DEA-C01 Practice Exam 56 — 20 Questions

Question 1

A data pipeline uses AWS Glue to process data from Amazon S3 and write results to Amazon Redshift. The pipeline fails intermittently with the error 'S3ServiceException: Access Denied'. The IAM role used by Glue has permissions to read from the S3 bucket. What is the most likely cause of this error?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The S3 bucket policy denies access to the Glue job's IAM role. S3 bucket policies can explicitly deny access even if the IAM role allows it. Option A is wrong because S3 bucket region does not cause access denied errors. Option B is wrong because S3 Server Access Logging does not affect access permissions. Option D is wrong because S3 Transfer Acceleration is not related to access denied errors.

Answer

The S3 bucket is in a different AWS Region than the Glue job

Answer

S3 Server Access Logging is enabled and blocking requests

Answer

The S3 bucket has S3 Transfer Acceleration enabled

Question 2

A company has an Amazon DynamoDB table with a provisioned write capacity of 1000 WCU. During a flash sale, the write traffic spikes to 5000 WCU for 10 minutes. The table is not auto-scaled. Which action should the data engineer take to handle the spike without throttling?

Accepted Answer

Convert the table to on-demand capacity mode before the sale.. The table is currently provisioned with 1000 WCU and cannot handle a spike to 5000 WCU. Converting to on-demand mode before the sale allows DynamoDB to automatically handle varying traffic without throttling, as on-demand capacity scales instantly to meet demand. Option D (auto-scaling) might not react quickly enough for a short 10-minute spike, and the table is not currently auto-scaled. Option C is incorrect because DAX is a read cache and does not buffer or improve write capacity. Option B is reactive and would not prevent initial throttling.

Answer

Set a CloudWatch alarm to increase provisioned capacity when write throttling occurs.

Answer

Use DynamoDB Accelerator (DAX) to cache writes.

Answer

Enable auto-scaling with a target utilization of 70% and a maximum capacity of 5000 WCU.

Question 3

A data engineer is configuring an S3 bucket for storing sensitive customer data. The bucket must be encrypted at rest using an AWS Key Management Service (KMS) key that is managed by the data engineering team. The team wants to ensure that only users with explicit permission can decrypt the data. Which S3 encryption option should be used?

Accepted Answer

SSE-KMS. SSE-KMS is the correct option because it uses a customer-managed AWS KMS key, allowing the data engineering team to control access and permissions for decryption. Client-side encryption is not an S3 server-side encryption option and does not use KMS. SSE-S3 uses Amazon S3-managed keys, which do not provide customer-controlled access. SSE-C requires the customer to manage their own encryption keys and does not use KMS, nor does it allow the same level of access control as a CMK.

Answer

Client-side encryption

Answer

SSE-S3

Answer

SSE-C

Question 4

A data engineer receives an alert that a Kinesis Data Stream has a 'WriteProvisionedThroughputExceeded' error. The stream has 5 shards with 1 MB/s write capacity per shard. The producer application is sending data at 8 MB/s sustained. What should the engineer do to resolve the issue?

Accepted Answer

Increase the number of shards from 5 to 10.. The 'WriteProvisionedThroughputExceeded' error indicates that the total write throughput to the Kinesis Data Stream exceeds the provisioned capacity. With 5 shards, each offering 1 MB/s write capacity, the total write capacity is 5 MB/s. The producer is sending 8 MB/s, which is above this limit. Increasing the number of shards to 10 raises the total write capacity to 10 MB/s, accommodating the sustained 8 MB/s throughput and resolving the throttling.

Answer

Reduce the record size to below 1 MB per record.

Answer

Enable enhanced fan-out on the stream.

Answer

Use Kinesis Firehose as an intermediary to buffer data.

Question 5

A team is designing a data lake on S3 and needs to enforce encryption at rest. They want to use server-side encryption with a KMS key that they manage. Which encryption option should they configure on the S3 bucket?

Accepted Answer

SSE-KMS. SSE-KMS is the correct choice because it provides server-side encryption using a customer-managed KMS key. This allows the team to enforce encryption at rest with their own key, giving them control over key rotation, access policies, and audit trails via AWS CloudTrail, which aligns with the requirement to manage the encryption key themselves.

