DEA-C01 Practice Exam 58 — 20 Questions

Question 1

Refer to the exhibit. A data engineer runs a Glue job manually and receives a ThrottlingException. The engineer checks the job run history and sees a previous failure with the same error. What is the MOST likely cause of the throttling, and which solution is MOST appropriate?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Implement retry logic with exponential backoff in the script that calls start-job-run.. The error 'ThrottlingException' indicates the Glue API rate limit has been exceeded. The most likely cause is making too many API calls, such as multiple concurrent job starts. Implementing retry logic with exponential backoff in the script that calls StartJobRun will handle transient throttling. Option A (increasing DPUs) does not affect API rate limits. Option C (using reserved capacity) reserves compute capacity, not API throughput, so it does not prevent throttling. Option D (deleting old job runs) does not reduce API calls; it only affects job history visibility.

Answer

Increase the number of DPUs for the job to reduce runtime.

Answer

Use AWS Glue reserved capacity to guarantee API throughput.

Answer

Delete old job runs to reduce the number of entries in the job run history.

Question 2

A data engineering team needs to store log files for 90 days with immediate access, then archive them for 7 years with infrequent access. Which S3 storage class configuration meets these requirements cost-effectively?

Accepted Answer

Use S3 Intelligent-Tiering with lifecycle transition to S3 Glacier Deep Archive after 90 days. S3 Intelligent-Tiering automatically moves data between access tiers based on changing access patterns, making it cost-effective for logs that may have variable access during the first 90 days. A lifecycle policy then transitions the data to S3 Glacier Deep Archive after 90 days, which provides the lowest-cost storage for the 7-year archival period with infrequent access needs.

Answer

Use S3 One Zone-IA for 90 days, then lifecycle to S3 Glacier Deep Archive

Answer

Use S3 Glacier Instant Retrieval for 90 days, then lifecycle to S3 Glacier Flexible Retrieval

Answer

Use S3 Standard for 90 days, then lifecycle policy to S3 Glacier Deep Archive

Question 3

A company uses Amazon Kinesis Data Firehose to deliver streaming data to Amazon S3. The data must be transformed in real-time using a custom Lambda function. Which TWO steps are required to enable this? (Choose TWO)

Accepted Answer

Configure Kinesis Data Firehose to use a Lambda function for data transformation. Options A and B are correct. Amazon Kinesis Data Firehose can invoke an AWS Lambda function for data transformation. You configure Firehose to call the Lambda function (A), and the Lambda function must return the transformed records in the required format, including fields like recordId, result, and data (B). Option C is incorrect because Kinesis Data Analytics is used for real-time analytics, not for simple record transformations within Firehose. Option D is incorrect because transformation logic cannot be written directly in the Firehose delivery stream configuration; it must be implemented in a Lambda function. Option E is incorrect because using Kinesis Data Streams as a source is optional and not required for enabling Lambda transformation.

Answer

Create a Kinesis Data Analytics application to transform the data

Answer

Write the transformation logic directly in the Firehose delivery stream configuration

Answer

Use Kinesis Data Streams as the source for Firehose

Question 4

A data engineer is troubleshooting a slow-running Amazon Redshift query. The query involves a large fact table with a distribution style of EVEN and a sort key on date. The table has 10 slices. The engineer notices that the query is performing a broadcast join with a small dimension table. Which change would most improve performance?

Accepted Answer

Change the fact table to DISTSTYLE KEY on the join column. Changing the fact table’s distribution style to KEY on the join column co-locates rows from both tables on the same nodes, eliminating the need for broadcasting and reducing network traffic. This fully optimizes the join for the large fact table. Option A is incorrect: removing the sort key can degrade range queries, and a compound sort key on the join column does not address data distribution. Option B: while setting the dimension table to DISTSTYLE ALL would avoid broadcasting by replicating the table to all nodes, it does not improve the fact table’s own data distribution, which remains EVEN and can cause skew or suboptimal joins in other queries. Option C: adding slices increases parallelism but still requires broadcasting, so it does not address the root cause of the performance issue.

