DEA-C01 Practice Exam 57 — 20 Questions

Question 1

A company is using Amazon EMR to process data stored in Amazon S3. The S3 bucket is configured with a bucket policy that denies access unless the request includes a specific tag. The EMR cluster's IAM role has s3:GetObject permission. However, the EMR job fails to read data from S3. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The IAM role does not have a condition that matches the required tag.. The bucket policy denies access unless the request includes a specific tag. Even though the EMR cluster's IAM role has s3:GetObject permission, the IAM role does not have a condition key (e.g., aws:RequestTag) that matches the required tag. Therefore, the request is denied by the bucket policy, causing the EMR job to fail.

Answer

The bucket policy is not attached to the EMR role.

Answer

The EMR cluster is not in the same account as the S3 bucket.

Answer

The EMR role does not have s3:GetObject permission.

Question 2

Refer to the exhibit. A data engineer checks the versioning status of an S3 bucket and sees the above output. The bucket contains critical logs that must not be permanently deleted. What should the engineer do to enhance protection against accidental or malicious deletion?

Accepted Answer

Enable MFA Delete on the bucket. Enabling MFA Delete on the bucket adds an extra layer of protection by requiring multi-factor authentication for permanently deleting object versions or changing the versioning state. Since the bucket already has versioning enabled (as shown in the exhibit), MFA Delete is the appropriate enhancement to prevent accidental or malicious permanent deletion.

Answer

Enable versioning on the bucket

Answer

Enable cross-region replication

Answer

Configure a lifecycle policy to expire noncurrent versions

Question 3

A data engineer is setting up an Amazon RDS for MySQL database. The compliance team requires that all data at rest be encrypted. What must the engineer do to enable encryption for this database?

Accepted Answer

Specify an AWS KMS key when launching the DB instance. For Amazon RDS, encryption at rest must be enabled at the time of DB instance creation by specifying an AWS KMS key. Once the DB instance is created, you cannot enable encryption by simply modifying the instance; you would need to create an encrypted snapshot and restore it to a new encrypted instance. Therefore, the engineer must specify a KMS key when launching the DB instance to meet the compliance requirement.

Answer

Enable encryption after the DB instance is created by modifying the DB instance

Answer

Use AWS Secrets Manager to store the encryption key and attach it to the DB instance

Answer

Encrypt the underlying EBS volumes after the instance is created

Question 4

A data engineer needs to ensure that an Amazon S3 bucket containing sensitive customer data is encrypted at rest. Which AWS service can be used to manage the encryption keys?

Accepted Answer

AWS Key Management Service (KMS). AWS Key Management Service (KMS) is the managed service for creating, rotating, and controlling the keys used to encrypt data at rest in S3 (SSE-KMS). It integrates natively with S3 so that objects are encrypted with a KMS customer master key, and access to the key is governed by IAM and key policies. This is the standard answer for managing S3 encryption keys.

Answer

AWS Certificate Manager

Answer

AWS Secrets Manager

Answer

AWS CloudHSM

Question 5

A company uses Amazon S3 to store sensitive data. The data engineer needs to ensure that all data in transit between the S3 bucket and clients is encrypted. Which configuration should the engineer implement?

Accepted Answer

Create an S3 bucket policy that denies requests where SecureTransport is false.. An S3 bucket policy that denies requests where SecureTransport is false enforces HTTPS for all access, encrypting data in transit. Option A is wrong because CloudFront with SSL can enforce HTTPS but is not a direct S3 configuration and may incur additional costs. Option B is wrong because SSE-S3 only encrypts data at rest, not in transit. Option D is wrong because SSE-C also encrypts data at rest with a customer-provided key, not in transit.

Answer

Use Amazon CloudFront to serve the content and enable SSL.

Answer

Enable default encryption on the S3 bucket using SSE-S3.

Answer

Use SSE-C to encrypt the data with a customer-provided key.

Question 6

A data engineer is monitoring an Amazon Redshift cluster and notices that the 'WLM query wait time' metric is consistently high during peak hours. The cluster uses automatic WLM. The engineer wants to reduce query wait times without changing the cluster size. Which action is MOST effective?

Accepted Answer

Enable concurrency scaling.. Enabling concurrency scaling (Option A) is the most effective action because it automatically adds transient cluster capacity during peak loads, allowing more queries to run concurrently without increasing wait times. This is specifically designed to reduce WLM query wait time. Option B (manual WLM) requires tuning and does not add capacity. Option C (increasing max queries per queue) could increase concurrency but may lead to resource contention and longer wait times if the cluster is already saturated. Option D (short query acceleration) prioritizes short queries, which does not address overall wait times for all queries. Therefore, A is correct.

