE features should the engineer consider? (Select THREE.)

Accepted Answer

S3 Lifecycle policies to transition data to Amazon S3 Glacier. S3 Object Lock in governance mode (Option D) is correct because it enforces immutability by preventing objects from being deleted or overwritten for a specified retention period, which is essential for a data lake requiring immutable data. S3 Multipart Upload API (Option C) is correct because it enables high-throughput streaming ingestion by allowing large objects to be uploaded in parallel parts, improving throughput and resilience. S3 Lifecycle policies to transition data to Amazon S3 Glacier (Option B) is correct because it supports cost-effective storage management for immutable data that is rarely accessed, aligning with the data lake's lifecycle needs.

Answer

S3 Transfer Acceleration

Answer

S3 Cross-Region Replication (CRR)

Question 6

An e-commerce company is building a near-real-time dashboard to monitor customer clickstream data. The data is ingested via Amazon Kinesis Data Streams, transformed using AWS Lambda, and stored in Amazon S3. The team needs to query the data using Amazon Athena. Which THREE steps should be taken to optimize cost and performance? (Choose three.)

Accepted Answer

Convert the data to Apache Parquet or ORC format.. To optimize cost and performance when querying data with Athena, use columnar formats like Parquet or ORC (C) to reduce data scanned and improve compression. Compress data with gzip or Snappy (D) to reduce storage costs and data transferred during queries. Partition data by date (E) to limit the amount of data scanned per query. Option A (Glue Data Catalog) is a prerequisite, not an optimization step. Option B (JSON) is less efficient than columnar formats for analytical queries.

Answer

Use AWS Glue Data Catalog to store the table metadata.

Answer

Store the data in JSON format for flexibility.

Question 7

A company is ingesting streaming data from social media feeds using Amazon Kinesis Data Streams. The data volume peaks at 10,000 records per second, and each record is up to 1 KB. The company needs to archive the raw data in Amazon S3 in near real-time and also make it available for real-time analytics using Amazon Kinesis Data Analytics. What is the MOST efficient architecture to meet these requirements?

Accepted Answer

Use Kinesis Data Streams as the ingestion point. Use Kinesis Data Firehose to read from the stream and write to S3. Use Kinesis Data Analytics to read directly from the same stream.. Kinesis Data Streams can serve as a single ingestion point, with Kinesis Data Firehose reading from the stream to deliver data to S3 (with optional transformation) and Kinesis Data Analytics reading directly from the same stream for real-time analytics. This avoids unnecessary duplication of streams or Lambda-based processing, which would add latency and complexity. The architecture is the most efficient as it leverages native integrations without intermediate compute.

Answer

Use Kinesis Data Streams as the ingestion point. Use Kinesis Data Firehose to read from the stream, convert to Parquet, and write to S3. Use a Lambda function to send data to Kinesis Data Analytics.

Answer

Use Kinesis Data Streams as the ingestion point. Use a Lambda function to read from the stream, write to S3, and send data to Kinesis Data Analytics.

Answer

Use two Kinesis Data Streams: one for S3 delivery and one for Kinesis Data Analytics.

Question 8

A company is running a critical application that generates millions of small JSON files every hour in an S3 bucket. A data engineer needs to process these files in near real-time using AWS Glue. The engineer wants to minimize the latency between file arrival and Glue job start. Which TWO actions should the engineer take?

Accepted Answer

Pre-process the files to consolidate them into larger files before the Glue job runs.. Consolidating millions of small JSON files into larger files reduces the overhead of S3 LIST operations and minimizes the number of partitions Glue must scan. This directly lowers the latency between file arrival and job start, as Glue jobs are more efficient when processing fewer, larger files rather than many small files. Option D is correct because S3 event notifications can trigger a Lambda function that immediately starts the Glue job upon file arrival, enabling near real-time processing without polling or scheduled delays.

Answer

Increase the Glue job's batch window to 600 seconds.

Answer

Increase the number of DPUs for the Glue job to accelerate processing.

Question 9

A company has an S3 data lake with millions of objects. A data engineer needs to provide a daily report of objects that are not accessed for 90 days. The engineer must minimize cost and impact on performance. Which approach should be used?

