DEA-C01 Practice Exam 55 — 20 Questions

Question 1

A company stores sensitive customer data in an Amazon S3 bucket. The security team requires that all data be encrypted at rest using server-side encryption with AWS KMS managed keys (SSE-KMS). Additionally, they want to ensure that the encryption context is enforced for all PutObject requests. Which THREE steps should be taken to meet these requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Set the default encryption on the bucket to SSE-KMS with the desired KMS key.. To enforce SSE-KMS and encryption context, three steps are needed. First, set default encryption on the bucket to SSE-KMS with the desired KMS key (A). Second, add a bucket policy that requires the s3:x-amz-server-side-encryption-aws-kms-key-id header and the kms:EncryptionContext condition key (B). Third, ensure the IAM role used by applications has kms:GenerateDataKey and kms:Decrypt permissions for the KMS key (E). Option C (SSE-C) is incorrect because it uses a customer-provided key, not KMS. Option D (versioning) does not enforce encryption context.

Answer

Configure the bucket to use SSE-C and provide the encryption key.

Answer

Enable S3 Versioning on the bucket.

Question 2

Refer to the exhibit. A data engineer runs this AWS CLI command to create a Glue job. The job processes JSON files in an S3 bucket and writes Parquet files to another bucket. After the first successful run, the job re-processes all input files instead of only new files. What is the most likely cause?

Accepted Answer

The job script does not implement job bookmark support.. The command sets '--job-bookmark-enable' but if the job script does not use the bookmark APIs or implement bookmark support, Glue will not track processed files and will reprocess all input on each run. Option A is incorrect because the ScriptLocation is valid and does not affect bookmark behavior. Option B is incorrect because max-retries does not control reprocessing. Option D is incorrect because the IAM role is specified and permissions for bookmark state are not explicitly shown, but the lack of bookmark support in the script is the issue.

Answer

The ScriptLocation points to an incorrect S3 path.

Answer

The --max-retries parameter is set to 0.

Answer

The IAM role lacks permissions to read bookmark state.

Question 3

An organization uses AWS Lake Formation to manage a data lake in S3. A new data engineer needs to create a Glue ETL job that reads from a Lake Formation-managed table. The engineer has been granted SELECT permission on the table via Lake Formation. However, the job fails with an AccessDenied error. What is the MOST likely cause?

Accepted Answer

The IAM role used by the Glue job does not have Lake Formation permissions.. The IAM role used by the Glue job must have Lake Formation permissions (such as lakeformation:GetDataAccess) to access the table. Without these permissions, the job will fail with an AccessDenied error even if the S3 bucket policy allows access. Option B is incorrect: S3 bucket policies are not the primary issue because Lake Formation manages fine-grained access; the role must have Lake Formation permissions. Option C is incorrect: the table is already registered with Lake Formation if it is a Lake Formation-managed table; registration is a prerequisite for granting permissions. Option D is incorrect: Lake Formation does not require a specific VPC; Glue jobs can access Lake Formation over the internet or via a VPC endpoint, but that is not the cause of the AccessDenied error.

Answer

The S3 bucket policy does not allow the Glue job to access the data.

Answer

The table has not been registered with Lake Formation.

Answer

The Glue job is not running in the same VPC as Lake Formation.

Question 4

A company runs an e-commerce platform that generates clickstream data from millions of users. The data is ingested into Amazon Kinesis Data Streams with a shard count of 10. The data is then consumed by a Kinesis Data Analytics application that runs SQL queries to aggregate metrics in real time. Recently, the application has been falling behind, and the stream's iterator age metric is increasing. The data volume has doubled over the past month. The application currently uses a single Kinesis Data Analytics application with parallelism of 1. Which action should the data engineer take to improve the processing rate and reduce the iterator age without losing data or causing duplicates?

Accepted Answer

Increase the parallelism of the Kinesis Data Analytics application to match the number of shards.. Kinesis Data Analytics (KDA) processes data from each shard in a stream using one or more parallel operators. With a parallelism of 1, the application uses only a single processing thread, which cannot keep up with the doubled data volume across 10 shards. By increasing parallelism to match the shard count (10), KDA can read from all shards concurrently, distributing the processing load and reducing the iterator age without data loss or duplicates, as KDA manages checkpointing and exactly-once semantics internally.