Answer

Remove the sort key and use a compound sort key on the join column

Answer

Change the dimension table to DISTSTYLE ALL

Answer

Increase the number of slices by resizing the cluster

Question 5

A data engineer needs to move data from an Amazon S3 bucket to an Amazon Redshift cluster on a daily schedule. The data is in CSV format and the target table already exists. Which AWS service should the engineer use to automate this task?

Accepted Answer

AWS Glue. AWS Glue is the correct choice because it provides managed ETL (extract, transform, load) capabilities and can be scheduled to run daily. Glue jobs can directly read CSV files from S3 and write to a Redshift table that already exists. Option A (correct) accurately identifies AWS Glue for this automated data movement task. Option B (Amazon Athena) is wrong because Athena is an interactive query service, not an ETL scheduler; it cannot autonomously move data on a schedule. Option C (Amazon EMR) is wrong because while EMR can handle such tasks, it requires provisioning a cluster, managing lifecycle, and more configuration than needed for a simple daily copy—Glue is simpler and more cost-effective for this use case. Option D (Amazon Kinesis Data Analytics) is wrong because it is designed for processing streaming data in real time, not for batch copying of CSV files.

Answer

Amazon Athena

Answer

Amazon EMR

Answer

Amazon Kinesis Data Analytics

Question 6

A company wants to enforce that all data written to an S3 bucket is encrypted with a customer-managed AWS KMS key. The data engineer has created the KMS key and attached an S3 bucket policy. However, users are still able to upload objects without specifying the KMS key. What is the most likely cause?

Accepted Answer

The S3 bucket policy does not include a condition that denies s3:PutObject without the correct encryption. The bucket policy must explicitly deny s3:PutObject if the encryption header does not match the required KMS key. Without this condition, users can upload objects without specifying the KMS key, even if the bucket has default encryption. Option B is wrong because default encryption with SSE-S3 does not enforce a customer-managed KMS key. Option C is wrong because the KMS key policy grants encryption permissions, but the issue is that the bucket policy does not deny non-compliant uploads. Option D is wrong because the IAM role's s3:PutObject permission is not the issue; the issue is the lack of a condition in the bucket policy.

Answer

The S3 bucket has default encryption enabled with SSE-S3

Answer

The KMS key policy does not grant the users kms:Encrypt permission

Answer

The IAM role for the users does not have s3:PutObject permission

Question 7

A data engineer is running an Amazon Athena query that scans a large amount of data in Amazon S3, resulting in high costs. The data is stored in Parquet format in a partitioned table. Which strategy would be MOST effective in reducing the amount of data scanned?

Accepted Answer

Ensure the query includes a WHERE clause that filters on partition columns.. Partition pruning allows Athena to read only the partitions that match the WHERE clause, significantly reducing the amount of data scanned. Option A is correct because filtering on partition columns is the most effective way to minimize scanned data. Option B is incorrect because Parquet is a columnar format that already compresses well and reduces scan compared to CSV with GZIP. Option C is incorrect because S3 Intelligent-Tiering optimizes storage costs, not query scan costs. Option D is incorrect because adding more partition columns does not reduce scan unless the query filters on them, and may increase metadata overhead.

Answer

Convert the Parquet files to CSV format and apply GZIP compression.

Answer

Use S3 Intelligent-Tiering storage class to reduce storage costs.

Answer

Increase the number of partitions by adding more partition columns.

Question 8

A company uses Amazon S3 to store data for analytics. The data engineer needs to ensure that the S3 bucket is protected against accidental deletion of objects. Which THREE actions should the engineer take? (Choose THREE.)

Accepted Answer

Create an S3 bucket policy that explicitly denies the s3:DeleteObject action.. To protect against accidental deletion of objects in Amazon S3, three effective measures are: creating a bucket policy that explicitly denies the s3:DeleteObject action (option B), enabling versioning (option D), and enabling MFA Delete (option E). Option B ensures that no principal can delete objects unless an explicit allow overrides it. Option D preserves all object versions, allowing recovery of deleted objects. Option E requires multi-factor authentication for deletion operations, adding an extra security layer. Option A (server access logging) is for auditing, not prevention. Option C (lifecycle policy to Glacier) does not prevent deletion; it transitions objects to cheaper storage but objects can still be deleted by lifecycle rules or manually.