Accepted Answer

Use S3 Storage Lens to generate a dashboard of object age and last access. S3 Storage Lens provides cost-effective analytics including last access date and object age, enabling identification of objects not accessed for 90 days without scanning all objects or incurring high costs. Option A is less suitable because S3 Inventory creates daily lists but requires additional Athena queries, adding complexity and cost. Option B is incorrect because S3 Select is designed for querying object content, not metadata; applying it to millions of objects would be highly inefficient and costly. Option C is incorrect because analyzing S3 server access logs would involve storing and querying large volumes of log data, which is costly and impacts performance, and it logs all requests rather than providing a direct last access timestamp.

Answer

Enable S3 Inventory and query with Athena

Answer

Use S3 Select on each object to check last access metadata

Answer

Analyze S3 server access logs to find objects not accessed

Question 10

A data engineer is designing a pipeline to ingest change data capture (CDC) events from an Amazon RDS for PostgreSQL database into Amazon S3. The CDC events are captured using AWS DMS. The data must be available for querying within 5 minutes of the change. Which approach meets these requirements?

Accepted Answer

Use AWS DMS to replicate data directly to S3 in near real-time.. AWS DMS supports continuous replication (change data capture) directly to Amazon S3 as a target endpoint. DMS can write CDC events to S3 in near real-time (typically seconds to minutes), meeting the 5-minute latency requirement without intermediate services. The data is stored in comma-separated value (CSV) or Parquet format, ready for querying via Athena or Glue.

Answer

Export the database to S3 using pg_dump and then use AWS Glue to load into S3 in Parquet format.

Answer

Use AWS DMS to replicate data to Amazon Redshift, then unload to S3.

Answer

Use AWS DMS to replicate data to an SQS queue, then process with Lambda to write to S3.

Question 11

A data engineer is setting up an Amazon Kinesis Data Firehose delivery stream to load data into Amazon Redshift. The data is coming from an application that produces JSON records. The engineer needs to transform the data to match the Redshift table schema. Which approach is the MOST cost-effective and requires the least operational overhead?

Accepted Answer

Configure a Lambda function in the Firehose delivery stream to transform records before delivery.. Kinesis Data Firehose natively supports invoking a Lambda function as a transformation step within the delivery stream. This allows the engineer to write a simple Lambda function that parses the incoming JSON records and transforms them to match the Redshift table schema, all without provisioning or managing any additional infrastructure. This approach is the most cost-effective (pay per invocation) and requires the least operational overhead since Firehose handles the orchestration, retries, and delivery to Redshift automatically.

Answer

Use AWS Glue as a transformation step between Firehose and Redshift, with a trigger on S3.

Answer

Use Kinesis Data Firehose with direct PUT to Redshift and rely on Redshift's COPY command to transform.

Answer

Use the Kinesis Client Library (KCL) to consume the stream, transform in an EC2 instance, and then load to Redshift.

Question 12

A company is using Amazon EMR to run Spark jobs. The jobs are failing due to memory issues. Which THREE configurations can help mitigate out-of-memory errors?

Accepted Answer

Tune Spark memory configurations like spark.executor.memory and spark.memory.fraction.. The correct options are C, D, and E. Tuning Spark memory configurations (C) such as spark.executor.memory and spark.memory.fraction directly controls memory allocation within executors. Increasing the instance type to one with more memory per node (D) provides additional physical memory for Spark workloads. Enabling Spark dynamic allocation (E) allows the cluster to automatically adjust the number of executors based on workload, which helps prevent memory pressure from over-allocation. Option A is incorrect because instance store volumes are used for temporary data storage (e.g., shuffle spills) but do not address memory constraints; they may help with disk I/O but not OOM errors. Option B is incorrect because increasing vCPUs increases parallelism, which can actually worsen memory contention if each task consumes significant memory, potentially leading to more OOM errors.

Answer

Configure instance store volumes for intermediate shuffle data.

Answer

Use instances with more vCPUs to process more tasks in parallel.

Question 13

A company runs an Amazon DynamoDB table with on-demand capacity. A new reporting application performs frequent Scan operations on the table, causing occasional 'ProvisionedThroughputExceededException' errors. The operations team needs to resolve this with minimal cost. What should they do?

