DEA-C01 Practice Exam 60 — 20 Questions

Question 1

A data engineer is troubleshooting a slow Amazon Redshift query that joins a large fact table with several dimension tables. The EXPLAIN plan shows a hash join on the distribution key, but the query still runs slowly. The fact table is distributed by KEY(column_x) and the dimension tables are distributed ALL. The engineer notices that the fact table has a high number of rows with the same value in column_x. What is the most likely cause of the slow performance?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The fact table's distribution key column has data skew, causing uneven data distribution across nodes.. Data skew in the distribution key column_x causes some slices to hold a disproportionate number of rows, leading to uneven workload distribution during the hash join. The EXPLAIN plan shows a hash join on the distribution key, which should be efficient if data is evenly distributed, but skew forces the node with the most rows to become a bottleneck, slowing the entire query.

Answer

The dimension tables should be distributed by KEY instead of ALL.

Answer

The Redshift cluster does not have enough disk space.

Answer

The fact table does not have a sort key.

Question 2

A data engineer receives an alert that an AWS KMS key has been scheduled for deletion by mistake. What is the immediate action to prevent the key from being deleted?

Accepted Answer

Cancel the key deletion from the KMS console or API.. When a KMS key is scheduled for deletion, the deletion can be canceled from the AWS KMS console or via the CancelKeyDeletion API during the pending deletion period. This immediate action restores the key to its previous state and prevents it from being deleted. Option B is incorrect because creating a new key does not cancel the deletion of the existing key. Option C is incorrect because deleted KMS keys cannot be restored; the default waiting period of 7–30 days exists specifically to allow cancellation. Option D is incorrect because disabling the key does not affect the deletion schedule.

Answer

Create a new KMS key and re-encrypt the data.

Answer

Wait for the key to be deleted and restore it from backup.

Answer

Disable the key immediately to stop usage.

Question 3

A company uses Amazon DynamoDB as the primary data store for a high-traffic application. Recently, read latency has increased significantly. The DynamoDB table has on-demand capacity mode. Which action is MOST effective to reduce read latency?

Accepted Answer

Add a DynamoDB Accelerator (DAX) cluster in front of the table. DynamoDB Accelerator (DAX) is an in-memory cache purpose-built for DynamoDB that reduces read latency from single-digit milliseconds to microseconds for eventually consistent reads. For a high-traffic, read-heavy application on on-demand mode, adding a DAX cluster in front of the table is the most direct and effective way to cut read latency without changing capacity mode or table architecture.

Answer

Switch the table to provisioned capacity mode with higher read capacity

Answer

Increase the read capacity units in the table's auto scaling settings

Answer

Enable DynamoDB Global Tables to distribute reads across regions

Question 4

A company uses Amazon Kinesis Data Firehose to deliver data to an Amazon S3 bucket. The data is in JSON format and contains a 'timestamp' field with a Unix epoch value. The company wants to partition the S3 objects by year, month, day, and hour based on the timestamp. What is the MOST efficient method to achieve this?

Accepted Answer

Use the dynamic partitioning feature of Kinesis Data Firehose with inline parsing to extract the timestamp and create the S3 prefix.. Kinesis Data Firehose dynamic partitioning with inline parsing extracts the 'timestamp' field from each JSON record and uses it to build the S3 prefix (year/month/day/hour) automatically as records are delivered. This is the native, serverless, most efficient approach because Firehose handles the partitioning logic per-record without any additional compute services. It also supports JQ expressions for extracting and formatting the timestamp into the desired prefix pattern.

Answer

Configure a custom S3 prefix in Firehose using the 'YYYY/MM/dd/HH' format based on the current time.

Answer

Use an AWS Glue ETL job to read from Firehose, partition, and write to S3.

Answer

Use Amazon Athena to run a CTAS query that partitions the data by timestamp.

Question 5

A data engineer needs to monitor the number of records processed by an AWS Glue ETL job. Which CloudWatch metric should the engineer use?

Accepted Answer

glue.driver.aggregate.numRecords. Glue emits a 'glue.driver.aggregate.numRecords' metric for the number of records processed. Option A is wrong because 'glue.driver.aggregate.elapsedTime' is for time. Option C is wrong because 'glue.driver.aggregate.bytesRead' is for bytes. Option D is wrong because 'glue.driver.aggregate.recordsRead' is not a standard metric.

