DEA-C01 Practice Exam 54 — 20 Questions

Question 1

A company has multiple AWS accounts and wants to centrally manage permissions and access to data lakes. They have enabled AWS Organizations and want to use a single set of policies that apply to all accounts. Which policy type should be used at the organization level?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Service control policies (SCPs). Service Control Policies (SCPs) are used in AWS Organizations to centrally manage permissions across accounts. Option A (IAM policies) are attached to IAM users/roles within an account, not across accounts. Option B (KMS key policies) control access to KMS keys. Option C (S3 bucket policies) are specific to S3 buckets.

Answer

IAM policies

Answer

KMS key policies

Answer

S3 bucket policies

Question 2

A data pipeline uses Amazon Kinesis Data Firehose to deliver data to an Amazon S3 bucket. The delivery stream is configured with a buffer size of 5 MB and a buffer interval of 60 seconds. The team notices that the S3 objects are much smaller than 5 MB. What is the most likely explanation?

Accepted Answer

The incoming data volume is low, so the 60-second buffer interval triggers delivery before the 5 MB buffer is filled.. If the incoming data rate is low, the buffer interval (60 seconds) expires before the buffer size (5 MB) is reached, causing small objects. Option B is incorrect because S3 event notifications do not split objects; they are triggered by events but do not affect object size. Option C is incorrect because S3 lifecycle policies transition objects to Glacier, which does not affect object size during delivery. Option D is incorrect because GZIP compression reduces the object size after batching, but the buffer interval can still trigger delivery before the buffer is full, so it is not the most likely explanation.

Answer

The S3 bucket has event notifications that split the objects.

Answer

The S3 bucket has a lifecycle policy that transitions objects to Glacier.

Answer

The delivery stream is using GZIP compression, which reduces the object size.

Question 3

Refer to the exhibit. A data engineer applies the following S3 bucket policy to an S3 bucket. What does this policy enforce?

Accepted Answer

Requires that all objects uploaded to the bucket be encrypted with SSE-KMS. The bucket policy uses a Deny effect with a condition that checks if the s3:x-amz-server-side-encryption header is not 'aws:kms'. This means any PutObject request that does not use SSE-KMS will be denied. Therefore, the policy enforces that all objects uploaded must be encrypted with SSE-KMS. Option A is incorrect because the policy does not mention SSE-S3; it denies if not SSE-KMS. Option B is incorrect because it requires SSE-KMS, not SSE-S3. Option C is incorrect because the policy only allows SSE-KMS, not any type of server-side encryption. Option D is correct.

Answer

Denies all uploads unless SSE-S3 is used

Answer

Allows only SSE-S3 encrypted uploads

Answer

Allows any type of server-side encryption

Question 4

A data engineer wants to ensure that only users with a specific tag (e.g., "Department": "DataEngineering") can access an S3 bucket. How can this be enforced?

Accepted Answer

Use a bucket policy with aws:PrincipalTag condition. S3 bucket policies support condition keys like aws:PrincipalTag, which allow access control based on tags attached to IAM principals (users or roles). Option A is correct because it uses aws:PrincipalTag in the bucket policy to restrict access to users with the specific tag. Option B is incorrect because S3 object tags are for objects, not principals, and cannot be used to filter users. Option C is incorrect because attaching an IAM policy to each user is less scalable and does not leverage the bucket policy's centralized control. Option D is incorrect because S3 Object Lambda is for modifying data during retrieval, not for access control decisions.

Answer

Use S3 object tags and a bucket policy condition

Answer

Attach an IAM policy to each user with the tag

Answer

Use S3 Object Lambda to check user tags

Question 5

A data engineer is troubleshooting a Kinesis Data Streams application that is experiencing high latency. The stream has 2 shards. The application is using a single Kinesis Client Library (KCL) worker to process all shards. Which change will MOST likely reduce latency?

