DEA-C01 Practice Exam 59 — 20 Questions

Question 1

A company is running a Redshift cluster and wants to improve query performance for a frequently used dashboard. Which THREE approaches are recommended?

Accepted Answer

Apply column compression encoding. The recommended approaches for improving Redshift query performance include applying column compression encoding (Option B) to reduce I/O, defining sort keys on columns used in WHERE clauses (Option C) to enable range-restricted scans, and choosing an appropriate distribution key for large tables (Option E) to minimize data movement between nodes. Enabling concurrency scaling (Option A) primarily helps with handling multiple concurrent queries but does not directly improve the performance of an individual query. Adding more nodes (Option D) can increase overall capacity but is often not the most cost-effective or immediate solution for performance issues.

Answer

Enable concurrency scaling

Answer

Add more nodes to the cluster

Question 2

A company wants to enforce encryption in transit for data moving between an EC2 instance and an S3 bucket. Which TWO methods can achieve this? (Choose 2)

Accepted Answer

Add a bucket policy that denies requests without the aws:SecureTransport condition.. Options A and D are correct. Option A: Adding a bucket policy with the aws:SecureTransport condition denies any requests that are not using HTTPS, thus enforcing encryption in transit. Option D: By using the HTTPS endpoint for S3 API calls, data is encrypted in transit via TLS. Option B is incorrect because a VPC endpoint for S3 does not automatically enforce encryption; it only keeps traffic within the AWS network. Option C is incorrect because SSE-S3 is for server-side encryption at rest, not in transit. Option E is incorrect because CloudTrail is a logging service and does not enforce encryption.

Answer

Use a VPC endpoint for S3.

Answer

Enable default SSE-S3 encryption on the bucket.

Answer

Enable CloudTrail to monitor for non-encrypted requests.

Question 3

Which TWO actions are recommended for securing data at rest in Amazon S3? (Choose two.)

Accepted Answer

Enable default encryption on the S3 bucket using SSE-S3 or SSE-KMS.. Enabling default encryption on an S3 bucket using SSE-S3 or SSE-KMS ensures that all objects stored in the bucket are encrypted at rest automatically, even if the upload request does not include encryption headers. This satisfies the requirement for securing data at rest by applying server-side encryption to every object written to the bucket.

Answer

Use S3 Bucket Key to reduce KMS request costs.

Answer

Enable S3 Versioning to protect against accidental deletions.

Answer

Configure cross-region replication to replicate data to another bucket.

Question 4

A company uses AWS Glue to process streaming data from Amazon Kinesis Data Streams. The job fails intermittently with a 'MemoryError'. What is the MOST likely cause?

Accepted Answer

The Glue job worker type is too small for the data volume. The 'MemoryError' in AWS Glue indicates that the worker type allocated to the job does not have sufficient memory to process the data volume. Glue workers (Standard, G.1X, G.2X) have fixed memory allocations (e.g., 16 GB for Standard), and if the streaming data from Kinesis exceeds this, the job fails. Increasing the worker type or the number of workers resolves this.

Answer

The Glue job uses too many DynamicFrames

Answer

The S3 output bucket is in a different region

Answer

The Kinesis stream has insufficient shards

Question 5

Refer to the exhibit. The S3 bucket policy above is applied to the bucket "example-bucket". An IAM user attempts to upload an object to the bucket without specifying any encryption header. What is the outcome?

Accepted Answer

The upload fails with an Access Denied error. The Deny statement in the bucket policy denies PutObject if the encryption header is not AES256. Since the user did not specify any encryption header, the condition StringNotEquals 'AES256' evaluates to true, causing the request to be denied with an Access Denied error. Option A is wrong because the Deny overrides the Allow. Option B is wrong because the Deny applies to PutObject, not GetObject. Option C is wrong because the Deny is conditional on encryption header, not default encryption.

Answer

The upload succeeds but the object is not encrypted

Answer

The upload fails because GetObject requires encryption

Answer

The object is uploaded successfully with SSE-S3 encryption by default

Question 6

A company wants to enforce that all data in Amazon S3 is encrypted at rest. They want to automatically reject any PUT request that does not include encryption headers. What S3 feature should they use?