Answer

glue.driver.aggregate.elapsedTime

Answer

glue.driver.aggregate.bytesRead

Answer

glue.driver.aggregate.recordsRead

Question 6

Refer to the exhibit. A data engineer runs the above AWS CLI command to view the table metadata in the AWS Glue Data Catalog. The data is stored as CSV in S3 with partitions by year and month. When querying the table using Amazon Athena, no data is returned. What is the most likely cause?

Accepted Answer

The partitions have not been added to the Glue Data Catalog.. The AWS CLI command shown only retrieves table metadata, not partition metadata. In AWS Glue, partitions must be explicitly added to the Data Catalog via `MSCK REPAIR TABLE`, `ALTER TABLE ADD PARTITION`, or a Glue crawler. Without partition metadata, Athena cannot locate the data files under the partitioned S3 paths (e.g., `s3://bucket/year=2024/month=01/`), resulting in zero rows returned even though the table schema is defined.

Answer

The SerDe is not compatible with CSV files.

Answer

The S3 location points to a file instead of a folder.

Answer

The column data types are incorrect for the CSV data.

Question 7

An e-commerce application uses Amazon ElastiCache for Redis to cache product catalog data. The cache currently uses lazy loading. The team wants to ensure that frequently accessed product data is always fresh. Which caching strategy should they implement?

Accepted Answer

Write-through caching. Write-through caching ensures that data is written to the cache simultaneously with the database, guaranteeing that frequently accessed product data is always fresh. This strategy eliminates stale reads by synchronously updating the cache on every write, which directly addresses the requirement for freshness without relying on expiration or lazy population.

Answer

Set a TTL of 5 minutes for all cached items

Answer

Use database read replicas to serve data

Answer

Lazy loading with TTL

Question 8

A company is building a data lake on Amazon S3. Data arrives from multiple sources in JSON, CSV, and Avro formats. The data must be transformed to Parquet and partitioned by date and source. Which TWO services can perform this transformation with minimal custom code? (Choose TWO.)

Accepted Answer

Amazon EMR with Spark. Amazon EMR with Spark (A) is correct because Spark natively reads JSON, CSV, and Avro, and can write Parquet with partitionBy('date','source') using built-in DataFrame APIs, requiring only a small script rather than a custom transformation engine. AWS Glue ETL jobs (D) are correct because Glue provides managed, serverless Spark with built-in DynamicFrame readers/writers for JSON, CSV, and Avro, plus automatic schema inference and native Parquet output with partition keys, minimizing custom code. AWS Lake Formation (B) is a permission and metadata/catalog governance layer, not a data transformation engine. Amazon Athena CTAS (C) can convert formats and partition results, but it is query-oriented and less suited to general multi-format ETL pipelines. Amazon Kinesis Data Firehose (E) is a streaming delivery service that can convert to Parquet via Glue schema, but it does not perform the required multi-source batch transformation and partitioning logic.

Answer

AWS Lake Formation

Answer

Amazon Athena CTAS queries

Answer

Amazon Kinesis Data Firehose

Question 9

A company runs a data processing pipeline on Amazon EMR. The pipeline reads data from S3, processes it with Spark, and writes results back to S3. The engineer notices that the cluster is underutilized and wants to reduce costs. Which TWO actions should the engineer take? (Choose TWO.)

Accepted Answer

Use Spot instances for task nodes.. Option A is correct because using Spot instances for task nodes is a standard EMR cost-optimization technique: task nodes perform only HDFS-non-persistent work (Spark executors), so they can be interrupted without data loss, and Spot capacity typically costs significantly less than On-Demand. Option B is correct because configuring the cluster to terminate after the job completes (a transient cluster, e.g., via --auto-terminate or a termination-protected=false setting) stops paying for idle EC2 instances once the batch pipeline finishes, directly addressing the underutilization. Option C is wrong because enlarging the master node does not improve processing throughput and increases cost, since the master only manages the cluster. Option D is wrong because EMRFS consistent view is a data-consistency feature for S3 reads/writes, not a cost-reduction mechanism. Option E is wrong because adding core nodes increases cost and capacity rather than reducing spend, and the cluster is already underutilized.

Answer

Change the master node to a larger instance type.

Answer

Enable EMRFS consistent view.

Answer

Increase the number of core nodes to improve parallelism.