Answer

Enable server access logging for the S3 bucket.

Answer

Configure a lifecycle policy to transition objects to Glacier.

Question 9

Refer to the exhibit. An IAM policy is attached to an IAM user. The user is trying to upload an object to 's3://data-lake-bucket/confidential/report.pdf' using the AWS CLI. The upload fails with an AccessDenied error. What is the reason for the failure?

Accepted Answer

An explicit Deny statement overrides the Allow statement for the 'confidential/' prefix.. The IAM policy includes an explicit Deny statement that denies all s3 actions on the 'confidential/' prefix. Even though there is an Allow statement that grants s3:PutObject on the bucket, the explicit Deny overrides it, causing the upload to fail with AccessDenied. Option A is incorrect because the policy does include the s3:PutObject action. Option B is incorrect because the resource ARN in the Allow statement covers the bucket and objects, but the Deny specifically targets 'confidential/'. Option C is incorrect because the user does have permission to access the bucket via the Allow statement, but the Deny blocks access to the specific object under 'confidential/'.

Answer

The policy does not include 's3:PutObject' action.

Answer

The resource ARN in the Allow statement does not cover the specific object.

Answer

The user does not have permission to access the bucket at all.

Question 10

A data engineer needs to set up a data catalog for a new data lake in AWS Glue. The data resides in S3 in Parquet format. The engineer wants to ensure that the schema is automatically detected and updated when new columns are added to the data. Which configuration should the engineer use?

Accepted Answer

Configure the crawler's 'Schema updates' option to 'Update the table schema'.. Configuring the crawler's 'Schema updates' option to 'Update the table schema' allows Glue crawlers to automatically detect and update the schema when new columns are added to the data. Option A is wrong because a partition index is used to improve query performance on partitioned data, not to update the schema. Option C is wrong because setting the crawler's database output to a new database does not affect schema updates; it simply directs the crawler to write to a different database. Option D is wrong because partition indexing (enable partition indexing) is about indexing partitions for faster querying, not about schema updates.

Answer

Add a partition index to the Glue Data Catalog table.

Answer

Set the crawler's 'Database' output to a new database.

Answer

Enable partition indexing on the table.

Question 11

A company is building a real-time analytics dashboard using Amazon Kinesis Data Streams and Amazon DynamoDB. The data engineer needs to ensure that the DynamoDB table can handle write spikes without throttling. Which approach is the most cost-effective?

Accepted Answer

Use DynamoDB on-demand capacity mode.. DynamoDB on-demand capacity mode automatically scales to handle write spikes without requiring capacity planning or management, making it the most cost-effective choice for unpredictable workloads like a real-time analytics dashboard. It charges per request, so you only pay for the writes you actually use, avoiding over-provisioning costs.

Answer

Use DynamoDB Accelerator (DAX) to cache writes.

Answer

Use provisioned capacity with auto-scaling set to a maximum of 10,000 WCU.

Answer

Use an Amazon Lambda function to buffer writes and batch them to DynamoDB.

Question 12

A data engineer is troubleshooting an access issue. A user has the IAM policy shown in the exhibit. The user attempts to upload an object to `s3://data-lake-bucket/confidential/report.pdf`. What will happen?

Accepted Answer

The upload will fail with an 'Access Denied' error.. The explicit Deny statement in the IAM policy overrides the Allow statement, so the user is denied permission to upload to the 'confidential' path. Therefore, the upload will fail with an 'Access Denied' error, making option A correct.

Answer

The upload will succeed because the Deny statement is not valid without a condition.

Answer

The upload will succeed because the Allow statement is more specific than the Deny.

Answer

The upload will succeed because the user has s3:PutObject permission on the bucket.

