DEA-C01 Practice Exam 60 — 20 Questions

Question 1

A data engineer needs to transfer 50 TB of historical data from an on-premises HDFS cluster to Amazon S3. The on-premises network has a 1 Gbps link to AWS. The transfer must complete within 5 days. Which solution is MOST cost-effective and meets the requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use AWS Snowball Edge to physically transfer the data.. AWS Snowball Edge is a physical device that can transfer large amounts of data faster than a network link, especially with a 1 Gbps link that would take about 4.6 days for 50 TB (theoretical max, but actual throughput will be lower due to overhead). Snowball Edge can transfer 50 TB in a few days and is cost-effective for large data volumes. Option A (Amazon S3 Transfer Acceleration) speeds up transfers but still limited by network bandwidth. Option B (AWS DataSync) is efficient for online transfers but may not meet the 5-day deadline over 1 Gbps. Option D (AWS Direct Connect) would require additional setup and cost, and still limited by the 1 Gbps link.

Answer

Use Amazon S3 Transfer Acceleration to speed up the transfer over the internet.

Answer

Use AWS DataSync to transfer the data over the existing network link.

Answer

Use AWS Direct Connect to establish a dedicated network connection.

Question 2

A data engineer is designing a data pipeline using AWS Step Functions to orchestrate multiple AWS Glue ETL jobs. The pipeline must handle failures and retries. Which TWO configurations should the engineer use to ensure the pipeline is resilient? (Choose two.)

Accepted Answer

Configure the state machine to use a 'Catch' rule to handle specific errors and transition to a fallback state. To ensure resilience in AWS Step Functions, the engineer should configure a Catch rule to handle errors by transitioning to a fallback state (Option B) and define a Timeout for each state to prevent the pipeline from hanging indefinitely (Option D). A dead-letter queue (DLQ) is not directly used by Step Functions but by services like Lambda. A fixed retry interval is less effective than exponential backoff. Using a Parallel state is for concurrency, not resilience.

Answer

Configure a dead-letter queue (DLQ) for the state machine

Answer

Set the 'Retry' interval to a fixed value instead of exponential backoff

Answer

Use a 'Parallel' state to run multiple Glue jobs simultaneously

Question 3

A company runs an Amazon EMR cluster that processes sensitive data stored in Amazon S3. The security team requires that all data in transit between the EMR cluster and S3 be encrypted. Which configuration ensures this requirement is met?

Accepted Answer

Configure the S3 endpoint to use TLS and ensure the EMR cluster uses HTTPS for S3 access.. Configuring the S3 endpoint to use TLS and ensuring the EMR cluster uses HTTPS for S3 access enforces encryption in transit between the cluster and S3. Option A is incorrect because enabling in-transit encryption within the EMR cluster using EMRFS encrypts data within the cluster, not data between the cluster and S3. Option B is incorrect because SSE-S3 encrypts data at rest on S3, not data in transit. Option D is incorrect because an S3 access point with a bucket policy denying HTTP requests does not directly configure encryption in transit from the EMR cluster; it only denies non-HTTPS requests, but the cluster could still use HTTPS, and this is a bucket-level enforcement, not a direct configuration for the cluster.

Answer

Enable in-transit encryption within the EMR cluster using EMRFS.

Answer

Enable server-side encryption with S3 managed keys (SSE-S3) on the S3 bucket.

Answer

Use an S3 access point with a bucket policy that denies HTTP requests.

Question 4

A data engineer needs to allow a Lambda function to read data from an S3 bucket in the same account. The Lambda function's execution role has the required permissions, but access is denied. The S3 bucket has a bucket policy that explicitly denies access to any principal that is not from the organization. What is the most likely issue?

Accepted Answer

The Lambda execution role is not part of the AWS organization.. The bucket policy explicitly denies access to any principal that is not from the AWS organization. Since the Lambda execution role is not part of the organization, the explicit deny overrides any allow permissions granted to the role. Option B is incorrect because the VPC endpoint policy is not mentioned in the scenario. Option C is incorrect because the bucket is in the same account. Option D is incorrect because KMS permissions are not relevant to this access denial.

Answer

The Lambda function is in a VPC without an S3 VPC endpoint.

Answer

The S3 bucket is in a different AWS account.

Answer

The Lambda function does not have kms:Decrypt permission.

Question 5

A data engineer needs to ensure that an S3 bucket containing sensitive customer data is encrypted at rest. The company requires that all encryption keys be managed by AWS and rotated annually. Which encryption option meets these requirements?