Question 10

A company is using Amazon DynamoDB to store session data for a web application. The data engineer needs to ensure that the data is encrypted at rest. Which action should the data engineer take?

Accepted Answer

Ensure encryption at rest is enabled on the DynamoDB table (default).. DynamoDB tables are encrypted at rest by default using AWS Key Management Service (KMS) with an AWS owned key. The data engineer does not need to take any additional action to enable encryption at rest, as it is automatically enabled for all new DynamoDB tables. This ensures that all data stored on disk, including the table's primary key, local secondary indexes, and global secondary indexes, is encrypted before being written to SSDs in AWS data centers.

Answer

Enable encryption at rest on the DynamoDB Accelerator (DAX) cluster.

Answer

Use client-side encryption before writing to DynamoDB.

Answer

Enable DynamoDB Time to Live (TTL) to encrypt data.

Question 11

A data engineer needs to store streaming data from IoT devices for real-time analytics. The data has a fixed schema and requires low-latency queries. Which AWS service should be used?

Accepted Answer

Amazon Timestream. Amazon Timestream is a time-series database purpose-built for IoT and operational applications that generate large volumes of time-stamped data. It automatically manages data retention and storage tiers (memory and magnetic) to provide fast query performance for recent data and cost-effective storage for historical data, making it ideal for real-time analytics on streaming IoT data with a fixed schema.

Answer

Amazon DynamoDB

Answer

Amazon Redshift

Answer

Amazon S3

Question 12

A data engineer needs to transform a large dataset stored in Amazon S3 using Apache Spark. The engineer wants to minimize startup time and use a serverless approach. Which AWS service should the engineer use?

Accepted Answer

AWS Glue. AWS Glue provides a serverless Spark environment with fast startup. Option A is wrong because Amazon Redshift is a data warehouse, not a Spark environment. Option B is wrong because Amazon EMR requires cluster provisioning, which increases startup time. Option D is wrong because Amazon Athena is for querying data, not for transforming with Spark.

Answer

Amazon Redshift

Answer

Amazon EMR

Answer

Amazon Athena

Question 13

A company stores sensitive customer data in an S3 bucket. The data engineer needs to ensure that all data is encrypted at rest. Which S3 feature should be enabled?

Accepted Answer

Default encryption. Default encryption ensures that all new objects written to the bucket are encrypted at rest using SSE-S3, SSE-KMS, or SSE-C. Option A is incorrect because S3 Versioning tracks object versions but does not encrypt data. Option B is incorrect because S3 Block Public Access controls public access, not encryption. Option C is incorrect because the aws:SecureTransport condition enforces encryption in transit, not at rest.

Answer

S3 Versioning

Answer

S3 Block Public Access

Answer

Bucket policy requiring aws:SecureTransport

Question 14

A data engineer is designing a data lake on Amazon S3 that must comply with a regulatory requirement to prevent any data from being overwritten or deleted for 7 years after creation. Which S3 feature should be used?

Accepted Answer

S3 Object Lock with retention mode set to COMPLIANCE. S3 Object Lock with retention mode set to COMPLIANCE ensures that objects cannot be overwritten or deleted for the specified retention period (7 years). The retention period cannot be shortened or removed by any user, including the root user, making it suitable for regulatory compliance. Option A is incorrect because a bucket policy that denies s3:DeleteObject can be modified or removed, and it does not prevent overwrites. Option B is incorrect because MFA Delete requires an additional authentication factor but can still be disabled by an authorized user, and it does not enforce a retention period. Option D is incorrect because bucket versioning alone does not prevent deletion; it only creates delete markers, and objects can still be permanently deleted.

Answer

S3 bucket policy that denies s3:DeleteObject

Answer

S3 bucket versioning with MFA Delete

Answer

S3 bucket versioning only

Question 15

A company is using Amazon Redshift for analytics and needs to ensure that all data is encrypted at rest. The current cluster does not have encryption enabled. What is the most efficient way to enable encryption?

Accepted Answer

Create a snapshot of the cluster and restore it to a new cluster with encryption enabled. Redshift does not support enabling encryption on an existing cluster; a new encrypted cluster must be created and data migrated. Modifying the cluster configuration or parameter groups does not enable encryption. Creating a snapshot and restoring it to a new cluster with encryption enabled is the standard approach.

