DEA-C01 Practice Exam 59 — 20 Questions

Question 1

A data engineer is tasked with designing a disaster recovery solution for a data lake stored in Amazon S3. The data lake contains sensitive customer data that must be replicated to a different AWS Region. The engineer needs to ensure that all objects, including those with encryption using SSE-KMS, are replicated. Which solution meets the requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable S3 Cross-Region Replication (CRR) with the appropriate KMS key and IAM role.. S3 Cross-Region Replication (CRR) with the appropriate KMS key and IAM role is the correct solution because it automatically replicates objects, including those encrypted with SSE-KMS, to a destination bucket in another region. To replicate SSE-KMS encrypted objects, you must specify a KMS key in the destination region and grant the necessary IAM permissions to the replication role. This meets the requirement for disaster recovery of sensitive data.

Answer

Use S3 Batch Operations to copy objects to the destination bucket.

Answer

Use S3 Transfer Acceleration to copy objects across regions.

Answer

Use the AWS CLI s3 sync command scheduled in a cron job.

Question 2

Which TWO are benefits of using Amazon S3 Object Lock? (Choose TWO.)

Accepted Answer

Helps meet regulatory requirements for write-once-read-many (WORM) storage.. Amazon S3 Object Lock helps meet regulatory requirements for write-once-read-many (WORM) storage by allowing you to set retention periods and legal holds on objects. This ensures that data cannot be deleted or overwritten for a specified duration, which is a common requirement for compliance frameworks such as SEC Rule 17a-4 or FINRA.

Answer

Encrypts objects at rest using AWS KMS.

Answer

Automatically transitions objects to lower-cost storage classes.

Answer

Enables automatic versioning of objects.

Question 3

A company uses Amazon Kinesis Data Firehose to deliver data to an Amazon S3 bucket. The data delivery is delayed by up to 5 minutes. The engineer wants to reduce the delay to under 1 minute. Which parameter should be adjusted?

Accepted Answer

Decrease the buffer interval in Kinesis Data Firehose.. Decreasing the buffer interval reduces the time Kinesis Data Firehose waits before delivering a batch, thus lowering latency to under 1 minute. Option A is incorrect because error logging to CloudWatch does not affect delivery timing. Option B is incorrect because increasing the buffer size would actually increase the delay as Firehose waits for more data to accumulate. Option C is incorrect because enabling data compression reduces storage size but has no impact on delivery frequency.

Answer

Enable error logging to CloudWatch.

Answer

Increase the buffer size in Kinesis Data Firehose.

Answer

Enable data compression.

Question 4

A company is building a data lake on Amazon S3. They need to ingest data from multiple sources, including relational databases, streaming data, and log files. Which THREE AWS services can be used to ingest data into the data lake?

Accepted Answer

Amazon Kinesis Data Firehose. Amazon Kinesis Data Firehose is a fully managed service for streaming data ingestion that can capture, transform, and load streaming data into Amazon S3 in near real-time. It supports sources like Amazon CloudWatch Logs, AWS IoT, and custom producers via the Kinesis Agent, making it ideal for log files and streaming data.

Answer

Amazon Athena

Answer

Amazon Redshift Spectrum

Question 5

A data engineer needs to store semi-structured JSON files that are accessed infrequently but must be retrievable within minutes. The data is immutable and must be stored cost-effectively. Which AWS service should the engineer use?

Accepted Answer

Amazon S3 with S3 Standard-IA storage class. Amazon S3 Standard-IA (Infrequent Access) is designed for data that is accessed less frequently but requires rapid retrieval when needed, with retrieval times in milliseconds. It offers lower storage costs than S3 Standard while maintaining high durability and availability, making it ideal for storing immutable semi-structured JSON files that must be retrievable within minutes. The service is cost-effective for infrequently accessed data because it charges a retrieval fee per GB, but the storage price is significantly lower than standard tiers.

Answer

Amazon DynamoDB with on-demand capacity

Answer

Amazon EBS with gp3 volume

Answer

Amazon RDS for PostgreSQL with JSONB data type

Question 6

A data engineer needs to transfer 10 TB of data from an on-premises Hadoop cluster to Amazon S3. The network bandwidth is limited to 100 Mbps, and the transfer must be completed within 48 hours. Which solution meets the requirements?