Answer

Change WLM to manual mode and increase the number of queues.

Answer

Increase the maximum number of queries per queue.

Answer

Enable short query acceleration (SQA).

Question 7

A data engineer is troubleshooting a slow-running query on Amazon Redshift. The query scans a large table but returns few rows. Which diagnostic step should be taken first?

Accepted Answer

Use EXPLAIN to review the query plan.. When a query scans a large table but returns few rows, the most likely cause is an inefficient query plan—such as a full table scan instead of using indexes or zone maps. Using EXPLAIN first reveals the execution plan, allowing the engineer to identify whether the query is performing unnecessary sequential scans, missing filter pushdown, or using suboptimal join strategies. This diagnostic step should always precede tuning actions like ANALYZE or VACUUM, which address data distribution or storage bloat rather than query planning.

Answer

Run ANALYZE on the table.

Answer

Check the concurrency scaling status.

Answer

Run VACUUM on the table.

Question 8

A data engineer is designing a data lake on Amazon S3 with sensitive data. The engineer needs to ensure that data at rest is encrypted and that access is logged for compliance. Which TWO actions should the engineer take? (Choose TWO.)

Accepted Answer

Enable CloudTrail data events for S3 object-level operations.. Option D is correct because enabling default bucket encryption with SSE-KMS ensures all objects written to the S3 bucket are encrypted at rest using AWS KMS-managed keys, satisfying the data-at-rest encryption requirement. Option C is correct because CloudTrail data events capture object-level S3 operations such as GetObject and PutObject, providing the access logging needed for compliance auditing. Option A is incorrect because S3 Select only filters data at read time and does not provide encryption or access logging. Option B is incorrect because S3 Transfer Acceleration only speeds up uploads and downloads over long distances, not encryption or logging. Option E is incorrect because S3 Block Public Access prevents public exposure but does not encrypt data at rest or log access.

Answer

Enable S3 Select to filter data at read time.

Answer

Enable S3 Transfer Acceleration.

Answer

Enable S3 Block Public Access on the account.

Question 9

A data engineer is migrating an on-premises MongoDB database to Amazon DocumentDB. Which migration strategy minimizes downtime?

Accepted Answer

Use AWS DMS with full load and ongoing replication from MongoDB to DocumentDB.. AWS DMS with full load and ongoing replication (change data capture) minimizes downtime by continuously synchronizing changes from the source MongoDB to the target DocumentDB after the initial full load, allowing a cutover with only a brief pause. This is the only option that supports near-zero downtime migration for live databases.

Answer

Take a snapshot of the MongoDB database and restore it to DocumentDB.

Answer

Use AWS Database Migration Service (AWS DMS) with full load only.

Answer

Export data using mongodump and import using mongorestore.

Question 10

Which TWO are valid approaches to troubleshoot a slow Amazon Redshift query? (Choose two.)

Accepted Answer

Check for table locks using STV_LOCKS.. Option A is correct because STV_LOCKS is the Amazon Redshift system view that shows current table locks, and a query can appear slow simply because it is blocked waiting on a lock held by another transaction, so checking it is a valid troubleshooting step. Option C is correct because the EXPLAIN command returns the query execution plan, revealing expensive operations such as sequential scans, nested loops, or large data redistributions and broadcasts, which directly identifies why a query is slow. Option B is not a troubleshooting approach for slow queries; enabling cluster encryption is a security configuration and does not affect query performance. Option D is not a diagnostic step but a maintenance action, and running VACUUM blindly is not a valid troubleshooting approach since it can be costly and should follow diagnosis. Option E is likewise a remediation action that changes the table's distribution style, not a way to investigate the cause of slowness, and it should only be applied after identifying a distribution problem.

Answer

Enable encryption on the cluster.

Answer

Run VACUUM on the table.

Answer

Alter the table to change DISTSTYLE to KEY.

Question 11

A company is using Amazon S3 as a data lake. The data engineer needs to ensure that all objects uploaded to a specific bucket are automatically replicated to a bucket in another AWS Region for disaster recovery. Which configuration should the engineer implement?

Accepted Answer

Enable S3 Cross-Region Replication (CRR) on the source bucket.. S3 Cross-Region Replication (CRR) is the correct choice because it automatically replicates objects from a source bucket in one AWS Region to a destination bucket in a different AWS Region, meeting the disaster recovery requirement for geographic separation. CRR requires versioning to be enabled on both buckets and replicates new objects asynchronously after upload.

Answer

Enable S3 Same-Region Replication (SRR) on the source bucket.

Answer

Use S3 Transfer Acceleration to copy objects to the destination.