Answer

Change the cluster parameter group to enable encryption

Answer

Modify the cluster configuration to enable encryption

Answer

Use AWS DMS to migrate data to a new encrypted cluster

Question 16

A data engineering team needs to encrypt data at rest in an Amazon S3 bucket that stores sensitive customer information. The team must use an AWS Key Management Service (AWS KMS) customer managed key with automatic rotation enabled. Which configuration meets these requirements?

Accepted Answer

Use default encryption with SSE-KMS and specify the customer managed key ID.. It enables SSE-KMS with a customer managed key that supports automatic key rotation, meeting the requirement for a customer managed key with automatic rotation. Option B is incorrect because SSE-S3 uses AWS managed keys that are not customer-controlled and do not support automatic rotation. Option C is incorrect because SSE-C requires the customer to provide and manage their own keys, and does not support automatic rotation. Option D is incorrect because leaving the key ID empty defaults to the AWS managed KMS key, which is not a customer managed key and does not support automatic rotation.

Answer

Use default encryption with SSE-S3.

Answer

Use default encryption with SSE-C and provide a customer-provided key.

Answer

Use default encryption with SSE-KMS and leave the key ID empty to use the AWS managed key.

Question 17

A company uses a Kinesis Data Firehose delivery stream to load data into an S3 bucket. The data is in JSON format and must be converted to Parquet before landing in S3. Which steps are required to achieve this? (Choose THREE.)

Accepted Answer

Configure the Firehose delivery stream to enable data format conversion to Parquet.. Kinesis Data Firehose natively supports converting incoming data from JSON to Parquet format. This conversion is enabled directly in the delivery stream configuration, eliminating the need for separate processing steps.

Answer

Store the schema in Amazon DynamoDB.

Answer

Use Kinesis Data Analytics to convert the data.

Question 18

A company is designing a data ingestion pipeline for clickstream data from a website. The data must be ingested in near real-time. Which TWO services can be used together to build this pipeline?

Accepted Answer

Amazon Kinesis Data Streams. Amazon Kinesis Data Streams (A) is correct because it is designed for real-time streaming ingestion of high-volume data such as clickstream events, allowing producers to continuously write records that can be processed within milliseconds by consumers. Amazon Kinesis Data Firehose (D) is correct because it can consume streaming data and reliably load it into destinations like S3, Redshift, or Elasticsearch in near real-time, making it a natural complement to Kinesis Data Streams for building an end-to-end ingestion pipeline. Together, Kinesis Data Streams captures and buffers the clickstream events while Firehose delivers them to downstream storage or analytics services with minimal latency. Amazon SQS (B) is a message queue for decoupling applications but is not purpose-built for real-time streaming analytics pipelines. Amazon S3 (C) is a storage service, not an ingestion mechanism, and Amazon DynamoDB (E) is a NoSQL database, so neither serves as the streaming ingestion component required here.

Answer

Amazon Simple Queue Service (SQS)

Answer

Amazon S3

Answer

Amazon DynamoDB

Question 19

A company needs to share a dataset stored in an S3 bucket with a partner account. The dataset contains sensitive information, so the company wants to ensure that the partner account can only access the data using a specific VPC endpoint in the partner's account. Which S3 bucket policy condition key should be used?

Accepted Answer

aws:SourceVpce. The aws:SourceVpce condition key restricts access to a specific VPC endpoint, ensuring the partner can only access the data through that endpoint. Option A is wrong because aws:SourceVpc restricts to a VPC, not a VPC endpoint. Option B is wrong because aws:SourceArn restricts to a resource ARN, not a network endpoint. Option C is wrong because aws:SourceIp restricts to an IP address, which does not meet the requirement.

Answer

aws:SourceVpc

Answer

aws:SourceArn

Answer

aws:SourceIp

Question 20

A data engineer applies the above IAM policy to a user. The user attempts to upload an object to the bucket 'my-data-lake' without specifying server-side encryption. What will happen?

Accepted Answer

The upload fails because the condition requires encryption. The IAM policy includes a condition that requires the `s3:x-amz-server-side-encryption` header to be present with a value of `AES256`. When the user attempts to upload an object without specifying server-side encryption, the condition is not satisfied, so the `s3:PutObject` permission is denied. This causes the upload to fail, regardless of any bucket default encryption settings or bucket policies.

Answer

The upload fails only if the bucket has a default encryption setting

Answer

The upload succeeds if the bucket policy allows unencrypted uploads

Answer

The upload succeeds because the policy allows s3:PutObject