Accepted Answer

Deploy multiple KCL workers to process shards in parallel.. The application uses a single KCL worker to process all 2 shards, which processes records sequentially and causes high latency. Deploying multiple KCL workers (ideally one per shard) enables parallel processing of shards, significantly reducing latency. Option A is incorrect because increasing shard count to 4 adds more capacity but does not address the bottleneck of a single worker; the same worker would process all 4 shards sequentially, potentially worsening latency. Option C is incorrect because Kinesis Data Streams is a managed service; there is no instance type to change for the stream itself. The KCL worker runs on your compute resources, not on the stream. Option D is incorrect because decreasing shards to 1 reduces the level of parallelism, increasing the workload per shard and likely increasing latency further.

Answer

Increase the number of shards to 4.

Answer

Use a larger instance type for the Kinesis stream.

Answer

Decrease the number of shards to 1.

Question 6

A data engineer is responsible for a real-time data pipeline that ingests clickstream data from a website into Amazon Kinesis Data Streams, then processed by an AWS Lambda function that writes to an Amazon DynamoDB table for user session tracking. The Lambda function is idempotent and uses the DynamoDB PutItem API with a condition expression to avoid overwriting existing records. Over the past week, the engineer has observed an increase in DynamoDB write throttling (ProvisionedThroughputExceededException) during peak traffic hours. The DynamoDB table has on-demand capacity. The engineer checks the Lambda function's reserved concurrency and finds it set to 1000. The Kinesis stream has 10 shards. The Lambda function's batch size is set to 100. The engineer suspects that the retry behavior is causing duplicate writes and throttling. Which change should the engineer make to reduce throttling?

Accepted Answer

Decrease the Lambda batch size to 10 to reduce the number of records processed per invocation.. On-demand DynamoDB can scale, but it has a per-partition throughput limit. Reducing the Lambda batch size reduces the number of concurrent writes per shard, decreasing the chance of hitting partition limits. Option A is wrong because increasing shards would increase concurrency, worsening throttling. Option C is wrong because decreasing reserved concurrency could cause Lambda throttling but not DynamoDB throttling. Option D is wrong because using a DynamoDB stream adds complexity and does not directly reduce write throttling.

Answer

Increase the number of Kinesis shards to 20 to distribute the load.

Answer

Decrease the Lambda reserved concurrency to 500 to limit the number of concurrent invocations.

Answer

Use a DynamoDB Stream to trigger a second Lambda function that writes to the table.

Question 7

A company is running a critical Amazon RDS for MySQL database. They need to implement a backup strategy that allows point-in-time recovery (PITR) with a recovery time objective (RTO) of 15 minutes and a recovery point objective (RPO) of 5 minutes. Which solution meets these requirements?

Accepted Answer

Enable automated backups with 1-day retention and enable Multi-AZ deployment. Automated backups enable point-in-time recovery using transaction logs that record changes every 5 minutes, achieving an RPO of 5 minutes. Multi-AZ deployment provides automatic failover to a standby instance, achieving an RTO of typically 1-2 minutes, well within the 15-minute RTO. Option B is incorrect because cross-Region automated backups replicate data to another region, but the promotion of a replica in another region can take longer than 15 minutes, and replication lag may cause RPO to exceed 5 minutes. Option C is incorrect because manual snapshots are taken at specific points in time and do not include transaction logs; even if taken every 5 minutes, restoring from a snapshot would not provide point-in-time recovery to any point within those 5 minutes, and the restore time is typically longer than 15 minutes. Option D is incorrect because a Read Replica is an asynchronous copy; promoting a read replica to a primary instance can take several minutes, and the RPO may be higher due to replication lag, thus not meeting the 5-minute RPO or 15-minute RTO.

Answer

Use cross-Region automated backups and promote the replica

Answer

Take manual snapshots every 5 minutes and restore from the latest snapshot

Answer

Enable a Read Replica and promote it during a disaster

Question 8

A company is ingesting streaming data from multiple sources using Amazon Kinesis Data Streams. The data is then processed by an AWS Lambda function that transforms the records and writes them to an Amazon S3 bucket. The Lambda function is failing intermittently with timeout errors. The average record size is 5 KB, and the shard count is 2. What is the MOST likely cause of the timeout errors?