Accepted Answer

Bucket policy with a condition for encryption headers. S3 bucket policies can include a condition that denies PutObject requests if they do not include the required encryption headers (e.g., x-amz-server-side-encryption). This enforces encryption at rest by rejecting unencrypted uploads. Default encryption only automatically encrypts objects that are uploaded without encryption headers, but does not reject them. MFA Delete is for requiring multi-factor authentication for delete operations, not for encryption. S3 Block Public Access controls public access to buckets, not encryption. Therefore, option A is correct.

Answer

Default encryption

Answer

MFA Delete

Answer

S3 Block Public Access

Question 7

A company is using Amazon Kinesis Data Firehose to deliver streaming data to an S3 bucket. The data includes a timestamp field. They want to partition the S3 objects by hour dynamically. The Firehose delivery stream is configured with a prefix like 'year=!{timestamp:yyyy}/month=!{timestamp:MM}/day=!{timestamp:dd}/hour=!{timestamp:HH}/'. However, the objects are not being partitioned as expected; all files end up in a single partition. What is the MOST likely cause?

Accepted Answer

Dynamic partitioning is not enabled in the Firehose delivery stream configuration.. Amazon Kinesis Data Firehose requires dynamic partitioning to be explicitly enabled in the delivery stream configuration in order to use custom partitioning keys and create partition prefixes dynamically. Without enabling dynamic partitioning, the timestamp expressions in the prefix are treated as static strings, resulting in a single partition. Option B is incorrect because buffer size affects delivery frequency, not partitioning behavior; even with large buffers, partitioning would still occur if dynamic partitioning were enabled. Option C is incorrect because time zone differences would cause incorrect hours, not a single partition; all files would still be distributed across hours. Option D is incorrect because IAM permission issues would cause write failures, not mispartitioning; the objects would simply not be delivered.

Answer

The buffer size is set too large, delaying file delivery.

Answer

The timestamp is in UTC but the prefix uses local time.

Answer

The IAM role for Firehose lacks permissions to write to S3 with dynamic prefixes.

Question 8

A data engineer needs to share a dataset stored in Amazon S3 with another AWS account. The bucket policy currently grants access only to the owning account. What is the simplest way to grant cross-account access?

Accepted Answer

Add a bucket policy that grants access to the other account's IAM role. The simplest way to grant cross-account access to an S3 bucket is to add a bucket policy that specifies the other AWS account's IAM role as the principal. This allows the role to access the bucket without requiring additional setup in the target account. Option B (public-read ACL) would make the data publicly accessible, which is not secure and not recommended for cross-account sharing. Option C (using an ACL) is less flexible and does not support granting access to specific IAM roles across accounts. Option D (creating an IAM role in the other account) is unnecessary because the bucket policy can directly grant access to the other account's role.

Answer

Set the object ACL to public-read

Answer

Use an S3 access control list (ACL) to grant access to the other account

Answer

Create an IAM role in the other account and attach a policy to it

Question 9

A data engineer is troubleshooting an Amazon Redshift cluster that is not responding to queries. The engineer suspects that the cluster may have been accidentally deleted. Which AWS service should be used to investigate the deletion?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records API calls made to the AWS environment. To investigate if an Amazon Redshift cluster was accidentally deleted, you would use CloudTrail to review the DeleteCluster API call, including who made the call and when. AWS Config tracks resource configuration changes and can show that a cluster was deleted, but it does not directly record API calls; CloudTrail is the primary service for auditing API activity. Amazon CloudWatch Logs stores log data from applications and services, not API calls. AWS Trusted Advisor provides best practice recommendations, not deletion history.

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Answer

AWS Trusted Advisor

Question 10

A company uses Amazon EMR to process sensitive data. The data engineer needs to ensure that data in transit between EMR and S3 is encrypted. Which THREE configurations achieve this? (Choose THREE.)

Accepted Answer

Configure EMRFS to use server-side encryption with S3 (SSE-S3) and require HTTPS. To ensure encryption in transit between Amazon EMR and S3, you can use server-side encryption with customer-provided keys (SSE-C) with HTTPS (Option D), configure EMRFS to use server-side encryption with S3 (SSE-S3) and require HTTPS (Option B), or use VPC endpoints for S3 with a policy that enforces HTTPS (Option E). Option A (S3 Block Public Access) controls public access, not transit encryption. Option C (SSE-KMS) encrypts data at rest, not in transit. Thus, correct answers are B, D, E.

