DEA-C01 Practice Exam 57 — 20 Questions

Question 1

A company is using Amazon S3 to store sensitive financial data. They need to ensure that all objects are encrypted at rest. Which TWO methods can achieve this? (Choose TWO.)

Accepted Answer

Use SSE-KMS to encrypt objects with AWS KMS.. SSE-KMS (Server-Side Encryption with AWS Key Management Service) allows you to encrypt objects at rest in S3 using customer-managed or AWS-managed KMS keys. This provides envelope encryption, separate key management, and audit trails via AWS CloudTrail, meeting compliance requirements for sensitive financial data.

Answer

Enable S3 Transfer Acceleration on the bucket.

Answer

Apply a bucket policy that denies PutObject without encryption.

Answer

Use client-side encryption before uploading objects.

Question 2

A data engineer is setting up an Amazon S3 lifecycle policy to transition objects to S3 Glacier after 90 days and delete after 365 days. The objects are stored in the S3 Standard storage class. Which lifecycle rule configuration meets the requirements?

Accepted Answer

Transition to Glacier after 90 days and expire after 365 days. It specifies a transition action to S3 Glacier after 90 days and a separate expiration action after 365 days, which directly matches the requirements. S3 lifecycle policies allow independent transition and expiration actions, and the expiration action must be set to a value greater than the transition action to keep objects accessible in Glacier until deletion.

Answer

Transition to Glacier after 90 days and expire after 90 days

Answer

Transition to Glacier after 90 days and expire after 90 days

Answer

Transition to Glacier after 365 days and expire after 365 days

Question 3

A data engineer is troubleshooting an AWS Glue job that fails with 'java.lang.OutOfMemoryError: Java heap space'. The job processes a large dataset. Which TWO configuration changes should the engineer consider to resolve this issue? (Choose TWO.)

Accepted Answer

Increase the Spark shuffle partitions configuration (spark.sql.shuffle.partitions).. Options B and D are correct. Increasing Spark shuffle partitions (B) reduces the amount of data shuffled per partition, lowering memory pressure and preventing heap overflow. Increasing the number of DPUs (D) allocates more memory and compute resources to the Glue job, directly addressing heap space limitations. Option A is incorrect because changing the output format from Parquet to CSV does not reduce memory usage and may increase it due to lack of compression. Option C is incorrect because reducing the number of source partitions can increase partition size, worsening memory issues. Option E is incorrect because disabling job bookmarks does not affect memory usage; it may cause processing of already processed data but doesn't resolve heap space.

Answer

Change the output format from Parquet to CSV.

Answer

Reduce the number of partitions in the source data.

Answer

Disable job bookmarks to avoid incremental processing.

Question 4

A company runs a daily batch process that reads data from Amazon S3, transforms it with AWS Glue, and loads it into Amazon Redshift. The process takes 6 hours, but the business requires completion within 4 hours. Which design change would MOST reduce runtime?

Accepted Answer

Load data directly from S3 to Redshift using COPY command, then transform in Redshift. Loading data directly from S3 to Redshift using the COPY command eliminates the AWS Glue transformation step, which is the primary bottleneck. The COPY command is optimized for high-speed bulk loads, and performing transformations within Redshift (e.g., using SQL or stored procedures) can often be faster than an external ETL tool. Option A (increasing Glue workers) may help parallelism but does not address the overhead of the Glue job itself. Option C (S3 Select) reduces the data volume scanned by Glue but still requires the Glue transformation. Option D (columnar storage) is already the default in Redshift and does not reduce the Glue job runtime.

Answer

Increase the number of Glue workers

Answer

Use S3 Select to filter data before Glue

Answer

Switch to columnar storage in Redshift

Question 5

A company uses AWS Glue to process data from multiple S3 buckets. The Glue job runs daily and reads data from a bucket that contains millions of small files (each < 1 MB). The job has been running for hours and is often close to the 8-hour timeout limit. Which optimization would MOST reduce the job's runtime?

Accepted Answer

Pre-process the data to consolidate small files into larger files before the Glue job.. The most impactful optimization for reducing the runtime of a Glue job that reads millions of small files is to consolidate those files into larger files prior to processing. Each small file incurs overhead for listing, opening, and reading, and Spark's task scheduler must create a separate task for each file or partition. By grouping small files (e.g., via S3 batch operations or a compaction job), the number of files decreases dramatically, reducing scheduling overhead and I/O operations. While converting to Parquet (Option B) and increasing DPUs (Option C) can improve performance, their benefits are limited if the underlying file count remains high. A larger Spark shuffle partition size (Option D) only affects shuffle operations, not the initial file read overhead. Therefore, file consolidation is the most effective single change.

Answer

Convert the source data from CSV to Parquet format.

Answer

Increase the number of DPUs allocated to the Glue job.

Answer

Use a larger Spark shuffle partition size.