Accepted Answer

The Lambda function timeout is set too low for the processing time required.. The Lambda function is timing out, indicating that the configured timeout is insufficient for the actual processing time. Lambda has a default timeout of 3 seconds, but it can be set from 1 second to 15 minutes. If the transformation logic or S3 write operation takes longer than the configured timeout, the function will fail with a timeout error. Option B is incorrect because the Kinesis data retention period (default 24 hours) affects data availability, not Lambda execution time. Option C is incorrect because reserved concurrency controls the number of concurrent invocations and can cause throttling, not timeouts. Option D is incorrect because with an average record size of 5 KB, even the default batch size of 100 records results in only 500 KB per invocation, well below the 6 MB payload limit.

Answer

The Kinesis data retention period is too short, causing data to be lost before processing.

Answer

The Lambda function's reserved concurrency is set too low, causing throttling.

Answer

The Lambda function is receiving too many records per invocation, exceeding the 6 MB payload limit.

Question 9

A company uses Amazon S3 to store raw data and needs to transform it into Parquet format for analytics. The transformation job runs daily on a schedule. Which AWS service is BEST suited for this task?

Accepted Answer

AWS Glue. AWS Glue is a fully managed, serverless ETL service that can automatically convert data formats (e.g., from CSV to Parquet) and run on a schedule (e.g., daily). It is ideal for this use case because it is purpose-built for ETL transformations and handles schema discovery, data cataloging, and job scheduling without managing infrastructure. Option A (Amazon Redshift) is wrong because Redshift is a data warehouse for querying, not a transformation service; it could load Parquet but not convert raw data to Parquet directly. Option B (Amazon EMR) is wrong because EMR requires provisioning and managing clusters, adding operational overhead. Option C (AWS Lambda) is wrong because Lambda has a maximum execution timeout of 15 minutes, which is too short for daily large-scale data transformation jobs.

Answer

Amazon Redshift

Answer

Amazon EMR

Answer

AWS Lambda

Question 10

A data engineer needs to store semi-structured JSON data that is accessed infrequently but must be retrievable within minutes. The data is generated by IoT devices and each object is about 500 KB. The engineer wants the most cost-effective storage solution. Which AWS service should be used?

Accepted Answer

Amazon S3 Standard-Infrequent Access (S3 Standard-IA). Amazon S3 Standard-Infrequent Access (S3 Standard-IA) is the correct choice because it is designed for data that is accessed infrequently but requires rapid retrieval (within minutes). The 500 KB JSON objects from IoT devices fit the use case, and S3 Standard-IA offers lower storage costs than S3 Standard while maintaining the same low-latency retrieval performance, making it the most cost-effective option for this scenario.

Answer

Amazon S3 Glacier Deep Archive

Answer

Amazon S3 Standard

Answer

Amazon Elastic Block Store (EBS)

Question 11

A data engineer is using AWS DMS to migrate a 2 TB Oracle database to Amazon Aurora PostgreSQL. The migration is running in full load mode with ongoing replication. After the full load completes, the ongoing replication task shows a 'TargetMetadata' error: 'ERROR:  duplicate key value violates unique constraint'. The engineer verifies that the target table already contains the data. What should the engineer do to resolve this issue?

Accepted Answer

Enable 'BatchApplyEnabled' and set 'TaskRecoveryTableEnabled' to false in the task settings.. Enabling 'BatchApplyEnabled' allows DMS to batch changes and reduces duplicate key errors, while setting 'TaskRecoveryTableEnabled' to false prevents recovery attempts that can reapply already committed transactions. Option B is wrong because disabling constraints compromises data integrity. Option C is wrong because truncating and restarting loses existing data and does not address the ongoing replication issue. Option D is wrong because dropping indexes does not prevent duplicate key violations.