Answer

Client-side encryption

Answer

SSE-S3

Answer

SSE-C

Question 6

A data engineer notices that an S3 bucket policy allows access to a user from another AWS account, but the access is being denied. What could be the reason?

Accepted Answer

The other account's IAM user does not have permissions to access the bucket. For cross-account S3 access to succeed, both the bucket policy (resource-based policy) and the IAM user policy (identity-based policy) in the other account must grant the necessary permissions. Option B is correct because even if the bucket policy allows access from the other account, the IAM user in that account must have an explicit IAM policy that permits the S3 action (e.g., s3:GetObject) on the bucket. Without this, the request is denied by the other account's own IAM evaluation.

Answer

The bucket policy does not include KMS permissions

Answer

S3 does not support cross-account access

Answer

The bucket is in a different region

Question 7

A data engineer needs to store semi-structured JSON data from IoT devices. The data is written once, read rarely, but must be queryable using SQL. The storage cost must be minimized. Which storage solution should the engineer choose?

Accepted Answer

Store JSON files in Amazon S3 and use Amazon Athena for queries. Amazon S3 provides the lowest-cost storage for data that is written once and rarely read, while Amazon Athena enables serverless SQL querying directly on JSON files stored in S3. This combination minimizes storage costs because S3 charges only for the data stored and retrieval, with no minimum fees or provisioning required, and Athena charges only for the data scanned per query. The workload's write-once, read-rarely pattern aligns perfectly with S3's durability and lifecycle policies, making it the most cost-effective choice.

Answer

Store JSON in Amazon Redshift as SUPER data type

Answer

Store JSON in an Amazon RDS for MySQL table

Answer

Store JSON documents in Amazon DynamoDB and use PartiQL for queries

Question 8

A data engineer needs to store JSON documents that are accessed by a serverless application using AWS Lambda. The documents are frequently updated and need low latency (single-digit milliseconds) for read and write operations. Which AWS service should the engineer use?

Accepted Answer

Amazon DynamoDB. Amazon DynamoDB is a fully managed NoSQL key-value and document database that provides single-digit millisecond latency for read and write operations at any scale. It natively supports JSON documents, integrates directly with AWS Lambda via the AWS SDK, and handles frequent updates efficiently through its auto-scaling and on-demand capacity modes, making it ideal for serverless applications requiring low-latency data access.

Answer

Amazon ElastiCache for Redis

Answer

Amazon S3 (with S3 Select)

Answer

Amazon RDS for MySQL

Question 9

A company uses DynamoDB with global tables in two AWS Regions. The data engineer observes that a write to the table in us-east-1 is not immediately visible in a read from eu-west-1. What is the most likely reason?

Accepted Answer

Replication between regions is eventually consistent.. DynamoDB global tables use asynchronous replication between regions. When a write occurs in us-east-1, the change is propagated to eu-west-1 with a replication lag that is typically sub-second but not instantaneous. Reads in eu-west-1 are eventually consistent by default, meaning they may not reflect the most recent write until replication completes. This is the expected behavior of DynamoDB global tables, which prioritize availability and partition tolerance over immediate consistency across regions.

Answer

The read is using strongly consistent reads.

Answer

There is a write conflict that needs to be resolved.

Answer

DynamoDB Streams is not enabled on the table.

Question 10

A company is designing a data lake on AWS and must comply with GDPR requirements. The company needs to implement data masking for personally identifiable information (PII) columns in Amazon Redshift. Which feature should be used?

Accepted Answer

Create views in Redshift that apply masking functions. Amazon Redshift supports dynamic data masking through views that apply masking functions, such as using CASE statements or custom masking functions to obfuscate PII columns. Option A is incorrect because Amazon RDS Proxy is a connection proxy for RDS databases and does not provide data masking capabilities for Redshift. Option B is incorrect because Amazon S3 Object Lambda is used to transform data in S3, not to mask data in Redshift queries. Option D is incorrect because AWS Lake Formation row-level security filters rows based on permissions but does not mask or obfuscate column values; it is for access control, not data masking.