Answer

Enable S3 Block Public Access on the bucket

Answer

Enable SSE-KMS on the S3 bucket

Question 11

A data team runs a daily AWS Glue ETL job that processes data from an Amazon Redshift cluster and writes results to Amazon S3. The job completes successfully but takes 2 hours longer than expected. The job uses the JDBC connection to Redshift. The Redshift cluster is 4 dc2.large nodes. The Glue job has 10 workers of type G.1X. Which change would MOST likely reduce the job duration?

Accepted Answer

Use the S3 staging option in the Glue connection to unload data from Redshift to S3 first. The JDBC connection in AWS Glue reads data row-by-row from Redshift, which is slow for large datasets. By enabling the S3 staging option in the Glue connection, the job uses Redshift's UNLOAD command to export data to S3 in parallel, then Glue reads from S3. This bypasses the JDBC bottleneck and leverages Redshift's massively parallel processing (MPP) to export data much faster.

Answer

Use Redshift Spectrum to query data directly from S3

Answer

Increase the Redshift cluster size to 8 nodes

Answer

Increase the number of Glue workers to 20

Question 12

Refer to the exhibit. A data engineer creates an IAM policy for a service role used by AWS Glue. What does the condition in the policy enforce?

Accepted Answer

The role can only use the KMS key when the request comes from S3. The condition uses the `kms:ViaService` key with value `s3.amazonaws.com`, which restricts KMS actions to requests originating from Amazon S3. Therefore, the role can only use the KMS key when the request comes from S3, making option D correct. Option A is incorrect because it does not allow any service; option B is incorrect because it specifies Glue instead of S3; option C is incorrect because it limits to decrypting only, but the condition does not specify the action.

Answer

The role can use the KMS key from any AWS service

Answer

The role can only use the KMS key when the request comes from Glue

Answer

The role can only use the KMS key for decrypting data

Question 13

The exhibit shows the output of describe-table for a DynamoDB table. The application is experiencing throttling errors when reading data. What is the MOST likely cause?

Accepted Answer

The table's provisioned read capacity is too low.. The describe-table output shows the table has provisioned read capacity set to 5, but the application is experiencing throttling errors. Throttling occurs when read requests exceed the provisioned read capacity units (RCUs). Increasing the read capacity or implementing retries with exponential backoff would resolve this. The throttling is directly caused by insufficient provisioned read capacity for the workload.

Answer

The sort key is not used correctly for queries.

Answer

The table has a hot partition due to the HASH key.

Answer

The table size is too large, causing slow reads.

Question 14

A data engineer needs to share a dataset stored in an Amazon S3 bucket with another AWS account. The dataset must remain encrypted at rest using AWS KMS. The data engineer creates a bucket policy that grants the other account access to the bucket. However, the other account reports that objects appear encrypted and they cannot decrypt them. What is the most likely cause?

Accepted Answer

The KMS key policy does not grant the other account the kms:Decrypt permission. When using SSE-KMS, the bucket policy alone is not enough; the KMS key policy must also grant the consuming account permission to use the key (kms:Decrypt). The bucket policy controls access to the S3 objects, but KMS key policy controls who can decrypt. Therefore, option A is correct.

Answer

The bucket policy does not grant the s3:GetObject permission

Answer

The other account must use the same KMS key to upload objects

Answer

The objects are encrypted with SSE-S3, which is not supported for cross-account access

Question 15

A company needs to automate the detection of sensitive data in Amazon S3 and generate reports. Which AWS service should be used?

Accepted Answer

Amazon Macie. Amazon Macie is the correct service for automating detection of sensitive data in S3 and generating reports. It uses machine learning to discover and classify sensitive data. Amazon Inspector is for vulnerability management, not sensitive data detection. Amazon GuardDuty is for threat detection. AWS Config is for resource compliance and configuration auditing.

Answer

Amazon Inspector

Answer

Amazon GuardDuty

Answer

AWS Config

Question 16

A data engineer is designing a data pipeline that processes sensitive financial data. The data must be encrypted at rest and in transit. The pipeline uses Amazon Kinesis Data Streams to ingest data and AWS Lambda to process it. Which combination of actions ensures the data is encrypted in transit? (Select TWO.)