Answer

Change the Kinesis Data Analytics application to use a Kinesis Data Firehose delivery stream as the source.

Answer

Reduce the retention period of the Kinesis Data Streams to 24 hours.

Answer

Increase the number of shards in the Kinesis Data Streams to 20.

Question 5

A data engineer needs to ingest data from an on-premises Oracle database into Amazon S3 using AWS DMS. The change data capture (CDC) must be enabled to capture ongoing changes. Which additional AWS service is required to store the transaction logs for CDC?

Accepted Answer

Amazon S3. AWS DMS change data capture (CDC) for Oracle databases does not require an additional AWS service to store transaction logs. DMS reads the redo logs directly from the source Oracle database, either using LogMiner or binary reader. Therefore, none of the listed services are needed for storing transaction logs. As none of the provided options are correct, this question contains no valid answer.

Answer

Amazon RDS

Answer

Amazon EBS

Answer

Amazon CloudWatch Logs

Question 6

A data engineer is troubleshooting an AWS Glue ETL job that fails with an OutOfMemory error when processing large JSON files from Amazon S3. The files contain deeply nested structures. Which approach should the engineer take to resolve this issue?

Accepted Answer

Increase the DPU (Data Processing Unit) per worker. Increasing the DPU per worker allocates more memory per worker, directly addressing the OutOfMemory error when processing large files. Option A is incorrect because the `recurse` option is not a valid argument for `getResolvedOptions`, which is used for retrieving job parameters. Option B is incorrect because increasing the number of workers adds parallelism but does not increase memory per worker; OOM occurs per worker. Option D is incorrect because decreasing partitions reduces parallelism, potentially causing each partition to be larger, worsening the memory issue.

Answer

Use the `recurse` option with `getResolvedOptions` to limit recursion

Answer

Increase the number of workers in the Glue job configuration

Answer

Decrease the number of partitions while reading the data

Question 7

A company has an AWS Glue ETL job that reads from an RDS MySQL instance and writes to S3. The security team requires that the connection to RDS be encrypted and that credentials be rotated automatically. Which configuration should be used?

Accepted Answer

Store the password in AWS Secrets Manager with automatic rotation enabled and configure Glue to use SSL for the connection.. AWS Secrets Manager provides automatic rotation of RDS credentials, and AWS Glue can be configured to use SSL for an encrypted connection to RDS MySQL. Option A (Systems Manager Parameter Store) stores encrypted parameters but does not natively support automatic rotation of RDS credentials. Option B (IAM database authentication) provides authentication but does not encrypt the connection itself; SSL is still required for encryption. Option C (encrypted S3 bucket) is not a service designed for dynamic credential management and lacks automatic rotation.

Answer

Store the database password in an encrypted parameter in Systems Manager Parameter Store and enable SSL for the connection.

Answer

Use IAM database authentication for RDS and store credentials in Glue connection properties.

Answer

Store the password in a text file in an encrypted S3 bucket and use SSL.

Question 8

A company uses AWS Lake Formation to manage permissions on a data lake. A data engineer creates a table in the Data Catalog and grants SELECT permission to a group of analysts. The analysts report they can see the table but get an AccessDenied error when querying it with Amazon Athena. What is the most likely cause?

Accepted Answer

The analysts' IAM role does not have permission to call the Athena API.. The analysts can see the table in the Data Catalog but receive an AccessDenied error when querying with Athena. This indicates that Lake Formation has granted SELECT permission on the table, so the table is visible and the permission exists. The error occurs when Athena attempts to run the query, meaning the IAM role used by Athena (which is the analysts' role or a service role) lacks permission to call the Athena API (e.g., StartQueryExecution, GetQueryResults). Lake Formation permissions cover Data Catalog and S3 access, but do not grant IAM permissions for Athena itself. Therefore, Option A is the most likely cause. Option B is incorrect because the table is visible, so it is registered. Option C is incorrect because the workgroup result location issue would produce a different error (e.g., insufficient permissions on S3). Option D is incorrect because Lake Formation manages S3 access via registered locations, and if the table is registered, the bucket policy is overridden by Lake Formation permissions.