Answer

Disable the unique constraint on the target table.

Answer

Truncate the target table and restart the full load.

Answer

Drop the indexes on the target table and recreate them after the migration.

Question 12

A data engineer is troubleshooting an AWS Glue ETL job that fails with an 'Access Denied' error when trying to write to an S3 bucket. The IAM role used by the job has the policy shown in the exhibit. The bucket 'my-bucket' uses S3 default encryption with AWS KMS. What is the most likely missing permission?

Accepted Answer

kms:GenerateDataKey and kms:Decrypt. When an S3 bucket uses AWS KMS for default encryption, any write operation requires the IAM role to have kms:GenerateDataKey and kms:Decrypt permissions on the KMS key. The policy in the exhibit grants s3:PutObject but does not include any KMS actions, resulting in an 'Access Denied' error. Option A (s3:GetObjectVersion) is not needed for writing. Option B (glue:GetObject) is not a valid AWS action. Option C (s3:ListBucketMultipartUploads) is not required for a write operation. Option D (s3:PutObjectAcl) is unnecessary unless the job explicitly sets ACLs.

Answer

s3:GetObjectVersion

Answer

glue:GetObject

Answer

s3:ListBucketMultipartUploads

Answer

s3:PutObjectAcl

Question 13

A data engineer is monitoring an AWS Glue ETL job that processes data from Amazon DynamoDB to Amazon S3. The job is taking longer than expected. The engineer suspects that the job's parallelism is not optimal. Which THREE actions can improve the job's performance? (Choose THREE.)

Accepted Answer

Enable the 'groupFiles' option in the S3 sink to coalesce small files.. Enabling 'groupFiles' in the S3 sink coalesces small files into larger ones, reducing the number of write operations and improving write performance. Option C is correct because increasing MaxCapacity (DPU) allocates more processing units, increasing parallelism and processing speed. Option E is correct because increasing 'dynamodb.throughput.read.percentage' allocates a higher percentage of the table's provisioned read capacity to the Glue job, allowing more parallel reads from DynamoDB. Option B is incorrect because decreasing 'dynamodb.splits' reduces the number of parallel readers, which can lower parallelism and slow down the job. Option D is incorrect because disabling job bookmarks results in reprocessing all data each run, which increases processing time and does not improve performance.

Answer

Decrease the 'dynamodb.splits' parameter to reduce the number of parallel readers.

Answer

Disable job bookmark to avoid storing metadata.

Question 14

A data engineer is designing a pipeline to ingest daily CSV files from an SFTP server into Amazon S3. The files are large (up to 10 GB) and must be encrypted in transit. The pipeline should be fully managed and serverless where possible. Which TWO services should be used together to achieve this? (Choose TWO.)

Accepted Answer

AWS Glue. Options C and D are correct. AWS Transfer Family provides a fully managed SFTP service that can transfer files directly to S3 with encryption in transit, meeting the requirement for serverless, managed file ingestion. AWS Glue can then be used to process the CSV files in S3, as it is a serverless ETL service suitable for batch processing large files. Option A (Kinesis Data Firehose) is for streaming data, not batch file transfers. Option B (Lambda) has a 15-minute timeout and is not ideal for large files up to 10 GB. Option E (Athena) is a query service, not a transfer or processing service.

Answer

Amazon Kinesis Data Firehose

Answer

AWS Lambda

Answer

Amazon Athena

Question 15

Which TWO AWS services can be used to automatically back up an Amazon RDS for SQL Server DB instance? (Choose TWO.)

Accepted Answer

Amazon RDS automated backups. Amazon RDS automated backups are a built-in feature of RDS that automatically creates daily snapshots of the DB instance and backs up transaction logs every 5 minutes, enabling point-in-time recovery to any second within the retention period. This is the native, no-cost mechanism for backing up an RDS for SQL Server DB instance without additional configuration beyond setting the backup retention window.