Accepted Answer

Create a global secondary index (GSI) on the attributes used in the reporting queries.. Creating a global secondary index (GSI) on the attributes used in the reporting queries allows the reporting application to use Query operations instead of expensive Scan operations. This reduces the read capacity consumption and avoids partition-level throttling, which is the cause of the 'ProvisionedThroughputExceededException' errors. On-demand tables have per-partition throughput limits, and frequent Scans can exceed those limits. Option A is incorrect because increasing the maximum read capacity via AWS Support is not applicable to on-demand tables; on-demand scaling is automatic but per-partition limits still apply. Option B is incorrect because switching to provisioned capacity would require careful capacity planning and would likely increase costs compared to using a GSI. Option C is incorrect because DAX can cache data and reduce read load, but it does not eliminate the inefficiency of Scan operations; the root cause is the Scan itself, which can be avoided by using a GSI to enable efficient queries.

Answer

Increase the table's maximum read capacity by requesting a limit increase from AWS Support.

Answer

Switch the table to provisioned capacity and increase the read capacity units.

Answer

Enable DynamoDB Accelerator (DAX) to cache the Scan results.

Question 14

A company needs to ingest data from a self-managed Apache Kafka cluster running on EC2 into Amazon S3. The data must be delivered in near real-time. Which AWS service is BEST suited for this task?

Accepted Answer

Use an AWS Glue streaming ETL job that reads from the Kafka cluster and writes to S3.. AWS Glue streaming ETL jobs can connect directly to an Apache Kafka cluster (including self-managed) as a source and write data to Amazon S3 in near real-time, making it a fully managed and suitable solution. Option A (Amazon MSK) is a managed Kafka service but does not directly ingest into S3; Option B (S3 Transfer Acceleration) only accelerates uploads, not ingestion; Option C (Kinesis Data Streams) adds unnecessary complexity as an intermediary.

Answer

Use Amazon MSK to replicate the Kafka cluster and then use a connector to S3.

Answer

Use Amazon S3 Transfer Acceleration to speed up the transfer from Kafka brokers to S3.

Answer

Use Amazon Kinesis Data Streams as an intermediary to buffer data before writing to S3.

Question 15

A company stores sensitive data in S3 and uses VPC endpoints to access the bucket. They need to ensure that only traffic from their VPC can access the data, and that the traffic cannot leave the AWS network. Which combination of bucket policy and endpoint policy should they use?

Accepted Answer

Use an S3 VPC Gateway endpoint and add a bucket policy with aws:SourceVpc condition. Using an S3 VPC Gateway endpoint with a bucket policy that includes the aws:SourceVpc condition restricts access to traffic originating from the specified VPC, and Gateway endpoints use AWS private network, ensuring traffic does not leave the AWS network. Option A is incorrect because aws:SourceIp checks IP addresses, not VPC origin, so it cannot enforce VPC-only access. Option C is incorrect because VPC Interface endpoints, while private, rely on aws:SourceVpce condition which checks the specific endpoint ID rather than the VPC; the requirement is to restrict to the entire VPC. Option D is incorrect because without any bucket policy, the bucket would be publicly accessible or accessible to any authenticated user, failing to restrict to the VPC.

Answer

Use only a bucket policy with aws:SourceIp condition

Answer

Use an S3 VPC Interface endpoint and add a bucket policy with aws:SourceVpce condition

Answer

Use an S3 VPC Gateway endpoint with no bucket policy

Question 16

A data engineer is designing a data lake on Amazon S3 that will be accessed by multiple AWS Glue ETL jobs. The engineer needs to ensure that the data is organized efficiently for querying and that sensitive columns are masked for certain users. Which TWO actions should the engineer take? (Choose TWO.)

Accepted Answer

Use AWS Lake Formation to define column-level permissions for sensitive data.. AWS Lake Formation provides fine-grained access control at the column level, allowing you to mask or restrict sensitive columns (e.g., PII) for specific IAM roles or users without altering the underlying data in S3. This is achieved through Lake Formation’s column-level permissions and data filtering, which integrate directly with the AWS Glue Data Catalog and query engines like Athena and Redshift Spectrum.