Accepted Answer

Use AWS Snowball Edge device to transfer data offline. The on-premises Hadoop cluster has 10 TB of data to transfer, but the network bandwidth is only 100 Mbps. At 100 Mbps, the theoretical maximum transfer rate is about 12.5 MB/s, which would take approximately 10 TB / 12.5 MB/s ≈ 800,000 seconds ≈ 222 hours — far exceeding the 48-hour window. AWS Snowball Edge is an offline, physical device that bypasses network constraints entirely, allowing you to transfer the data by shipping the device, which completes within days regardless of bandwidth.

Answer

Use AWS DataSync to transfer data online

Answer

Use S3 Transfer Acceleration over the internet

Answer

Set up AWS Direct Connect to increase bandwidth

Question 7

A company uses AWS DMS to migrate a 2 TB Oracle database to Amazon RDS for PostgreSQL. The migration completes successfully, but data validation shows some tables have missing rows. The task is configured for ongoing replication using change data capture (CDC). What is the MOST likely cause of the missing rows?

Accepted Answer

Source tables missing primary keys. AWS DMS requires a primary key or unique index on source tables to reliably identify and apply row changes during CDC. Without a primary key, DMS cannot uniquely match rows for updates and deletes, and it may also fail to capture all inserts during the initial load plus CDC handoff, resulting in missing rows.

Answer

Source database archive log retention period too short

Answer

Large objects (LOBs) not supported by the target

Answer

Insufficient storage on the DMS replication instance

Question 8

A data engineer needs to store event data from IoT devices that arrives in bursts. The data is key-value and requires single-digit millisecond read and write latency. The engineer also needs to run complex analytical queries on the data for reporting. Which TWO services should be used together? (Choose TWO.)

Accepted Answer

Amazon DynamoDB. Amazon DynamoDB (A) is correct because it is a fully managed key-value and document NoSQL database that delivers consistent single-digit millisecond read and write latency at any scale, making it ideal for bursty IoT event ingestion. Amazon Redshift (C) is correct because it is a petabyte-scale, columnar data warehouse designed for complex analytical queries and reporting, so it complements DynamoDB by handling the analytics workload. Together, DynamoDB captures the high-throughput key-value events while Redshift serves the reporting and complex query needs. Amazon ElastiCache for Redis (B) is an in-memory cache, not a durable primary store for event data, and it does not natively run complex analytical SQL queries. Amazon S3 (D) is object storage with higher latency and no native single-digit millisecond key-value access or complex query engine. Amazon RDS for MySQL (E) is a relational database that generally cannot match DynamoDB's single-digit millisecond latency at burst scale and is not optimized for large-scale complex analytical reporting like Redshift.

Answer

Amazon ElastiCache for Redis

Answer

Amazon S3

Answer

Amazon RDS for MySQL

Question 9

A data engineer needs to store semi-structured JSON data that is accessed infrequently but must be retrievable within minutes. The data is generated by IoT devices and each object is about 500 KB. The engineer wants the most cost-effective storage solution. Which AWS service should be used?

Accepted Answer

Amazon S3 Standard-Infrequent Access (S3 Standard-IA). Amazon S3 Standard-Infrequent Access (S3 Standard-IA) is the correct choice because it is designed for data that is accessed infrequently but requires rapid retrieval (within minutes). The 500 KB JSON objects from IoT devices fit the use case, and S3 Standard-IA offers lower storage costs than S3 Standard while maintaining the same low-latency retrieval performance, making it the most cost-effective option for this scenario.

Answer

Amazon S3 Glacier Deep Archive

Answer

Amazon S3 Standard

Answer

Amazon Elastic Block Store (EBS)

Question 10

Refer to the exhibit. A data engineer deploys this CloudFormation template to create an AWS Glue job. The job fails on the first run with an error: 'AccessDeniedException: User: arn:aws:sts::123456789012:assumed-role/GlueServiceRole/... is not authorized to perform: s3:GetObject on resource: s3://my-bucket/scripts/etl.py'. What is the most likely cause?

Accepted Answer

The IAM role associated with the Glue job does not have an S3 GetObject permission for the script location.. The error message indicates that the IAM role 'GlueServiceRole' assumed by the AWS Glue job does not have the s3:GetObject permission for the script object at s3://my-bucket/scripts/etl.py. AWS Glue requires the execution role to have read access to the script location specified in the 'ScriptLocation' parameter. Without this permission, the job fails immediately on startup because it cannot download and execute the ETL script.