Question 6

Which THREE considerations are important when designing a data pipeline that uses AWS Glue to process streaming data from Amazon Kinesis Data Streams? (Choose 3.)

Accepted Answer

Set the number of Glue workers to match the number of shards for optimal parallelism. A, B, and C are correct. A: Setting the number of Glue workers to match the number of shards ensures optimal parallelism and resource utilization. B: Ensuring sufficient shards in Kinesis Data Streams is essential to handle the expected record rate and avoid throttling. C: Configuring checkpointing in AWS Glue streaming jobs prevents data loss and allows resumption from the last checkpoint on failure. D (batch window) is not appropriate for streaming pipelines as it introduces latency and is more suited for batch processing. E (converting to Avro) is a general data optimization but not a critical consideration specifically for Glue streaming with Kinesis.

Answer

Use batch window to accumulate data before processing

Answer

Convert data to Avro format for better compression

Question 7

A data engineer needs to export data from an Amazon DynamoDB table to Amazon S3 for archival purposes. The export should be a one-time operation and must not impact the read capacity of the table. Which approach meets these requirements?

Accepted Answer

Use DynamoDB on-demand backup feature to export to S3. DynamoDB's on-demand backup feature can export table data directly to S3 without consuming any read capacity units, making it ideal for a one-time archival export. Option A (Scan operation) consumes read capacity and impacts table performance. Option B (AWS Glue ETL with DynamoDB connector) also uses Scan operations that consume read capacity. Option C (DynamoDB Streams to Lambda) is designed for continuous change capture, not one-time bulk export.

Answer

Use a Scan operation in a script to read all items and write to S3

Answer

Use AWS Glue ETL with a DynamoDB connector

Answer

Set up a DynamoDB Stream to Lambda that writes to S3

Question 8

A company uses Amazon Kinesis Data Streams to ingest real-time clickstream data. The consumer application is falling behind and the iterator age is increasing. Which action would most effectively improve throughput?

Accepted Answer

Increase the number of shards in the stream. Increasing the number of shards in a Kinesis data stream increases the level of parallelism for both ingestion and consumption, allowing the consumer to process more data concurrently and catch up. Option A is incorrect because Kinesis Data Firehose is a delivery stream, not a replacement for real-time consumption, and cannot solve a consumer lag issue. Option B is incorrect because decreasing batch size reduces the amount of data processed per poll, which can actually slow down throughput and increase iterator age. Option C is incorrect because enhanced fan-out is useful when multiple consumers need dedicated throughput, but it does not increase the total throughput of the stream; it simply provides each consumer with its own 2 MB/sec per shard read throughput, which may not help a single consumer that is already falling behind.

Answer

Switch from Kinesis Data Streams to Kinesis Data Firehose

Answer

Decrease the batch size in the consumer

Answer

Enable enhanced fan-out for the consumer

Question 9

Refer to the exhibit. An IAM policy is attached to an IAM role used by an application. The application needs to read objects from 'my-bucket' that have the tag 'classification=public'. The application account is 123456789012. However, the application is getting 'Access Denied' errors. What is the most likely reason?

Accepted Answer

The object being accessed does not have the tag 'classification=public'.. The Allow statement grants s3:GetObject only when the request has a condition that the object tag 'classification' equals 'public' (using StringEquals). If the object being accessed does not have this tag, the Allow condition is not satisfied, and the request is implicitly denied. The Deny statement does not apply because it only denies when the source account is NOT 123456789012, and the request does come from that account. Thus, the most likely cause is that the object's tag does not match 'classification=public'.

Answer

The Deny statement uses StringNotEquals, which incorrectly denies the application account.

Answer

The policy does not grant s3:ListBucket permission, so the application cannot list objects.

Answer

The Deny statement blocks all access from accounts other than 123456789012, but the application is in that account.

Question 10

A data engineer is monitoring an Amazon Redshift cluster and notices that some queries are experiencing high disk usage and slow performance. The engineer wants to identify the queries that are causing the most disk spills to temporary files. Which system table should the engineer query to get this information?

Accepted Answer

SVL_QUERY_SUMMARY. SVL_QUERY_SUMMARY. This system view provides information about disk spills for each query step, including the number of bytes spilled to temporary files. It is used to identify queries causing high disk usage and slow performance due to spills. Option B, SYS_QUERY_DETAIL, contains general query execution details but not spill information. Option C, STL_SCAN, tracks table scan operations, not disk spills. Option D, STV_TBL_PERM, shows permanent table storage statistics, not temporary spill data.

Answer

SYS_QUERY_DETAIL

Answer

STL_SCAN

Answer

STV_TBL_PERM

Question 11

A data pipeline using Amazon Kinesis Data Streams is experiencing high consumer lag. The stream has 10 shards. The consumer is an AWS Lambda function that processes each record and writes to Amazon DynamoDB. What is the MOST likely cause of the lag?