Answer

The table is not registered with Lake Formation as a resource.

Answer

The Athena workgroup is configured with a per-query result location that the analysts cannot write to.

Answer

The S3 bucket policy does not allow the analysts' IAM role.

Question 9

A data engineer is designing a streaming pipeline using Amazon Kinesis Data Streams. The data must be transformed in real-time and then stored in Amazon S3 for long-term retention. Which THREE services can be used together to achieve this?

Accepted Answer

Amazon Kinesis Data Analytics. Options A, B, and E are correct: Kinesis Data Streams ingests data, Kinesis Data Analytics performs real-time transformations, and Kinesis Data Firehose delivers the transformed data to S3. Option C (AWS Glue) is a batch ETL service, not suitable for real-time streaming. Option D (Amazon Athena) is a query service, not for data ingestion or transformation in a streaming pipeline.

Answer

AWS Glue

Answer

Amazon Athena

Question 10

Which TWO actions can improve the performance of an AWS Glue ETL job that processes large datasets in Amazon S3? (Choose two.)

Accepted Answer

Increase the number of DPUs allocated to the job.. Increasing the number of DPUs allocates more processing power to the Glue job, which can speed up data processing for large datasets. Option D is correct because columnar file formats like Parquet or ORC are more efficient for analytical queries, reduce I/O, and allow better compression compared to row-based formats. Option A is incorrect: increasing crawler frequency only affects the metadata catalog update frequency, not the ETL job performance. Option B is incorrect: using a single Availability Zone for the S3 bucket does not improve performance and may reduce availability. Option E is incorrect: using a single large file can reduce parallelism, as distributed processing benefits from splitting data into multiple files to be processed in parallel by different executors.

Answer

Increase the frequency of the Glue crawler.

Answer

Use a single Availability Zone for the S3 bucket.

Answer

Use a single large file instead of many small files.

Question 11

A team manages an Amazon DynamoDB table with on-demand capacity. Recently, they noticed increased throttling errors during peak hours. The table has a Lambda trigger that processes changes and writes to an S3 bucket. Which design change would BEST reduce throttling?

Accepted Answer

Implement DynamoDB Accelerator (DAX) to cache frequent reads.. DynamoDB Accelerator (DAX) provides an in-memory cache that reduces the number of read requests hitting the table, which can alleviate throttling during peak hours. The question describes throttling errors, which are typically caused by exceeding the table's read or write capacity; DAX offloads read traffic, reducing the load on the table and thus decreasing throttling events.

Answer

Switch the table to provisioned capacity and enable auto-scaling.

Answer

Increase the write capacity units to handle the peak load.

Answer

Enable S3 bucket versioning to reduce the number of writes.

Question 12

A company needs to ingest real-time sensor data from thousands of IoT devices into Amazon S3, with a latency of less than 1 minute. The data must be transformed (e.g., convert to Parquet) before landing in S3. Which combination of services is MOST cost-effective?

Accepted Answer

Amazon Kinesis Data Streams to Amazon Kinesis Data Firehose to S3.. The most cost-effective because Amazon Kinesis Data Firehose directly ingests data from Kinesis Data Streams, can perform transformations (e.g., convert to Parquet) using built-in or Lambda functions, and delivers to S3 with low latency (under 1 minute). Option A is incorrect because AWS Lambda, while capable of transformation, does not scale cost-effectively for thousands of devices due to per-invocation costs and concurrency limits. Option B is incorrect because Kinesis Data Analytics is designed for complex stream processing with SQL, not simple transformations, and adds unnecessary cost. Option C is incorrect because AWS Glue streaming ETL is more suited for near-real-time batch processing and can incur higher costs and latency for high-throughput ingestion.

Answer

Amazon Kinesis Data Streams to AWS Lambda to S3.

Answer

Amazon Kinesis Data Streams to Amazon Kinesis Data Analytics to S3.