Answer

The ExecutionProperty MaxConcurrentRuns is set to 1, preventing the job from running.

Answer

The MaxRetries is set to 0, so the job does not retry on failure.

Answer

The script location is incorrectly specified; it should be an S3 URI with bucket and key.

Question 11

A company is storing sensitive user data in an Amazon S3 bucket. The security team requires that all data be encrypted at rest using a customer-managed key stored in AWS KMS. The bucket policy must deny any PUT request that does not include the appropriate encryption header. Which bucket policy condition key should be used?

Accepted Answer

s3:x-amz-server-side-encryption-aws-kms-key-id. The `s3:x-amz-server-side-encryption-aws-kms-key-id` condition key allows the bucket policy to enforce that PUT requests include a specific customer-managed KMS key ID in the `x-amz-server-side-encryption-aws-kms-key-id` header, ensuring encryption at rest with the required key. This directly meets the security team's requirement to deny PUT requests that lack the appropriate encryption header tied to a customer-managed KMS key.

Answer

s3:x-amz-server-side-encryption

Answer

s3:x-amz-acl

Answer

aws:SourceArn

Question 12

A company is using AWS Database Migration Service (DMS) to migrate a 2 TB Oracle database to Amazon Aurora PostgreSQL. The migration must have minimal downtime. The source database is highly active with continuous writes. Which DMS migration type and additional configuration should the engineer use?

Accepted Answer

Use a full load migration task followed by ongoing replication (CDC).. A full load migration followed by ongoing replication (CDC) allows the initial data copy to complete while continuously capturing and applying incremental changes from the highly active source. This minimizes downtime by keeping the target database nearly synchronized, requiring only a brief cutover window to stop writes and finalize replication.

Answer

Use a CDC-only migration task to capture changes from the source.

Answer

Use a full load migration task and stop the source database before starting.

Answer

Use a full load migration task with task restart enabled.

Question 13

A company uses Amazon DynamoDB as the primary data store for a gaming application. The application stores user profiles and game state. During peak hours, the application experiences throttling on writes to the UserProfiles table. The table's read capacity is underutilized. Which solution should resolve the write throttling?

Accepted Answer

Increase the provisioned write capacity units for the table.. Write throttling occurs when the number of write requests exceeds the provisioned write capacity units (WCUs) for the DynamoDB table. Since the read capacity is underutilized, the correct solution is to increase the provisioned WCUs to accommodate the peak write traffic. This directly addresses the capacity deficit without affecting read operations.

Answer

Enable DynamoDB Accelerator (DAX) on the table.

Answer

Add a global secondary index (GSI) to the table.

Answer

Configure auto scaling for read capacity units.

Question 14

A data engineer is designing a data lake on Amazon S3. The data is frequently accessed by multiple analytics services, and the company needs to enforce fine-grained access control based on data tags. Which combination of AWS services should be used?

Accepted Answer

AWS Lake Formation with tag-based access control. AWS Lake Formation with tag-based access control (TBAC) is the correct choice because it provides fine-grained, attribute-based access control (ABAC) at the column, row, and cell level across a data lake on S3. By assigning LF-tags to Data Catalog resources and defining permissions based on those tags, you can enforce granular access policies that scale without managing individual user-to-resource mappings. This directly meets the requirement for tag-driven, fine-grained access for multiple analytics services.

Answer

S3 Block Public Access settings

Answer

S3 Access Points with bucket policies

Answer

S3 Object Lambda with IAM policies

Question 15

A company runs an Amazon RDS for PostgreSQL instance that stores financial data. The company requires point-in-time recovery (PITR) with a retention period of 35 days. Additionally, the company needs to create a new database from a specific snapshot every night for testing. Which combination of actions should the data engineer take to meet these requirements?

Accepted Answer

Enable automated backups with a 35-day retention period and create a manual snapshot each night for testing.. Automated backups in Amazon RDS for PostgreSQL support a maximum retention period of 35 days, which satisfies the PITR requirement. Additionally, creating a manual snapshot each night provides a stable, independent copy for testing without interfering with the automated backup schedule or the source database's performance.

Answer

Create a read replica and promote it to a new instance for testing each night.

Answer

Enable Multi-AZ and use the standby instance for testing.

