DEA-C01 Practice Exam 61 — 20 Questions

Question 1

A company runs an e-commerce platform that generates clickstream data from user interactions on their website. The data is sent as JSON objects via HTTP POST to an API Gateway endpoint, which triggers a Lambda function that writes each record to a Kinesis Data Stream (100 shards). A second Lambda function consumes the stream, transforms the data (enriches with geolocation from a DynamoDB table), and writes to a Kinesis Data Firehose delivery stream that delivers Parquet files to an S3 data lake every 5 minutes. The system has been working for months, but recently the Firehose delivery stream started showing 'DeliveryFailed' errors for a subset of records. The errors point to 'InvalidData' from the Lambda transformation. The engineer reviews the Lambda transformation code and notices that the geolocation lookup occasionally fails because the DynamoDB table has a throttling issue. The engineer needs to handle these failures gracefully so that records that fail enrichment are still delivered to S3 with a null geolocation field, without blocking other records. Which course of action should the engineer take?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Modify the Lambda function to catch exceptions during the geolocation lookup, set the geolocation field to null, and continue processing the record.. The requirement is to keep records flowing to S3 with a null geolocation when enrichment fails, without blocking other records. Wrapping the DynamoDB lookup in a try/catch inside the Lambda transformation, setting geolocation to null on failure, and returning the record as 'Ok' ensures Firehose treats it as successfully transformed and delivers it. This is the standard graceful-degradation pattern for Firehose Lambda transformations.

Answer

Configure the Kinesis Data Firehose delivery stream to send failed records to a dead-letter queue (DLQ) for later reprocessing.

Answer

Modify the Lambda function to send failed records to a separate Kinesis Data Stream for manual processing.

Answer

Increase the read capacity units (RCUs) on the DynamoDB table to eliminate throttling.

Question 2

Refer to the exhibit. A data engineer is using a Kinesis Data Stream with one shard. The application writes 2000 records per second, each 1 KB. The put record calls are frequently throttled. What is the most likely cause?

Accepted Answer

The stream has only one shard, which limits writes to 1000 records per second. A Kinesis Data Stream shard has a write throughput limit of 1,000 records per second (or 1 MB per second). Since the application is writing 2,000 records per second (each 1 KB) to a single shard, it exceeds the shard's record-per-second quota, causing the PutRecord calls to be throttled. The solution is to increase the number of shards to at least two to distribute the load.

Answer

The retention period of 24 hours is too short

Answer

The stream uses KMS encryption, causing additional latency

Answer

Enhanced monitoring is not enabled, causing performance issues

Question 3

A data engineer sees the CloudWatch log entry in the exhibit for a Lambda function that processes data from an Amazon SQS queue. What is the MOST likely cause of the timeout?

Accepted Answer

The Lambda function's timeout is too short for the processing required.. The CloudWatch log entry shows a Lambda invocation timing out, which directly indicates the function's configured timeout is shorter than the time needed to process the SQS message. Lambda timeouts are a hard limit (max 15 minutes), and when exceeded, the invocation is terminated and the message returns to the queue. Increasing the timeout (or optimizing the code) resolves the issue.

Answer

The Lambda function's reserved concurrency is set too low.

Answer

The Lambda function is running out of memory.

Answer

The SQS queue's visibility timeout is set too low.

Question 4

Refer to the exhibit. A data engineer runs the command on an object in S3. The engineer expected the object to have a tag 'type=raw' but sees no metadata. What is the likely cause?

Accepted Answer

Object tags are not returned by head-object; use get-object-tagging instead. The head-object command does not return object tags; you must use the get-object-tagging command to retrieve tags. Option B is incorrect because the head-object command succeeds regardless of region, and region does not affect tag visibility. Option C is incorrect because bucket policies can deny access but do not prevent tags from being returned by head-object; they would affect get-object-tagging instead. Option D is incorrect because lifecycle rules do not remove tags from objects; they may transition or expire objects but do not strip metadata.

Answer

The S3 bucket is in a different AWS Region

Answer

The bucket policy blocks reading tags

Answer

The object was created without tags because of lifecycle rules

Question 5

The exhibit shows an S3 bucket policy. What is the effect of this policy?