Answer

Configure AWS Glue Data Catalog to automatically mask sensitive columns in table definitions.

Answer

Use S3 object tags to label sensitive data and apply bucket policies to restrict access.

Answer

Implement S3 lifecycle policies to transition sensitive data to S3 Glacier after 30 days.

Question 17

The exhibit shows a build log from AWS CodeBuild. The build fails with a permission error when trying to open the downloaded file. What is the most likely cause?

Accepted Answer

The downloaded file has restrictive permissions that the python process cannot read.. The build log shows a permission error when the Python script attempts to open the downloaded file. This typically occurs because the file was downloaded with restrictive permissions (e.g., 600 or 700) that only allow the file owner (likely root) to read it. In AWS CodeBuild, if the Python script runs as a non-root user (or even as root but the file is owned by another user with no read permissions), it cannot access the file. Option C correctly identifies this scenario, while other options are less likely: the S3 bucket policy would affect the download itself, not the open operation; PATH issues relate to command execution, not file reading; encryption would likely produce a different error message.

Answer

The S3 bucket policy denies access to the object.

Answer

The python script is not in the PATH.

Answer

The file is encrypted and cannot be decrypted.

Question 18

A data engineer is setting up an Amazon S3 bucket for storing sensitive financial data. The compliance team requires that all data be encrypted at rest using a customer-managed AWS KMS key. Additionally, the bucket must block public access. Which combination of settings should the engineer configure?

Accepted Answer

Enable default encryption with AWS-KMS and a customer managed key. Enable block public access settings.. Enabling default encryption with AWS-KMS using a customer-managed key ensures that all objects uploaded to the S3 bucket are automatically encrypted at rest with the required key type. Additionally, enabling block public access settings prevents any public access to the bucket, satisfying the compliance team's requirements.

Answer

Use S3 Object Ownership to enforce bucket owner enforced. Enable block public access.

Answer

Use S3 Bucket Keys to reduce KMS costs. Enable block public access.

Answer

Create a bucket policy that denies PutObject without encryption. Enable block public access.

Question 19

A data engineer is designing a data pipeline that ingests millions of small JSON files (1-10 KB each) from an S3 bucket into Amazon Redshift. The current approach uses a Lambda function triggered by S3 events to call the Redshift COPY command for each file. This is causing high latency and throttling. Which alternative is MOST cost-effective and efficient?

Accepted Answer

Use Amazon Kinesis Data Firehose to buffer and write larger files to S3, then use a scheduled COPY command. Amazon Kinesis Data Firehose can buffer the incoming small JSON files from S3 (via S3 event notifications) and write larger aggregated files to S3. A scheduled COPY command then efficiently loads these larger files into Amazon Redshift, reducing the number of COPY operations and avoiding Lambda throttling. This approach is cost-effective as Firehose charges only for data volume processed, and it eliminates the need for custom batching logic. Other options either process files individually (A, C) or incur higher costs with AWS Glue (D).

Answer

Use Amazon Kinesis Data Streams and a consumer to batch files before COPY

Answer

Increase the Lambda concurrency limit and memory

Answer

Use AWS Glue to merge files into larger Parquet files before loading

Question 20

A startup uses Amazon S3 to store user-uploaded images. The images are accessed frequently for the first week after upload, but after that they are rarely accessed. The company wants to optimize storage costs without compromising availability. The data engineer must implement a lifecycle policy to transition objects to a more cost-effective storage class after 30 days. The objects must be retrievable within minutes. Which storage class should the engineer transition the objects to?

Accepted Answer

S3 Standard-Infrequent Access. S3 Standard-Infrequent Access (S3 Standard-IA) is the correct choice because it offers a per-GB storage cost lower than S3 Standard while maintaining high durability (99.999999999%) and availability (99.9%), with retrieval times in milliseconds. The lifecycle policy transitions objects after 30 days, aligning with the access pattern where images are rarely accessed after the first week, and the requirement for retrieval within minutes is satisfied by S3 Standard-IA's instant access.

Answer

S3 One Zone-Infrequent Access

Answer

S3 Standard

Answer

S3 Glacier Instant Retrieval