Accepted Answer

Enable TLS for Kinesis Data Streams.. Enabling TLS for Kinesis Data Streams encrypts data in transit between producers and the stream. Option B is correct because enabling encryption in transit for the Lambda function's VPC configuration ensures TLS is used when Lambda communicates, such as with Kinesis over a VPC endpoint. Option C is incorrect because SSE-S3 encrypts data at rest in S3, not in transit. Option D is incorrect because encrypting data at rest in Kinesis using KMS does not address encryption in transit. Option E is incorrect because encrypting CloudWatch Logs with KMS is for data at rest.

Answer

Enable Server-Side Encryption (SSE-S3) on the S3 bucket used for data storage.

Answer

Use AWS KMS to encrypt data at rest in Kinesis Data Streams.

Answer

Encrypt the Lambda function's CloudWatch Logs using KMS.

Question 17

A data engineer is troubleshooting an Amazon Redshift cluster that is running slowly. The cluster has 4 dc2.large nodes. The engineer runs a query that scans a large table and notices that the query uses only a single slice instead of all slices. The table is distributed with DISTSTYLE ALL. What is the most likely reason for the query using only one slice?

Accepted Answer

The table uses DISTSTYLE ALL, which stores the entire table on a single slice per node.. DISTSTYLE ALL replicates the entire table to every node, but within each node, the data is stored on a single slice. For dc2.large nodes, which have 2 slices per node, this means that a full table scan will only use one slice per node, not all available slices. This leads to underutilization and slow query performance. Option A is incorrect because the leader node does not execute data queries; it only coordinates them. Queries are executed on compute nodes. Option C is incorrect because WLM queue slots control concurrency, not the number of slices used by a single query. Option D is incorrect because sort keys affect data ordering and compression, not slice distribution.

Answer

The query is running on the leader node instead of the compute nodes.

Answer

The workload management (WLM) queue is configured with a single query slot.

Answer

The table does not have a sort key defined.

Question 18

A data engineer needs to migrate an on-premises PostgreSQL database to Amazon RDS for PostgreSQL. The database is 2 TB and has a continuous stream of write operations. The migration should minimize downtime. Which AWS service should be used?

Accepted Answer

AWS Database Migration Service (DMS). AWS Database Migration Service (DMS) is the correct choice because it supports ongoing replication (change data capture) from an on-premises PostgreSQL source to Amazon RDS for PostgreSQL, enabling a near-zero downtime migration. DMS can handle the 2 TB dataset and continuous write stream by performing a full load followed by continuous replication of changes until the cutover. Other services lack the ability to perform live, transactional replication with minimal interruption.

Answer

AWS DataSync

Answer

AWS Snowball Edge

Answer

AWS Glue

Question 19

A data engineer needs to securely store database credentials used by a Lambda function. The solution must automatically rotate the credentials every 90 days. Which AWS service should the engineer use?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager supports automatic rotation of secrets. Option A is wrong because CloudHSM is a hardware security module, not a secret store with rotation. Option B is wrong because Parameter Store does not natively rotate secrets. Option C is wrong because IAM Roles are for access to AWS services, not for storing database credentials.

Answer

AWS CloudHSM

Answer

AWS Systems Manager Parameter Store

Answer

IAM Roles for Lambda

Question 20

A data engineer needs to audit who accessed specific objects in an S3 bucket over the past 30 days. Which AWS service should be used?

Accepted Answer

Amazon S3 server access logs. Amazon S3 server access logs provide detailed records of requests made to an S3 bucket, including object-level access (e.g., who accessed which object, when, and from where). Option A (AWS Config) is used for resource inventory and compliance, not access auditing. Option B (Amazon CloudWatch Logs) can store and monitor logs but does not generate S3 access logs. Option D (AWS CloudTrail) logs API calls to S3, but by default it records bucket-level operations, not object-level access; CloudTrail can be enabled for data events to log object-level operations, but S3 server access logs are specifically designed for detailed object access auditing and are simpler to enable for this requirement.

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Answer

AWS CloudTrail