Accepted Answer

The Lambda function's reserved concurrency is set too low. The most likely cause of high consumer lag is that the Lambda function's reserved concurrency is set too low (Option A). Each Kinesis shard is processed by a single Lambda invocation, and if the function's concurrency limit is less than the number of shards (10), some shards will not be processed in parallel, leading to lag. Option B (DynamoDB write capacity throttling) could cause lag but is less common if the table is properly provisioned. Option C (insufficient shards) is unlikely because 10 shards already provide parallelism; increasing shards would improve throughput only if Lambda concurrency is not the bottleneck. Option D (authorization) would cause errors, not just lag.

Answer

The DynamoDB table's write capacity is throttling writes

Answer

The number of shards is insufficient for the data volume

Answer

The Lambda function is not authorized to read from Kinesis

Question 12

A data engineer is using Amazon EMR to process large datasets. The cluster uses a mix of Spot Instances and On-Demand Instances. The engineer wants to reduce costs while ensuring the job can complete even if Spot Instances are reclaimed. Which TWO actions should the engineer take? (Choose two.)

Accepted Answer

Enable Instance Fleets to use multiple instance types for Spot Instances.. Enabling Instance Fleets allows EMR to use multiple instance types for Spot Instances, reducing the risk of interruption by diversifying across instance pools. Option E is correct because using a task instance group with Spot Instances for non-critical tasks ensures that if Spot Instances are reclaimed, only those non-critical tasks are affected, while core and master nodes running on On-Demand continue processing. Option B is incorrect because using only On-Demand increases costs. Option C is incorrect because using Spot Instances for core nodes risks data loss or job failure if they are reclaimed, as HDFS data is stored on core nodes. Option D is incorrect because termination protection prevents accidental termination, but does not address Spot Instance interruptions.

Answer

Use only On-Demand Instances for all nodes.

Answer

Use Spot Instances for core nodes to reduce cost.

Answer

Enable termination protection for the cluster.

Question 13

A data engineer is designing a data lake on Amazon S3. The data includes sensitive personally identifiable information (PII). Which combination of services would provide the most comprehensive data protection?

Accepted Answer

Enable S3 Block Public Access and use Amazon Macie to discover and classify PII. Combining S3 Block Public Access prevents unintended public exposure, and Amazon Macie automatically discovers, classifies, and protects sensitive PII. Option A is incorrect because S3 Transfer Acceleration speeds up uploads but does not protect data; versioning helps with accidental deletion but not confidentiality or access control. Option B is incorrect because SSE-KMS only provides encryption at rest, not comprehensive protection against misconfigurations or authorized access to PII. Option C is incorrect because CloudWatch Logs monitor and audit access but do not prevent exposure or classify data; MFA Delete protects against accidental deletion but not against data leaks.

Answer

Use S3 Transfer Acceleration and enable versioning

Answer

Enable S3 server-side encryption with AWS KMS

Answer

Use Amazon CloudWatch Logs to monitor access and enable MFA Delete

Question 14

A data engineer is monitoring Amazon CloudWatch metrics for an Amazon Redshift cluster and notices high CPU utilization. The engineer wants to reduce CPU usage. Which TWO actions should the engineer take?

Accepted Answer

Enable concurrency scaling to offload read queries to additional clusters.. Options A and C are correct. Enabling concurrency scaling offloads read queries to additional clusters, reducing CPU load on the main cluster. Optimizing table design with sort keys and compression reduces the amount of data scanned per query, lowering CPU usage. Option B (increasing node count) increases overall CPU capacity but does not reduce usage; it may even increase cost without addressing inefficiency. Option D (running VACUUM) primarily reclaims disk space and maintains data distribution, not CPU reduction. Option E (enabling audit logging) adds CPU overhead, making it counterproductive.

Answer

Increase the number of nodes in the cluster.

Answer

Run the VACUUM command on all tables.

Answer

Enable audit logging to monitor queries.

Question 15

A data engineer uses AWS CloudTrail to investigate a security incident. The engineer runs the command shown in the exhibit. What does the output indicate?

Accepted Answer

A file was uploaded to the S3 bucket.. The CloudTrail event shows EventName as PutObject, which indicates an object was uploaded to S3. The resource name includes the bucket and the object key 'sales_2024-07-01.csv', confirming a single file upload. Option A is incorrect because the event is PutObject, not GetObject. Option B is incorrect because PutObject is an upload, not a deletion. Option C is incorrect because PutObject represents uploading a single object, not listing a batch of files.

Answer

A file was downloaded from the S3 bucket.

Answer

A file was deleted from the S3 bucket.

Answer

A batch of files was listed from the S3 bucket.