Answer

AWS Database Migration Service (DMS)

Answer

AWS Data Pipeline

Answer

Amazon S3

Question 16

An e-commerce company wants to capture clickstream data from its website and store it in Amazon S3 for analytics. The data arrives continuously and the company needs near-real-time processing. Which solution is most appropriate?

Accepted Answer

Amazon Kinesis Data Firehose. Amazon Kinesis Data Firehose is the most appropriate solution because it is a fully managed service designed to ingest streaming data and deliver it to destinations like Amazon S3 with near-real-time latency. The company needs continuous clickstream capture and near-real-time processing, which Firehose provides. Option A (AWS Data Pipeline) is for batch processing, not streaming. Option B (AWS Snowball Edge) is for offline data transfer, not real-time. Option D (S3 Transfer Acceleration) improves upload speed but is not a streaming ingestion service.

Answer

AWS Data Pipeline

Answer

AWS Snowball Edge

Answer

Amazon S3 Transfer Acceleration

Question 17

A company uses Amazon DynamoDB as its primary data store for a web application. The application experiences high latency during peak hours. The data engineer notices that the table has a large number of items with the same partition key. Which DynamoDB feature should the engineer use to improve performance?

Accepted Answer

Redesign the partition key to use a composite key that includes a timestamp or random suffix.. The high latency is caused by a hot partition, where many items share the same partition key, overwhelming a single DynamoDB partition. Redesigning the partition key to include a timestamp or random suffix distributes the workload evenly across partitions, improving throughput and reducing latency. This directly addresses the root cause of the performance issue.

Answer

Enable DynamoDB Accelerator (DAX) to cache read requests.

Answer

Create a global table to replicate data across multiple Regions.

Answer

Enable auto scaling on the table to increase write capacity.

Question 18

Which TWO actions can help improve query performance in Amazon Redshift? (Choose two.)

Accepted Answer

Use appropriate sort keys for tables.. Defining appropriate sort keys in Amazon Redshift enables the query optimizer to use zone maps to skip irrelevant data blocks during table scans, significantly reducing the amount of data read from disk. Sort keys also improve the effectiveness of merge joins and the performance of range-restricted queries by physically co-locating rows with similar sort key values on disk.

Answer

Disable SSL encryption for connections.

Answer

Use VARCHAR instead of CHAR for fixed-length strings.

Answer

Increase the number of nodes in the cluster.

Question 19

A company uses Redshift for analytics. The security team requires that all queries be logged and that any access to sensitive columns be blocked for non-admin users. Which combination of features should the data engineer implement?

Accepted Answer

Enable Redshift audit logging and create views that expose only non-sensitive columns, granting access to views.. Redshift audit logging captures all queries, and creating views that expose only non-sensitive columns with access granted to those views enforces column-level access control for non-admin users. Option B is incorrect because row-level security is not supported in Redshift, and CloudTrail logging alone does not block access. Option C is incorrect because CloudWatch Logs do not control access; they only provide monitoring. Option D is incorrect because IAM policies cannot restrict access to specific columns in Redshift.

Answer

Use Redshift row-level security and enable CloudTrail logging.

Answer

Enable CloudWatch Logs for Redshift and use IAM conditions to block sensitive columns.

Answer

Enable Redshift audit logging and use IAM policies to restrict column access.

Question 20

Which THREE factors should a data engineer consider when choosing between AWS Glue and Amazon EMR for a data transformation job? (Choose three.)

Accepted Answer

The level of control over the execution environment and dependencies. When choosing between AWS Glue and Amazon EMR for a data transformation job, key considerations include: the level of control over the execution environment (EMR offers more customization, while Glue is managed), the deployment model (Glue is serverless, EMR is cluster-based), and the cost structure (Glue charges per DPU, EMR charges per EC2 instance). Options A and B are not differentiating factors because both services support Apache Spark and can output to S3.

Answer

The ability to output results to Amazon S3

Answer

The support for Apache Spark