Answer

Use Amazon RDS Proxy to intercept queries

Answer

Amazon S3 Object Lambda to mask data on the fly

Answer

AWS Lake Formation row-level security

Question 11

A data engineer is designing a data pipeline that processes PII data using AWS Glue and stores results in S3. Which TWO actions should be taken to protect the data? (Choose 2)

Accepted Answer

Store database credentials in AWS Secrets Manager and reference them in Glue connections.. Option B is correct because storing database credentials in AWS Secrets Manager and referencing them from Glue connections avoids hardcoding secrets in scripts or job parameters, enabling secure, auditable, and rotatable credential management for PII pipelines. Option D is correct because configuring AWS Glue to use a customer-managed KMS key for encrypting data written to S3 provides encryption at rest with control over key policies, rotation, and access auditing, which is appropriate for sensitive PII. Option A is not the best choice because SSE-S3 uses AWS-managed keys with less control and auditability than a KMS key, and the question asks for protective actions beyond default encryption. Option C is incorrect because S3 object deletion protection via retention policies (Object Lock) addresses immutability/deletion, not the confidentiality of PII data being processed. Option E is not selected because HTTPS protects data in transit, but Glue-to-S3 traffic within AWS is already encrypted in transit by default, so it is not one of the two required protective actions for this scenario.

Answer

Use S3 default encryption with SSE-S3 for the output bucket.

Answer

Enable S3 object deletion protection by setting a retention policy.

Answer

Use HTTPS for all data transfer between Glue and S3.

Question 12

A company wants to grant read-only access to an S3 bucket for a data analyst. The analyst should be able to list objects and read object content. Which IAM policy effect and action combination is correct?

Accepted Answer

Effect: Allow, Actions: s3:ListBucket, s3:GetObject. To grant read-only access to an S3 bucket, the policy must allow s3:ListBucket to list objects in the bucket and s3:GetObject to read object content. These actions are the minimum required for read-only access to a specific bucket.

Answer

Effect: Allow, Actions: s3:GetObject, s3:DeleteObject

Answer

Effect: Allow, Actions: s3:ListAllMyBuckets, s3:GetObject

Answer

Effect: Allow, Actions: s3:PutObject, s3:GetObject

Question 13

A data engineer is troubleshooting an issue where an IAM role used by AWS Glue cannot read data from an S3 bucket encrypted with SSE-KMS. The bucket policy allows the role to perform s3:GetObject. What additional permission is needed?

Accepted Answer

kms:Decrypt on the KMS key. For SSE-KMS, the IAM role needs kms:Decrypt permission on the KMS key to read encrypted objects. Option A (s3:GetObjectVersion) is not required because the bucket policy already allows s3:GetObject; versioning is not relevant here. Option C (s3:GetObjectAcl) is for access control lists, not encryption. Option D (kms:GenerateDataKey) is used for encrypting new objects, not reading existing ones. Therefore, the correct answer is B.

Answer

s3:GetObjectVersion

Answer

s3:GetObjectAcl

Answer

kms:GenerateDataKey on the KMS key

Question 14

Refer to the exhibit. A data engineer applies this bucket policy to an S3 bucket. A user within the 10.0.0.0/24 IP range attempts to upload an object to the bucket using an HTTP (non-HTTPS) request. What is the outcome?

Accepted Answer

The upload fails because the request is not using HTTPS.. The bucket policy includes a condition `aws:SecureTransport` set to `false`, which explicitly denies any request that does not use HTTPS. Since the user is making an HTTP (non-HTTPS) request, the Deny statement overrides any Allow statement, causing the upload to fail. The correct answer is D.

Answer

The upload succeeds because the Allow statement grants permission.

Answer

The upload succeeds because the user's IP is allowed.

Answer

The upload fails because the user's IP is not in the allowed range for PutObject.

Question 15

A company uses Amazon Redshift for a data warehouse. They notice that queries are slow due to heavy data skew. Which optimization technique should be applied first?

Accepted Answer

Set an appropriate distribution style. Data skew occurs when rows are distributed unevenly across Redshift slices, causing some nodes to process far more data than others. Setting an appropriate distribution style (e.g., KEY, EVEN, or ALL) redistributes the data to balance the workload, directly addressing the root cause of the slowness. This is the first optimization to apply because skew is a fundamental distribution issue that other tuning steps cannot fix.