Question 13

A company uses Amazon Redshift for its data warehouse. A data engineer notices that queries are running slowly and the system's disk space is nearly full. The engineer runs the STV_PARTITIONS view and sees that many slices have high 'tossed' counts. What does this indicate, and what should the engineer do?

Accepted Answer

The tossed rows are deleted rows that need to be reclaimed by running VACUUM.. The STV_PARTITIONS view shows 'tossed' rows, which are rows that have been deleted or updated and are waiting to be reclaimed by a VACUUM operation. High tossed counts indicate wasted disk space, and running VACUUM reclaims that space, improving performance. Option D correctly describes this. Option A is incorrect because tossed rows are not permanent; they can be reclaimed. Option B is incorrect because tossed rows are not related to sort key optimization. Option C is incorrect because tossed rows are not caused by data skew; data skew is about uneven distribution.

Answer

The tossed rows are permanent and cannot be reclaimed; the engineer should perform a deep copy to a new table.

Answer

The tossed rows indicate that the sort key is not optimal; redefining the sort key will reduce tossed rows.

Answer

The tossed rows are due to data skew; redistribute the table on a different distribution key.

Question 14

A company uses Amazon DynamoDB as a source for an AWS Glue job. The job reads a large table using a DynamoDB export to S3 feature. The job is failing with 'ThrottlingException' from DynamoDB. What should the data engineer do to resolve this issue WITHOUT changing the job's logic?

Accepted Answer

Use the DynamoDB export to S3 feature and read the exported data from S3. The DynamoDB export to S3 feature creates a point-in-time snapshot of the table data in S3 without consuming any read capacity units (RCUs) from the DynamoDB table. By reading the exported data from S3 instead of directly scanning the DynamoDB table, the Glue job avoids triggering ThrottlingException entirely, as the export operation uses the table's backup and restore mechanism, not the read path. This resolves the issue without altering the job's logic, as the job can be reconfigured to read from the S3 export location.

Answer

Use DynamoDB Streams to capture changes and process them incrementally

Answer

Reduce the number of DynamoDB read segments in the Glue job

Answer

Increase the read capacity units (RCU) of the DynamoDB table

Question 15

A company is using AWS Glue Data Catalog to store metadata about datasets in S3. The data engineer wants to implement a data governance solution that tracks lineage and versioning of datasets. Which TWO AWS services can be used together to achieve this?

Accepted Answer

AWS Lake Formation. The correct answers are B (AWS Lake Formation) and C (AWS Glue Data Catalog). AWS Lake Formation provides data lineage tracking and versioning capabilities for datasets in the data lake. AWS Glue Data Catalog serves as the central metadata repository and integrates with Lake Formation to enable governance features like lineage. Option A (AWS Data Pipeline) is a data orchestration service, not a governance tool. Option D (AWS CloudTrail) logs API calls but does not track data lineage or versioning. Option E (Amazon S3) is object storage and does not provide lineage or versioning by itself.

Answer

AWS Data Pipeline

Answer

AWS CloudTrail

Answer

Amazon S3

Question 16

A data engineer is running an Amazon EMR cluster with Spark to process log files. The cluster uses instance fleets with m5.xlarge core nodes. The engineer observes that the Spark job is running slower than expected. CloudWatch metrics show that the cluster's CPU utilization is below 20% but memory utilization is near 90%. Which configuration change would most likely improve performance?

Accepted Answer

Use memory-optimized instances (r5.xlarge) for core nodes.. High memory utilization (90%) with low CPU (<20%) indicates that the data does not fit in memory, causing frequent spills to disk. Using memory-optimized instances (r5.xlarge) provides more memory per vCPU compared to m5.xlarge, allowing more data to be kept in memory and reducing spills. Option B is incorrect because increasing the number of core nodes adds more CPU and memory overall, but each node still has the same memory-to-CPU ratio (8 GB per 4 vCPUs for m5.xlarge), so memory pressure per node remains. Option C is incorrect because the issue is insufficient memory, not the number of shuffle partitions; adjusting shuffle partitions does not increase available memory. Option D is incorrect because decreasing the number of core nodes reduces total cluster memory, worsening the memory bottleneck.