Answer

Amazon Kinesis Data Streams to AWS Glue streaming ETL to S3.

Question 13

A company uses Amazon RDS for PostgreSQL with encryption at rest using AWS KMS. The company needs to share a database snapshot with a different AWS account. What must be done to allow the target account to restore the snapshot?

Accepted Answer

Share the snapshot and update the KMS key policy to allow the target account to use the key. Cross-account snapshot sharing of an encrypted snapshot requires both sharing the snapshot and granting the target account permission to use the KMS key via the key policy. Option A is incorrect because copying does not grant the necessary key access. Option B is incorrect because IAM roles are not used for this purpose; KMS key policies are the mechanism for cross-account access. Option D is incorrect because encryption cannot be disabled on an existing encrypted snapshot.

Answer

Copy the snapshot to the target account's region and share it

Answer

Create an IAM role in the source account that allows cross-account snapshot access

Answer

Disable encryption on the snapshot before sharing

Question 14

A company streams clickstream data from websites to Amazon Kinesis Data Streams. A Lambda function processes each record and writes it to Amazon S3. Recently, the function has been timing out under high load. Which solution should a data engineer implement to handle the increased throughput?

Accepted Answer

Increase the number of shards in the Kinesis data stream.. Increasing the number of shards in the Kinesis data stream increases the level of parallelism. Each shard can be processed by a separate Lambda invocation, allowing more concurrent processing of records. This directly addresses the high load and timeout issue. Option A is incorrect because increasing the timeout does not increase throughput; it only allows the function to run longer, but under high load it will still timeout. Option C is incorrect because increasing memory may improve performance per invocation but does not increase the number of concurrent invocations; the bottleneck is limited by the number of shards. Option D is incorrect because S3 Event Notifications are for object creation events in S3, not for real-time streaming; they do not help with Kinesis ingestion.

Answer

Increase the Lambda function's timeout value.

Answer

Increase the memory allocated to the Lambda function.

Answer

Configure Amazon S3 Event Notifications to trigger Lambda directly.

Question 15

A company is using Amazon Kinesis Data Streams with a Lambda consumer to process real-time events. The Lambda function is triggered by a DynamoDB stream to update a counter. Recently, the counter has been inaccurate due to duplicate processing. What is the most likely cause?

Accepted Answer

The Lambda function is not idempotent and is being retried on failures. The Lambda function is invoked at least once per record in the DynamoDB stream. If the function fails or times out, it may be retried, processing the same record again. If the function is not idempotent, this retry leads to duplicate updates to the counter. Option A is incorrect because TRIM_HORIZON is a Kinesis iterator type, not relevant to DynamoDB streams. Option B is incorrect because low reserved concurrency would cause throttling, not duplicate processing. Option D is incorrect because shard rebalancing occurs in Kinesis, not DynamoDB streams, and does not cause duplicates.

Answer

The DynamoDB stream is configured with 'TRIM_HORIZON' iterator type

Answer

The Lambda function's reserved concurrency is too low

Answer

The Kinesis stream has undergone a shard rebalance

Question 16

A company has an AWS Glue ETL job that reads data from an S3 bucket encrypted with SSE-S3. The job runs successfully, but the output written to another S3 bucket with SSE-KMS fails. The IAM role for the Glue job has s3:PutObject and kms:GenerateDataKey permissions. What is the most likely cause?

Accepted Answer

The IAM role is missing kms:Encrypt permission. For SSE-KMS, the IAM role needs both kms:GenerateDataKey and kms:Encrypt permissions to write objects. The role already has kms:GenerateDataKey, but missing kms:Encrypt causes the write to fail. Option A is correct. Option B is incorrect because if the bucket policy denied s3:PutObject, the job would fail on the PutObject action itself, not on encryption. Option C is incorrect because the role already has kms:GenerateDataKey; the missing permission is kms:Encrypt. Option D is incorrect because the source bucket's encryption (SSE-S3) is irrelevant to the write operation; the error occurs on the target bucket with SSE-KMS.