Answer

Use S3 Batch Operations to copy existing objects.

Question 12

A data pipeline uses AWS DMS to replicate data from an on-premises Oracle database to Amazon S3 in Parquet format. The pipeline has been running successfully for months, but recently the DMS task status shows 'failed' with the error: 'The source database is running out of archive log space.' Which action should the engineer take to prevent this error?

Accepted Answer

Increase the amount of archive log space or reduce the log retention period on the source Oracle database.. The error 'source database is running out of archive log space' originates on the Oracle source, not on DMS. Oracle must retain archive logs until DMS (via LogMiner or Binary Reader) has consumed them; if DMS lags or the retention is too long, archive log space fills up. The fix is to increase archive log space or reduce the retention period so Oracle can purge logs after DMS reads them.

Answer

Configure multiple target S3 buckets to distribute the load.

Answer

Enable automatic log archiving on the DMS replication instance.

Answer

Increase the memory allocation for the DMS replication instance.

Question 13

A data engineer is monitoring an Amazon Redshift cluster and notices that queries are taking longer than expected. The engineer checks the system tables and sees that many queries are waiting for 'WLM' resources. What is the most likely cause and recommended fix?

Accepted Answer

The WLM queue concurrency is set too low; increase the concurrency level.. When queries wait on WLM resources, it means they are queued because the workload management (WLM) queue does not have enough concurrency slots to run them. Increasing the concurrency level of the WLM queue allows more queries to run simultaneously, reducing wait time. This is the most direct fix for WLM queue waits.

Answer

The table sort keys are poorly designed; recreate tables with better sort keys.

Answer

The distribution style is set to ALL; change to KEY distribution.

Answer

The cluster is running low on disk space; resize the cluster.

Question 14

A data engineer is monitoring an Amazon Kinesis Data Analytics for Apache Flink application that processes streaming data. The application is falling behind (increasing 'MillisBehindLatest') and the CPU utilization of the Flink task managers is consistently above 80%. Which THREE actions should the engineer take to improve performance? (Choose THREE.)

Accepted Answer

Increase the number of shards in the Kinesis data stream.. Option A is correct because increasing the number of shards in the Kinesis data stream raises the stream's read throughput capacity (each shard supports up to 1 MB/s or 1,000 records/s for reads), which directly addresses the growing MillisBehindLatest by allowing the Flink source to consume data faster. Option C is correct because enabling auto-scaling for the Flink application (via Kinesis Data Analytics' automatic scaling of KPUs) dynamically adds parallel task slots and CPU resources when utilization is high, relieving the sustained >80% CPU pressure on task managers. Option E is correct because increasing the Flink application's parallelism distributes the workload across more parallel subtasks and task slots, lowering per-task CPU load and improving overall processing throughput. Option B is not appropriate because shortening the checkpoint interval increases checkpointing overhead and I/O rather than reducing state size, potentially worsening performance. Option D is wrong because decreasing the number of task managers reduces available CPU and parallelism, which would increase contention and further degrade the application.

Answer

Decrease the checkpoint interval to reduce state size.

Answer

Decrease the number of task managers to reduce CPU contention.

Question 15

Which TWO of the following are benefits of using Amazon DynamoDB Accelerator (DAX)? (Choose TWO.)

Accepted Answer

Provides microsecond read latency. Option B is correct because DAX is an in-memory write-through cache placed in front of DynamoDB that serves eventually consistent reads from RAM, delivering microsecond read latency for cached items instead of the single-digit millisecond latency of direct DynamoDB reads. Option C is correct because read requests that hit the DAX cache are answered by DAX itself, so they never reach the DynamoDB table, which offloads read traffic and reduces the read capacity units consumed on the underlying table. Option A is not correct because DAX does not accelerate writes: write operations are still written through to DynamoDB synchronously, so write throughput and write latency remain governed by the table. Option D is not correct because durability across Availability Zones is provided by DynamoDB's own multi-AZ replication of table data, not by DAX, which is a cache and can lose cached data. Option E is not correct because DAX does not reduce the storage consumed by the DynamoDB table; it is an additional caching layer that itself incurs cost.

Answer

Improves write throughput

Answer

Provides data durability across Availability Zones

Answer

Reduces storage costs

Question 16

A company is experiencing high costs from Amazon Redshift. The data engineer wants to optimize costs. Which THREE actions should the engineer take? (Choose THREE.)