Accepted Answer

Allows only GetObject and PutObject over HTTPS.. The S3 bucket policy in the exhibit uses a condition key `aws:SecureTransport` set to `true`, which restricts access to HTTPS only. The `Effect` is `Allow` for `s3:GetObject` and `s3:PutObject` actions, meaning only these two actions are permitted over HTTPS. This matches option D.

Answer

Allows all S3 actions over HTTPS only.

Answer

Allows all S3 actions to the bucket over any protocol.

Answer

Denies all S3 actions to the bucket.

Question 6

A data pipeline uses AWS Glue to process data from an S3 data lake. The pipeline fails intermittently with a 'ThrottlingException' when writing to a DynamoDB table. What is the MOST likely cause?

Accepted Answer

The DynamoDB table's write capacity is insufficient for the workload.. A ThrottlingException from DynamoDB indicates that the request rate to the table has exceeded the provisioned write capacity. AWS Glue jobs can generate high-throughput writes, and if the DynamoDB table's write capacity units (WCUs) are not sufficient to handle the burst, DynamoDB will throttle the requests. This is the most direct cause of the intermittent failure described.

Answer

The network connection between Glue and DynamoDB is unstable.

Answer

The Glue job's timeout setting is too low.

Answer

The Glue job does not have sufficient IAM permissions to write to DynamoDB.

Question 7

Which THREE factors should be considered when choosing between AWS Glue and Amazon EMR for data transformation? (Choose three.)

Accepted Answer

EMR allows fine-grained control over cluster configuration and software.. Amazon EMR provides full control over cluster configuration, including the ability to customize software, install libraries, and tune Spark, Hadoop, or Hive parameters. This fine-grained control is essential for complex or specialized data transformation pipelines that require specific versions or custom configurations.

Answer

Glue automatically stores data in S3 after transformation.

Answer

EMR supports real-time stream processing with Spark Streaming.

Question 8

Refer to the exhibit. A data engineer runs the above CLI command and sees the output. The security team requires that the RDS instance not be accessible from the internet. Which change should the engineer make?

Accepted Answer

Modify the DB instance to set PubliclyAccessible to false.. Setting the `PubliclyAccessible` attribute to `false` ensures that the RDS instance is not assigned a public IP address and is not reachable from the internet. This directly satisfies the security team's requirement, as the instance will only be accessible from within the VPC. The CLI command shown modifies the DB instance, and this parameter is the standard AWS mechanism to control internet accessibility for RDS.

Answer

Change the storage type to io1 for better performance.

Answer

Enable Multi-AZ deployment to improve security.

Answer

Update the VPC security group to deny inbound traffic from 0.0.0.0/0.

Question 9

A data engineer is troubleshooting an AWS Glue ETL job that fails with the error: 'An error occurred while calling o123.pyWriteDynamicFrame. Access Denied when writing to S3 bucket: my-bucket'. The job uses a Glue service role named 'GlueServiceRole'. Which TWO actions should the engineer take to resolve the issue? (Choose TWO.)

Accepted Answer

Check if the S3 bucket policy denies access from the GlueServiceRole.. The error 'Access Denied when writing to S3 bucket' during pyWriteDynamicFrame indicates an S3 authorization failure for the Glue job's execution role, so option D is correct: the engineer must verify that the IAM policy attached to GlueServiceRole includes s3:PutObject (and typically s3:PutObjectAcl) on the target bucket/prefix, since Glue writes output objects to S3 using that role. Option C is also correct because an explicit Deny in the S3 bucket policy overrides any Allow in the IAM policy, so the engineer must check whether the bucket policy denies access from GlueServiceRole. Option A is wrong because disabling S3 Block Public Access is unrelated to a role-based write failure and would weaken security without fixing the permission issue. Option B is wrong because the failure is writing to S3, not to the Glue Data Catalog, so Data Catalog permissions would not resolve the S3 Access Denied error. Option E is wrong because S3 is accessed via AWS public service endpoints and does not require the Glue job to be in the same VPC as the bucket; VPC placement only matters for private endpoint configurations, not for this authorization error.

Answer

Disable S3 Block Public Access on the bucket.

Answer

Grant the GlueServiceRole permission to write to the AWS Glue Data Catalog.

Answer

Ensure the Glue job is in the same VPC as the S3 bucket.