Answer

Configure workload management (WLM) queues

Answer

Define sort keys on frequently filtered columns

Answer

Apply compression encodings to columns

Question 16

A data engineer runs the above CLI command to describe the DynamoDB table 'Orders'. The table has a partition key 'OrderID' and sort key 'CustomerID'. Which query operation is most efficient for retrieving all orders for a specific customer?

Accepted Answer

Create a Global Secondary Index on CustomerID and query the index. A Global Secondary Index (GSI) on CustomerID allows you to query efficiently using CustomerID as the partition key, avoiding a full table scan. Since the base table's primary key is (OrderID, CustomerID), you cannot directly query by CustomerID alone; a GSI provides an alternative access pattern optimized for this query.

Answer

Query the table using CustomerID as the partition key

Answer

Scan the table and filter by CustomerID

Answer

Use GetItem with CustomerID as the key

Question 17

A company is using Amazon ElastiCache for Redis to cache frequently accessed data. The cache hit ratio is low, and the engineering team suspects that the eviction policy is causing important data to be removed. Which eviction policy should be used to minimize eviction of the most frequently accessed keys?

Accepted Answer

allkeys-lfu. The allkeys-lfu (Least Frequently Used) eviction policy is the correct choice because it explicitly tracks and retains keys that are accessed most frequently across the entire keyspace. Since the cache hit ratio is low due to eviction of important data, LFU ensures that frequently accessed keys are evicted last, directly addressing the problem of important data being removed.

Answer

allkeys-lru

Answer

noeviction

Answer

volatile-lru

Question 18

A company needs to ingest data from multiple SaaS applications into Amazon S3. The data sources provide REST APIs. Which AWS service can be used to build a fully managed data ingestion pipeline without writing custom code?

Accepted Answer

Amazon AppFlow. Amazon AppFlow is a fully managed service designed to transfer data from SaaS applications to AWS services like Amazon S3 without writing custom code. Option B is wrong because Amazon Kinesis Data Streams is primarily for real-time streaming data, not for directly ingesting from SaaS APIs. Option C is wrong because AWS Lambda requires custom code to integrate with SaaS APIs. Option D is wrong because AWS Glue with Python shell is for ETL transformations and also requires custom scripting.

Answer

Amazon Kinesis Data Streams

Answer

AWS Lambda with custom code

Answer

AWS Glue with Python shell

Question 19

A company has a DynamoDB table with a partition key of 'user_id' and a sort key of 'timestamp'. They need to query all items for a user within a date range. Which query operation should be used?

Accepted Answer

Query with KeyConditionExpression on partition key and sort key. The Query operation in DynamoDB is designed to retrieve items based on a specific partition key and an optional sort key condition. Since the table has a partition key of 'user_id' and a sort key of 'timestamp', using Query with a KeyConditionExpression that filters on the partition key (user_id) and a range condition on the sort key (timestamp) is the most efficient and correct approach to get all items for a user within a date range.

Answer

BatchGetItem with multiple keys

Answer

GetItem with both partition and sort key

Answer

Scan with FilterExpression

Question 20

A data engineer is designing a data ingestion pipeline for clickstream data from a mobile app. The data volume varies, with occasional spikes up to 10 MB/s. The pipeline must persist the raw data in Amazon S3 and make it available for near-real-time analytics via Amazon Athena. Which combination of services minimizes cost and operational overhead?

Accepted Answer

Amazon Kinesis Data Firehose with direct delivery to Amazon S3, then Amazon Athena. Amazon Kinesis Data Firehose is the most cost-effective and low-overhead solution for ingesting variable-volume clickstream data (up to 10 MB/s) into Amazon S3 because it is a fully managed service that automatically scales, buffers, and compresses data before delivery. It integrates directly with S3 without requiring custom code or infrastructure management, and the data is immediately queryable by Amazon Athena with no additional transformation steps.

Answer

Amazon Kinesis Data Streams with Amazon Kinesis Data Analytics, then Amazon S3

Answer

Amazon SQS with an Auto Scaling group of EC2 instances writing to Amazon S3

Answer

Amazon Kinesis Data Streams with AWS Lambda for transformation, then Amazon S3