Question 16

A company stores sensitive data in Amazon S3 and uses AWS Lake Formation to manage fine-grained access control. A data engineer notices that users are able to access data in S3 directly via the AWS Management Console, bypassing Lake Formation permissions. What should the engineer do to enforce Lake Formation access controls for all access methods?

Accepted Answer

Register the S3 location in Lake Formation and disable IAM access control for the registered location.. To enforce Lake Formation permissions for all access methods, you must register the S3 location in Lake Formation and disable IAM access control for that location. This ensures that Lake Formation's fine-grained permissions are enforced, preventing direct S3 access. Option A is incorrect because adding a bucket policy that denies all access except from Lake Formation is not the recommended approach and can break legitimate access. Option B is incorrect because disabling CloudTrail does not affect access control. Option D is incorrect because S3 Block Public Access only prevents public access, not IAM user access.

Answer

Add a bucket policy that denies all access except from Lake Formation.

Answer

Disable AWS CloudTrail logging for S3 access.

Answer

Enable S3 Block Public Access on the bucket.

Question 17

A company uses Amazon S3 to store sensitive data. The security team requires that all data in transit between on-premises applications and S3 be encrypted. The data engineer must implement a solution that meets this requirement without changing the applications. Which TWO solutions should the engineer consider? (Choose two.)

Accepted Answer

Use an S3 VPC Endpoint and enforce the use of HTTPS through bucket policies.. Using an S3 VPC Endpoint with a bucket policy that enforces HTTPS ensures all traffic to S3 is encrypted in transit, without any application changes. Option E is correct because AWS Storage Gateway can mount S3 as a file system and be configured to use HTTPS, enforcing encryption in transit. Option A is incorrect because S3 Transfer Acceleration only improves speed over long distances, it does not enforce encryption—it optionally uses HTTPS but the application must still use HTTPS. Option B is incorrect because default encryption (SSE-S3, SSE-KMS, DSSE-KMS) encrypts data at rest, not in transit. Option C is incorrect because server-side encryption with SSE-S3 also only encrypts data at rest.

Answer

Enable S3 Transfer Acceleration on the bucket.

Answer

Enable default encryption on the S3 bucket.

Answer

Use server-side encryption with S3 managed keys (SSE-S3).

Question 18

A company is designing a data lake on Amazon S3. The data ingestion pipeline must handle both structured and unstructured data. The data must be cataloged for easy discovery. Which THREE services should be included in the solution? (Choose THREE.)

Accepted Answer

Amazon S3. Amazon S3 is the core storage layer for the data lake, providing scalable, durable, and cost-effective object storage for both structured and unstructured data. AWS Glue Data Catalog acts as the central metadata repository, enabling data discovery and schema management across the data lake. Amazon Athena allows serverless querying of data directly from S3 using standard SQL, leveraging the Glue Data Catalog for schema-on-read, which is essential for easy discovery and analysis.

Answer

Amazon RDS

Answer

Amazon Redshift

Question 19

A data engineering team notices that an AWS Glue ETL job, which processes hourly data from an S3 bucket, is taking progressively longer to run. The job reads Parquet files partitioned by date and hour. Which action is MOST likely to improve the job's performance?

Accepted Answer

Enable pushdown predicate filtering on the job's data source.. Enabling pushdown predicate filtering allows the Glue job to read only the relevant partitions (e.g., specific date and hour) instead of scanning all data. This directly addresses the symptom of progressively longer run times as data accumulates. Option B is incorrect because Parquet is a columnar format optimized for performance, while CSV would increase I/O. Option C, increasing DPUs, can improve parallelism but does not reduce the amount of data read, so it may not address the root cause. Option D, switching to Python shell, would lose Spark's distributed processing capabilities and is unlikely to improve performance.

Answer

Convert Parquet files to CSV to improve read performance.

Answer

Increase the number of DPUs for the job.

Answer

Switch from Spark to Python shell for simpler processing.

Question 20

A company uses AWS Glue to run ETL jobs on data stored in S3. The data is encrypted with SSE-KMS. The Glue job fails with an 'AccessDenied' error when trying to read the data. What is the MOST likely cause?

Accepted Answer

The IAM role used by Glue does not have kms:Decrypt permission on the KMS key.. When data is encrypted with SSE-KMS, the IAM role used by Glue must have kms:Decrypt permission on the KMS key to read the data. Without it, the Glue job will fail with an 'AccessDenied' error despite S3 bucket permissions. Option A is incorrect because the S3 bucket policy may allow access, but KMS permission is separate and required. Option B is incorrect because the Glue Data Catalog permissions are for catalog operations, not for reading actual data from S3. Option D is incorrect because Glue connection permissions are for JDBC connections, not for S3 data access.

Answer

The S3 bucket policy denies access to the Glue service role.

Answer

The AWS Glue Data Catalog does not have permission to the table.

Answer

The Glue job's connection does not have the necessary permissions.