Accepted Answer

Use server-side encryption with S3-managed keys (SSE-S3). SSE-S3 uses AWS-managed keys and automatically handles annual key rotation, meeting both requirements of encryption at rest and AWS-managed keys with rotation. SSE-KMS also uses AWS-managed keys but does not automatically rotate keys (unless using a custom KMS key with rotation enabled, but the question implies automatic rotation without extra configuration). SSE-C requires customer-provided keys, which violates the requirement that AWS manages the keys. Client-side encryption (B) is not server-side and also involves customer management. Thus, only SSE-S3 fully satisfies the requirements.

Answer

Use server-side encryption with AWS KMS (SSE-KMS)

Answer

Use client-side encryption with AWS KMS

Answer

Use server-side encryption with customer-provided keys (SSE-C)

Question 6

Which TWO of the following are best practices for Amazon Redshift table design? (Choose TWO.)

Accepted Answer

Choose sort keys based on query patterns. Options A and D are correct. Choosing sort keys based on query patterns optimizes data organization for faster retrieval, and specifying distribution keys minimizes data movement across nodes. Option B is wrong because large data loads should use the COPY command, not INSERT statements. Option C is wrong because compression encoding reduces storage and I/O, improving performance despite slightly higher CPU overhead. Option E is wrong because setting distribution style to ALL for all tables can cause excessive data duplication and storage costs; distribution keys should be selected based on table size and join patterns.

Answer

Use INSERT statements for large data loads

Answer

Avoid compression encoding to reduce CPU overhead

Answer

Set distribution style to ALL for all tables

Question 7

An organization wants to audit all API calls made to AWS services for compliance. Which AWS service should be used to capture and store these API calls?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records all API calls made to AWS services and stores them in Amazon S3 for auditing and compliance. AWS Config monitors resource configurations, not API calls. Amazon VPC Flow Logs capture IP traffic information. Amazon CloudWatch Logs stores log data but does not natively capture API calls; it can receive logs from CloudTrail if integrated, but CloudTrail is the primary service for capturing API calls.

Answer

AWS Config

Answer

Amazon VPC Flow Logs

Answer

Amazon CloudWatch Logs

Question 8

A data engineering team needs to ingest streaming data from thousands of IoT devices and store it in Amazon S3 for batch processing. The data arrives at a rate of 10 MB/s, with occasional spikes up to 50 MB/s. The data must be processed in near real-time with minimal latency. Which AWS service should be used for ingestion?

Accepted Answer

Amazon Kinesis Data Streams. Amazon Kinesis Data Streams is designed for real-time streaming data ingestion at scale, handling throughput from megabytes to gigabytes per second with low latency. It can absorb the described 10 MB/s baseline and 50 MB/s spikes by sharding, and integrates directly with AWS Lambda or Kinesis Data Firehose to land data into Amazon S3 for batch processing.

Answer

Amazon DynamoDB Streams

Answer

Amazon SQS

Answer

Amazon S3

Question 9

A company uses AWS Database Migration Service (DMS) to migrate an on-premises Oracle database to Amazon RDS for PostgreSQL. The migration completes successfully, but the data engineer notices that some tables have fewer rows in the target than the source. Which DMS setting should be checked to ensure full data migration?

Accepted Answer

The task logs show that some rows failed to apply due to data type conversion errors.. If some rows failed to apply due to data type conversion errors, those rows would be logged as errors and not written to the target, resulting in fewer rows. AWS DMS task logs capture these failures, and checking them is the direct way to identify rows that were skipped or rejected during migration. This is the most common cause of row count mismatches after a successful DMS task.

Answer

The LOB mode is set to 'Limited LOB mode' instead of 'Full LOB mode'.

Answer

The 'Enable validation' option is turned off.

Answer

The 'Parallel Apply' feature is disabled, slowing down the migration.

Question 10

A financial services company uses AWS Glue ETL jobs to process credit card transaction data stored in Amazon S3. The data includes PII such as names and credit card numbers. The security team requires that all PII be masked before the data is written to the curated zone of the data lake. The data engineer has implemented a Glue job that reads from the raw zone, applies a custom transform to mask credit card numbers using a regular expression, and writes to the curated zone. However, during a recent audit, the security team discovered that some masked data still contained partial credit card numbers (e.g., showing the last four digits) when viewed by analysts who should only see masked data. The company's policy is that credit card numbers must be completely masked, showing only asterisks or a fixed string like "XXXX-XXXX-XXXX-XXXX". The Glue job uses a DynamicFrame and applies a Map transform with a Python function that replaces digits with 'X'. The data is stored in Parquet format. What should the data engineer do to ensure complete masking of credit card numbers?