Answer

Disable automated backups to reduce storage costs and take manual snapshots with 35-day retention.

Question 16

An IAM role 'DataLakeRole' has the above S3 bucket policy attached to an S3 bucket. The role is assumed by an AWS Glue job. The Glue job is failing with 'Access Denied' errors when trying to list objects in the bucket. Which action should be added to the policy to fix the issue?

Accepted Answer

Add s3:ListBucket action for the bucket ARN (arn:aws:s3:::my-data-lake).. The Glue job is failing with 'Access Denied' when trying to list objects, which requires the s3:ListBucket permission on the bucket itself (not on objects). Option B correctly adds s3:ListBucket for the bucket ARN (arn:aws:s3:::my-data-lake), which grants permission to list the contents of the bucket. Without this action, even if other permissions exist, the ListObjectsV2 API call used by AWS Glue to enumerate objects will be denied.

Answer

Add s3:ListObjects action for the bucket ARN.

Answer

Add s3:GetObjectVersion action for the object ARN.

Answer

Add s3:ListBucket action for the object ARN (arn:aws:s3:::my-data-lake/*).

Question 17

Which TWO actions can improve the performance of an AWS Glue ETL job that processes large datasets in Amazon S3? (Choose two.)

Accepted Answer

Increase the number of DPUs allocated to the job.. Increasing the number of DPUs allocates more processing power to the Glue job, which can speed up data processing for large datasets. Option D is correct because columnar file formats like Parquet or ORC are more efficient for analytical queries, reduce I/O, and allow better compression compared to row-based formats. Option A is incorrect: increasing crawler frequency only affects the metadata catalog update frequency, not the ETL job performance. Option B is incorrect: using a single Availability Zone for the S3 bucket does not improve performance and may reduce availability. Option E is incorrect: using a single large file can reduce parallelism, as distributed processing benefits from splitting data into multiple files to be processed in parallel by different executors.

Answer

Increase the frequency of the Glue crawler.

Answer

Use a single Availability Zone for the S3 bucket.

Answer

Use a single large file instead of many small files.

Question 18

A company needs to encrypt data in transit between an EC2 instance and an S3 bucket. Which method should be used?

Accepted Answer

Use HTTPS endpoints. HTTPS endpoints encrypt data in transit between EC2 and S3 using TLS/SSL, ensuring confidentiality and integrity over the public internet. S3 supports HTTPS natively on its REST endpoints, and the AWS SDKs default to HTTPS, making this the simplest and most secure method for encrypting data in motion.

Answer

Use plain HTTP

Answer

Use an IPsec VPN

Answer

Server-side encryption (SSE)

Question 19

Refer to the exhibit. A data engineer runs the AWS CLI command to describe a Glue job. The job is expected to process new data incrementally using job bookmarks. However, the job reprocesses all data every time it runs. What is the MOST likely reason?

Accepted Answer

The ETL script does not use the 'transformation_ctx' parameter in its DynamicFrame transformations.. AWS Glue job bookmarks rely on the `transformation_ctx` parameter to track state. Without it, Glue cannot identify which data has already been processed, causing the job to reprocess all data on every run. The `transformation_ctx` must be passed to each DynamicFrame transformation (e.g., `apply_mapping`, `filter`, `join`) to enable bookmark-based incremental processing.

Answer

The job bookmark option is set to 'job-bookmark-enable' but should be 'job-bookmark-disable'.

Answer

The job's MaxRetries is set to 0, which disables bookmarks.

Answer

The Glue job's command name is 'glueetl', which does not support job bookmarks.

Question 20

A company is using Amazon S3 to store sensitive data. The security team requires that all data be encrypted at rest using a customer-managed AWS KMS key. The data engineer must ensure that only a specific IAM role can decrypt the data. Which policy should the data engineer attach to the KMS key?

Accepted Answer

A KMS key policy that allows the IAM role to perform kms:Decrypt. KMS key policies are the primary mechanism for controlling access to a customer-managed KMS key. By specifying the IAM role as a principal in the key policy and granting kms:Decrypt, you ensure that only that role can decrypt data encrypted with this key, regardless of any IAM policies that might otherwise allow broader access.

Answer

An IAM user policy that allows kms:Decrypt for the specific key

Answer

An IAM policy attached to the role that allows kms:Decrypt

Answer

An S3 bucket policy that denies access unless encryption is used