Question 10

An e-commerce company wants to capture clickstream data from its website and store it in Amazon S3 for analytics. The data arrives continuously and the company needs near-real-time processing. Which solution is most appropriate?

Accepted Answer

Amazon Kinesis Data Firehose. Amazon Kinesis Data Firehose is the most appropriate solution because it is a fully managed service designed to ingest streaming data and deliver it to destinations like Amazon S3 with near-real-time latency. The company needs continuous clickstream capture and near-real-time processing, which Firehose provides. Option A (AWS Data Pipeline) is for batch processing, not streaming. Option B (AWS Snowball Edge) is for offline data transfer, not real-time. Option D (S3 Transfer Acceleration) improves upload speed but is not a streaming ingestion service.

Answer

AWS Data Pipeline

Answer

AWS Snowball Edge

Answer

Amazon S3 Transfer Acceleration

Question 11

A company has multiple AWS accounts and wants to centrally manage permissions and access to data lakes. They have enabled AWS Organizations and want to use a single set of policies that apply to all accounts. Which policy type should be used at the organization level?

Accepted Answer

Service control policies (SCPs). Service Control Policies (SCPs) are used in AWS Organizations to centrally manage permissions across accounts. Option A (IAM policies) are attached to IAM users/roles within an account, not across accounts. Option B (KMS key policies) control access to KMS keys. Option C (S3 bucket policies) are specific to S3 buckets.

Answer

IAM policies

Answer

KMS key policies

Answer

S3 bucket policies

Question 12

A data engineer is designing a data lake on Amazon S3 and needs to ensure that objects are automatically encrypted at rest using server-side encryption with AWS KMS. Which bucket policy statement achieves this?

Accepted Answer

Deny PutObject requests where the x-amz-server-side-encryption header is not set to aws:kms.. It enforces server-side encryption with AWS KMS (SSE-KMS) by denying any PutObject request that does not include the `x-amz-server-side-encryption` header set to `aws:kms`. This bucket policy ensures that all objects written to the S3 bucket are automatically encrypted at rest using AWS KMS, meeting the requirement for mandatory encryption with a specific key management service.

Answer

Deny PutObject requests that do not include the x-amz-server-side-encryption header.

Answer

Deny PutObject requests where the x-amz-server-side-encryption header is not set to AES256.

Answer

Allow PutObject requests only if the x-amz-server-side-encryption header is set to AES256.

Question 13

Refer to the exhibit. A data engineer is configuring an IAM policy for a Lambda function that writes transformed data to S3. The function writes to both 'example-bucket/data/' and 'example-bucket/public/'. The policy is intended to enforce server-side encryption with SSE-S3 for all objects written to the 'public/' prefix, while allowing all operations on other prefixes. However, the Lambda function is failing with an AccessDenied error when writing to 'example-bucket/public/'. What is the most likely cause?

Accepted Answer

The Lambda function is not setting the 'x-amz-server-side-encryption' header to 'AES256' when writing to 'public/'.. The policy enforces SSE-S3 encryption for objects written to the 'public/' prefix. When a Lambda function writes to S3 without setting the 'x-amz-server-side-encryption' header to 'AES256', the request fails with an AccessDenied error if the bucket policy requires SSE-S3. The policy explicitly denies PutObject unless the encryption header is present, so the function must include this header to succeed.

Answer

The policy denies DeleteObject on 'public/'.

Answer

The policy denies PutObject on 'public/' unconditionally.

Answer

The policy does not allow GetObject for 'public/'.

Question 14

An organization needs to audit all access to their S3 buckets for compliance purposes. They want to log both successful and failed API calls. Which AWS service should be used?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records all API calls made to S3, including both successful and failed requests, and delivers log files to an S3 bucket for auditing and compliance. CloudTrail captures management events (e.g., CreateBucket) and, when enabled, data events (e.g., GetObject, PutObject) for S3, providing a complete audit trail of access.

Answer

Amazon CloudWatch Logs

Answer

AWS Config

Answer

VPC Flow Logs

Question 15

A company is using Amazon EMR to process large datasets stored in Amazon S3. The data engineer wants to reduce the time it takes to read data from S3 by optimizing the data format. Which file format should the engineer recommend?