Accepted Answer

Replace the custom Python Map transform with a built-in Glue Transform for data masking, such as the Mask transform available in Glue Studio.. AWS Glue provides a built-in Mask transform that can be applied directly in Glue Studio or via the AWS Glue API. This transform is designed to reliably obfuscate sensitive data like credit card numbers by replacing them with a fixed string (e.g., 'XXXX-XXXX-XXXX-XXXX') or asterisks, ensuring complete masking regardless of input format. The custom Python Map transform in the current implementation is error-prone because it relies on a regular expression that may not catch all patterns or partial digits, whereas the Mask transform uses predefined logic to guarantee full masking.

Answer

Use an AWS Glue crawler to classify the data and apply a masking rule based on the classification.

Answer

Enable server-side encryption with AWS KMS on the curated S3 bucket.

Answer

Change the output format from Parquet to CSV and use a different write mode.

Question 11

A company runs a data warehouse on Amazon Redshift. Queries are slow, and the team suspects data distribution is skewed. Which approach would best help identify distribution skew?

Accepted Answer

Query the SVV_DISKUSAGE table to examine data distribution across slices. The SVV_DISKUSAGE table provides per-slice data distribution information, allowing you to identify skew by comparing the number of blocks allocated to each slice for a given table. In Amazon Redshift, data is distributed across slices based on the distribution key, and significant variation in block counts across slices indicates distribution skew, which can cause query performance degradation due to uneven workload distribution.

Answer

Check the STL_LOAD_ERRORS table for load failures

Answer

Query the SVV_TABLE_INFO table to see table size

Answer

Review the WLM configuration in the parameter group

Question 12

A company is using AWS Glue to catalog data in Amazon S3. The data is stored in CSV format, but the schema is not consistent across all files. Which TWO actions can the company take to handle schema evolution and ensure the Glue Data Catalog is up to date? (Choose TWO.)

Accepted Answer

Configure the Glue crawler to update the table schema on each run.. Options A and D are correct. Configuring the Glue crawler to update the table schema on each run (A) allows automatic schema evolution, while scheduling the crawler to run periodically (D) ensures that changes in the data are captured. Option B (manual update) is not scalable. Option C (disabling schema update) would prevent automatic updates. Option E (fixed schema) is impractical for evolving data.

Answer

Manually update the Glue Data Catalog tables whenever the schema changes.

Answer

Disable schema update in the crawler and add partitions manually.

Answer

Require all data producers to use a single fixed schema.

Question 13

A financial services company uses Amazon Athena to query a data lake in S3. The data lake contains sensitive financial transactions. The security team has implemented row-level security using views in AWS Glue Data Catalog. Each view is defined with a WHERE clause that filters rows based on the user's IAM role using a custom tag. However, when a data analyst runs a SELECT * FROM view_name in Athena, the query returns all rows, ignoring the row-level filter. The analyst's IAM role has the tag 'department=analytics'. The view was created with a filter condition 'department = current_user_department()', where current_user_department() is a user-defined function that extracts the department tag from the caller's IAM role. The function is defined in the Glue Data Catalog. What is the most likely reason the filter is not applied?

Accepted Answer

The view is not defined with the filter condition properly; the function current_user_department() may not be invoked correctly in the view definition.. The most likely reason is that the user-defined function current_user_department() is not invoked correctly in the view definition. In Athena, views store the SQL logic, and when queried, the filter condition is evaluated. If the function is not registered properly or is not supported in view filters, the query may ignore it. Option A is incorrect because the function is already defined in the Glue Data Catalog. Option B is incorrect because Athena does support user-defined functions in views. Option C is incorrect because the analyst's role does have the tag.

Answer

The user-defined function current_user_department() is not registered in the Glue Data Catalog.

Answer

Athena does not support user-defined functions in views.

Answer

The IAM role does not have the tag 'department=analytics'.

Question 14

A data engineering team is designing a data lake on Amazon S3. They need to store raw data in a format that supports schema evolution and is optimized for analytics with Amazon Athena. Which storage format should they use?

Accepted Answer

Parquet. Parquet is the correct choice because it is a columnar storage format that is highly optimized for Amazon Athena, which can read only the necessary columns to minimize data scanned and reduce query costs. Parquet also supports schema evolution through features like nested data structures and the ability to add or remove columns without rewriting the entire dataset, making it ideal for raw data lakes that must accommodate changing schemas over time.

Answer

CSV

Answer

Avro

Answer

JSON

Question 15

A data engineer needs to monitor and log changes to IAM policies in an AWS account. Which TWO AWS services can be used together to achieve this?