Accepted Answer

Right-size the cluster based on workload analysis.. Option B is correct because right-sizing the cluster based on actual workload analysis ensures you are not paying for compute and storage capacity that the workload does not consume, directly reducing Redshift costs. Option D is correct because purchasing Reserved Instances for steady-state (predictable, always-on) workloads provides a significant discount over on-demand pricing for the same node usage. Option E is correct because Concurrency Scaling adds transient capacity only when queries queue, and pairing it with a usage limit caps how much extra concurrency-scaling compute can be billed, preventing runaway costs. Option A is not correct because increasing automated snapshot frequency does not reduce cost and can actually increase storage charges for retained snapshots. Option C is not correct because adding more nodes increases both compute and storage cost, which is the opposite of cost optimization unless justified by a genuine performance need.

Answer

Increase the frequency of automated snapshots.

Answer

Increase the number of nodes to improve performance.

Question 17

A company stores sensitive data in Amazon S3. They need to ensure that all objects are encrypted at rest. Which approach meets this requirement with minimal effort?

Accepted Answer

Enable default encryption on the S3 bucket with SSE-S3. Enabling default encryption on an S3 bucket with SSE-S3 (Server-Side Encryption with S3-Managed Keys) automatically encrypts all objects at rest using AES-256, with no additional effort from the user. This ensures that any object uploaded without explicit encryption headers is encrypted by default, meeting the requirement with minimal configuration overhead.

Answer

Use client-side encryption before uploading

Answer

Enable S3 Versioning and MFA Delete

Answer

Use a bucket policy to deny PutObject without encryption

Question 18

A data engineer is troubleshooting a failed AWS Glue ETL job that reads from an S3 bucket. The job logs show the following error: 'java.lang.RuntimeException: java.lang.ClassNotFoundException: Class org.apache.hadoop.fs.s3a.S3AFileSystem not found'. Which TWO actions will resolve this issue?

Accepted Answer

Include the hadoop-aws jar as an extra jar in the Glue job configuration.. The error 'ClassNotFoundException: org.apache.hadoop.fs.s3a.S3AFileSystem' means the S3A filesystem implementation class is not on the Glue job's classpath, so the fix must supply that library. Option B is correct because adding the hadoop-aws jar (which contains org.apache.hadoop.fs.s3a.S3AFileSystem) as an extra jar via the Glue job's --extra-jars configuration puts the missing S3A class on the classpath. Option D is correct because newer AWS Glue versions (Glue 3.0 and later, built on Spark 3.x/Hadoop 3.x) bundle the S3A filesystem library, so running the job on such a version provides the class natively. Option A is wrong because a VPC S3 endpoint only fixes network routing to S3, not a missing Java class. Option C is wrong because IAM permissions govern authorization, and a ClassNotFoundException is a classpath problem, not an access-denied error. Option E is wrong because EMRFS is an EMR-specific filesystem and is not a valid S3 access mode to switch to within AWS Glue.

Answer

Enable VPC S3 endpoint for the Glue job.

Answer

Update the IAM role to allow access to S3.

Answer

Change the S3 access mode from S3A to EMRFS.

Question 19

A company has an Amazon Redshift cluster that stores petabytes of data. Queries are experiencing high disk usage due to large intermediate results. The data engineer needs to improve query performance without adding more nodes. Which action should the engineer take?

Accepted Answer

Set appropriate distribution keys to minimize data movement.. In Amazon Redshift, distribution keys determine how table rows are spread across compute nodes. When joined tables share the same distribution key (or use ALL distribution for small dimension tables), matching rows are co-located on the same node slice, eliminating the broadcast or redistribution steps that spill large intermediate result sets to disk. Since the question specifies high disk usage from large intermediate results and prohibits adding nodes, fixing distribution keys directly reduces the data movement that generates those spills.

Answer

Configure workload management (WLM) queues to limit concurrency.

Answer

Apply column compression encoding to reduce data size.

Answer

Define sort keys on all columns used in WHERE clauses.

Question 20

A company stores critical financial data in Amazon DynamoDB. To meet compliance requirements, the data must be encrypted at rest with a customer-managed key. Which solution should the data engineer implement?

Accepted Answer

Configure the DynamoDB table to use a customer managed key from AWS KMS.. AWS DynamoDB integrates with AWS KMS to support encryption at rest using customer-managed keys (CMKs). By selecting a customer-managed key from KMS during table creation or via an update, the company can meet compliance requirements for controlling the encryption key lifecycle, including rotation and access policies. This approach ensures that the data is encrypted using AES-256 encryption, with the key material managed by the customer rather than AWS.

Answer

Use AWS CloudHSM to generate a key and import it into DynamoDB.

Answer

Enable default encryption on the DynamoDB table using S3-managed keys.

Answer

Use AWS Certificate Manager to issue a certificate and configure TLS.