Answer

Increase the number of core nodes from 5 to 10.

Answer

Increase the number of Spark shuffle partitions.

Answer

Decrease the number of core nodes to reduce overhead.

Question 17

A data engineer is designing a data lake on Amazon S3 that will be used for both batch processing with Amazon EMR and interactive queries with Amazon Athena. The data includes sensitive personally identifiable information (PII) that must be encrypted at rest. The company requires that the encryption keys be managed by the company and rotated every 90 days. Which TWO options should the engineer implement to meet these requirements? (Choose TWO.)

Accepted Answer

Enable S3 default encryption using SSE-KMS with the customer managed key.. The correct answers are C and D. Option C enables S3 default encryption using SSE-KMS with a customer managed key, ensuring all objects are encrypted at rest with keys managed by the company. Option D creates a customer managed key in AWS KMS with automatic yearly rotation, which satisfies the requirement for key rotation; the company can also perform manual rotations every 90 days if needed. Option A is incorrect because SSE-C requires the customer to manage the keys themselves, including storing them in Secrets Manager, and does not provide automatic rotation. Option B is incorrect because a bucket policy can enforce encryption but does not manage keys. Option E is incorrect because SSE-S3 uses Amazon-managed keys, not customer-managed keys.

Answer

Use customer-provided keys (SSE-C) and store the keys in AWS Secrets Manager.

Answer

Configure a bucket policy to deny uploads that are not encrypted.

Answer

Use S3 managed keys (SSE-S3) for server-side encryption.

Question 18

A company uses AWS KMS to encrypt data in multiple services. They want to ensure that only specific IAM roles can decrypt data using a particular KMS key. Which TWO steps are necessary?

Accepted Answer

Attach an IAM policy to each role with kms:Decrypt permission. To allow specific IAM roles to decrypt data using a KMS key, two steps are required. First, each role must have an IAM policy that grants the kms:Decrypt permission (A). Second, the KMS key policy must include a statement that allows the IAM roles to perform kms:Decrypt (E). The permission kms:GenerateDataKey (D) is not needed for decryption-only access; it is used for generating data keys during encryption. Options B (enabling IAM policies in key policy) and C (automatic key rotation) are unrelated to access control for decryption.

Answer

Enable IAM policies in the key policy

Answer

Enable automatic key rotation

Answer

Ensure the key policy allows kms:GenerateDataKey for the roles

Question 19

A data engineer needs to audit data access in Amazon S3 for compliance. Which TWO services can be used to capture and analyze S3 access logs? (Choose TWO.)

Accepted Answer

AWS CloudTrail. Options B and C are correct. AWS CloudTrail can be configured to record S3 data events, capturing API calls made to S3 buckets. S3 server access logs provide detailed records of all requests made to an S3 bucket, including source IP, requester, and operation. Option A (Amazon CloudWatch Logs) is used for monitoring and storing logs from various sources, but it does not natively generate S3 access logs. Option D (Amazon Macie) is for sensitive data discovery and classification. Option E (AWS Config) is for tracking resource configuration changes.

Answer

Amazon CloudWatch Logs

Answer

Amazon Macie

Answer

AWS Config

Question 20

A data engineer is troubleshooting a slow-running Amazon Athena query on a large dataset stored in S3. The query scans many small files. Which TWO actions can improve query performance?

Accepted Answer

Concatenate small files into larger files. Concatenating small files into larger files reduces the overhead of file listing and task scheduling, improving query performance. Option D is correct because partitioning the data by a frequently filtered column allows Athena to use partition pruning, scanning only relevant partitions and reducing the amount of data read. Option A is incorrect because increasing the number of small files increases overhead and worsens performance. Option B is incorrect because disabling S3 server-side encryption does not affect query performance. Option E is incorrect because converting from CSV to JSON does not improve query performance; columnar formats like Parquet or ORC would be beneficial.

Answer

Increase the number of files to increase parallelism

Answer

Disable S3 server-side encryption

Answer

Convert files from CSV to JSON