Accepted Answer

AWS CloudTrail. AWS CloudTrail logs all IAM API calls, including policy changes. Amazon CloudWatch Logs can be used to store, monitor, and alert on these log events. Option A (GuardDuty) is a threat detection service, not for logging policy changes. Option B (AWS Config) tracks resource configuration changes but not API calls directly. Option C (VPC Flow Logs) captures network traffic, not IAM activities. Therefore, the correct combination is D and E.

Answer

Amazon GuardDuty

Answer

AWS Config

Answer

VPC Flow Logs

Question 16

A company stores sensitive customer data in an S3 bucket. The security team requires that all data be encrypted at rest using a customer-managed AWS KMS key. However, when a data engineer attempts to upload an object using the AWS CLI, the upload fails with an access denied error. The engineer has s3:PutObject permission on the bucket. Which additional permission is most likely missing?

Accepted Answer

kms:GenerateDataKey. To upload an object with SSE-KMS, the IAM user or role must have kms:GenerateDataKey permission to generate a data key for encryption. Option D is correct because without it, the upload fails. Option A (kms:CreateKey) is for creating keys, not using them. Option B (kms:Decrypt) is for decryption, not upload. Option C (s3:PutObjectAcl) is for ACLs, not encryption.

Answer

kms:CreateKey

Answer

kms:Decrypt

Answer

s3:PutObjectAcl

Question 17

A data engineer is designing a streaming ingestion pipeline using Amazon Kinesis Data Streams with multiple consumers. The data must be processed by a Lambda function for real-time alerts and also stored in Amazon S3 for historical analysis. Which THREE components are needed to implement this architecture? (Choose THREE.)

Accepted Answer

Amazon Kinesis Data Firehose. Amazon Kinesis Data Firehose is the correct component because it is the fully managed service designed to load streaming data into Amazon S3 without requiring custom code. It can directly subscribe to a Kinesis Data Stream as its source and automatically buffer, batch, compress, and deliver records to S3 for historical analysis, making it the ideal choice for the storage leg of this architecture.

Answer

Amazon Kinesis Data Analytics

Answer

Amazon SQS queue

Question 18

Refer to the exhibit. A data engineer is troubleshooting write throttling on the Orders table. The table has a composite primary key (OrderID as partition key, CustomerID as sort key). The engineer notices that writes are throttled even though the write capacity is not fully utilized. What is the most likely cause?

Accepted Answer

Writes are concentrated on a single partition key value.. D is correct because write throttling on an Amazon DynamoDB table occurs when requests exceed the provisioned throughput for a specific partition, even if the overall table write capacity is underutilized. With a composite primary key where OrderID is the partition key, writes concentrated on a single OrderID value (e.g., a hot key) will hit that partition's 3,000 WCU or 1,000 WCU (on-demand) limit, causing throttling while other partitions remain idle.

Answer

The table is empty and has no items.

Answer

A global secondary index (GSI) is consuming write capacity.

Answer

The read capacity units are too low.

Question 19

A company uses AWS Glue to process data from multiple sources. The data is stored in an Amazon S3 data lake. The company needs to transform the data using a custom Python library that is not available in the default Glue environment. What is the MOST efficient way to make this library available to the Glue jobs?

Accepted Answer

Upload the library as a .whl file to Amazon S3 and reference it in the Glue job's --additional-python-modules parameter.. AWS Glue supports adding custom Python libraries by uploading a .whl file to Amazon S3 and referencing it via the `--additional-python-modules` job parameter. This method is the most efficient as it requires no manual node configuration, no custom Docker images, and no runtime pip installs, ensuring the library is automatically distributed to all worker nodes before the job executes.

Answer

Manually install the library on each node in the Glue cluster by editing the bootstrap script.

Answer

Create a custom Docker image with the library and use it in AWS Glue for Ray.

Answer

Use a shell command in the Glue job script to run 'pip install <library>' before the job runs.

Question 20

A data engineer needs to ingest JSON data from an on-premises relational database into Amazon S3 every hour. Which AWS service should be used to set up a scheduled, incremental data transfer?

Accepted Answer

AWS Database Migration Service (DMS) with S3 as target.. AWS DMS is purpose-built for migrating databases to AWS targets, including Amazon S3. It supports ongoing replication (change data capture) and scheduled full-load tasks, making it ideal for hourly incremental transfers from an on-premises relational database to S3 without custom scripting.

Answer

Amazon S3 Transfer Acceleration with a cron job.

Answer

AWS Glue with a JDBC connection and a scheduled crawler.

Answer

Amazon Kinesis Data Firehose with a database source.