Answer

The target S3 bucket policy denies s3:PutObject

Answer

The KMS key policy does not grant the Glue role kms:GenerateDataKey

Answer

The source bucket's encryption type is incompatible with the target

Question 17

A company is using Amazon Kinesis Data Firehose to ingest data into Amazon S3. The data must be transformed from JSON to Parquet format before delivery. Which feature should be enabled on the Firehose delivery stream?

Accepted Answer

Format conversion (Parquet/ORC). Amazon Kinesis Data Firehose has a built-in format conversion feature that can automatically convert input data from JSON to Parquet or ORC format before delivery to Amazon S3. Option A (Amazon Kinesis Data Analytics) is for real-time stream processing, not format conversion within Firehose. Option B (Amazon S3 event notifications) triggers notifications on S3 events, not data transformation. Option D (AWS Lambda transformation) allows custom code for data transformation but is not specifically for converting JSON to Parquet; the built-in format conversion is the appropriate feature for this task.

Answer

Amazon Kinesis Data Analytics

Answer

Amazon S3 event notifications

Answer

AWS Lambda transformation

Question 18

A data engineer runs an AWS Glue job that reads from a JDBC connection to a PostgreSQL database. The job fails with a 'Connection timed out' error. The Glue job runs in a VPC with the appropriate security group. What is the most likely cause?

Accepted Answer

The network ACL associated with the Glue job's subnet is blocking outbound traffic.. The 'Connection timed out' error indicates a network connectivity issue. Since the Glue job runs in a VPC with a security group that likely allows outbound traffic, the most likely cause is that the network ACL (which is stateless) associated with the Glue job's subnet is blocking outbound traffic to the database. Option A is correct. Option B is incorrect because the error is not an authentication or permission issue. Option C is incorrect because the security group's inbound rule does not affect outbound traffic from the Glue job. Option D is incorrect because the error is network-related, not a credentials issue.

Answer

The Glue job does not have permission to access the database.

Answer

The security group does not allow inbound traffic from the Glue job.

Answer

The database credentials are incorrect.

Question 19

A company ingests streaming data from IoT devices into Amazon Kinesis Data Streams. The data must be transformed in real-time using custom Python code before being stored in Amazon S3. Which AWS service should be used to perform this transformation?

Accepted Answer

Amazon Kinesis Data Analytics for Apache Flink. Amazon Kinesis Data Analytics for Apache Flink enables real-time stream processing with custom Python code via Apache Flink's Python API, making it suitable for complex transformations. Option A (Amazon EMR) is wrong as it requires significant setup and is not a fully managed streaming service. Option B (Amazon Kinesis Data Firehose) is wrong because although it can invoke Lambda for simple transformations, it is limited in complexity and not designed for rich Python custom logic. Option C (AWS Glue) is wrong because it is primarily a batch ETL service and lacks native real-time stream processing capabilities.

Answer

Amazon EMR

Answer

Amazon Kinesis Data Firehose

Answer

AWS Glue

Question 20

A company uses AWS Glue ETL to transform data from Amazon RDS for PostgreSQL to Amazon S3. The transformation includes joining several tables and aggregating millions of rows. The job runs successfully but takes over 2 hours. The data engineer wants to reduce runtime. Which action is MOST effective?

Accepted Answer

Increase the number of DPUs for the Glue job.. Increasing the number of DPUs (Data Processing Units) in AWS Glue ETL jobs allows more parallel processing of the transformation, which directly reduces runtime for CPU-bound or memory-bound tasks like joining and aggregating millions of rows. Option A: Auto Scaling adjusts DPUs based on workload but does not guarantee maximum performance; it may still be limited by the initial DPU allocation. Option B: DynamicFrames vs DataFrames performance difference is minimal for such operations; this would not significantly reduce runtime. Option D: Converting source data to Parquet applies to data in S3, but the source is Amazon RDS, so this conversion does not help with reading from the database. Therefore, increasing DPUs is the most effective action.

Answer

Enable Auto Scaling for the Glue job.

Answer

Use AWS Glue DynamicFrames instead of DataFrames.

Answer

Convert the source data to Parquet format.