Accepted Answer

Parquet. Parquet is the correct choice because it is a columnar storage format that significantly reduces the amount of data read from Amazon S3 during analytical queries. By storing data column-wise, Parquet enables predicate pushdown and compression, which minimizes I/O and speeds up data processing in Amazon EMR, especially for large datasets.

Answer

CSV

Answer

ORC

Answer

JSON

Question 16

Refer to the exhibit. A data engineer needs to connect to the Redshift cluster from an EC2 instance in the same VPC. The engineer can ping the EC2 instance but cannot connect to Redshift using the endpoint address and port 5439. What is the most likely cause?

Accepted Answer

The security group for the Redshift cluster does not allow inbound traffic on port 5439 from the EC2 instance.. The most likely cause is that the security group associated with the Redshift cluster does not have an inbound rule allowing TCP traffic on port 5439 from the security group or IP address of the EC2 instance. Since the engineer can ping the EC2 instance (ICMP works), but cannot connect to Redshift on port 5439, this points to a firewall or security group rule blocking the specific port, not a network reachability issue.

Answer

The Redshift cluster is in a different VPC.

Answer

The Redshift cluster is not in an available state.

Answer

The Redshift cluster is publicly accessible and requires an internet gateway.

Question 17

A data engineer needs to design a data ingestion pipeline that ingests CSV files from an Amazon S3 bucket, transforms the data by adding a timestamp column, and loads it into an Amazon Redshift table. The pipeline should run automatically whenever a new file is uploaded to the S3 bucket. Which AWS service should be used to trigger the transformation?

Accepted Answer

AWS Lambda. Amazon S3 can be configured to send events directly to AWS Lambda when a new CSV file is uploaded. Lambda then executes the transformation (adding a timestamp column) and loads the data into Redshift. Option B (Step Functions) is not triggered directly by S3 events without an intermediate service like Lambda. Option C (EventBridge) can route S3 events to Lambda, but a direct S3 event notification to Lambda is simpler and more common; however, the key point is that Lambda is the direct trigger. Option D (SQS) requires a separate process to poll the queue and invoke Lambda; it is not a direct trigger.

Answer

AWS Step Functions

Answer

Amazon EventBridge

Answer

Amazon Simple Queue Service (SQS)

Question 18

A company needs to transform JSON data from an S3 bucket into a structured format for Amazon Redshift. The transformation should be done serverlessly. Which service should be used?

Accepted Answer

AWS Glue. AWS Glue is the correct choice because it is a fully managed, serverless ETL service designed specifically for transforming and preparing data for analytics, including converting JSON to structured formats like Parquet or ORC for Amazon Redshift. It can crawl the S3 source, infer schemas, and run Spark-based transformation jobs without provisioning any infrastructure, aligning perfectly with the serverless requirement.

Answer

Amazon EMR

Answer

Amazon Athena

Answer

AWS Lambda

Question 19

A data engineer needs to set up a new Amazon RDS for MySQL database for a web application. The application experiences variable read traffic and requires low read latency. The engineer needs to minimize downtime during maintenance and provide read scalability. Which configuration meets these requirements?

Accepted Answer

Multi-AZ db.r5.large instance with two Read Replicas. A Multi-AZ deployment provides high availability and automatic failover to minimize downtime during maintenance, while adding two Read Replicas offloads read traffic from the primary instance, reducing read latency and enabling read scalability. The db.r5.large instance size is sufficient for the variable read workload, and Read Replicas can be promoted to standalone instances if needed.

Answer

Multi-AZ db.r5.large instance

Answer

Single-AZ db.r5.large instance

Answer

Single-AZ db.r5.xlarge instance

Question 20

A company is designing a data ingestion pipeline for real-time sensor data from thousands of devices. The data must be processed with low latency and stored in Amazon S3. Which TWO services would be appropriate for this use case? (Choose TWO.)

Accepted Answer

Amazon Kinesis Data Firehose. Amazon Kinesis Data Firehose is the correct choice because it is a fully managed service designed to ingest real-time streaming data, transform it on the fly (e.g., convert to Parquet/ORC), and deliver it directly to Amazon S3 with low latency. It handles buffering, compression, and partitioning automatically, making it ideal for the described sensor data pipeline.

Answer

AWS Glue

Answer

AWS DataSync

Answer

Amazon Athena