DEA-C01 Practice Exam 62 — 20 Questions

Question 1

A data engineer is designing a disaster recovery plan for an Amazon RDS for MySQL database. The database must be recoverable within 1 hour in a different AWS Region. Which TWO actions should the engineer take?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a cross-Region read replica.. A cross-Region read replica for Amazon RDS for MySQL provides a fully provisioned secondary database in a different AWS Region that can be promoted to a standalone primary in minutes, meeting the 1-hour recovery time objective (RTO). This approach ensures continuous replication from the source database, minimizing data loss and enabling rapid failover without manual snapshot management.

Answer

Enable Multi-AZ deployment.

Answer

Take manual snapshots and copy them to an S3 bucket in the other Region.

Answer

Use Amazon EventBridge to schedule snapshot copies.

Question 2

Refer to the exhibit. A data engineer runs the command on an object in S3. The engineer expected the object to have a tag 'type=raw' but sees no metadata. What is the likely cause?

Accepted Answer

Object tags are not returned by head-object; use get-object-tagging instead. The head-object command does not return object tags; you must use the get-object-tagging command to retrieve tags. Option B is incorrect because the head-object command succeeds regardless of region, and region does not affect tag visibility. Option C is incorrect because bucket policies can deny access but do not prevent tags from being returned by head-object; they would affect get-object-tagging instead. Option D is incorrect because lifecycle rules do not remove tags from objects; they may transition or expire objects but do not strip metadata.

Answer

The S3 bucket is in a different AWS Region

Answer

The bucket policy blocks reading tags

Answer

The object was created without tags because of lifecycle rules

Question 3

A company uses AWS Glue to process sensitive customer data stored in S3. The data engineer must ensure that the Glue ETL jobs do not write any data to S3 buckets that lack encryption. Which approach meets this requirement?

Accepted Answer

Attach an S3 bucket policy that denies s3:PutObject unless the request includes the x-amz-server-side-encryption header. An S3 bucket policy with a condition key such as s3:x-amz-server-side-encryption can deny s3:PutObject requests that do not specify encryption, thereby preventing unencrypted writes. Option A is incorrect because AWS CloudTrail is an auditing service that logs API calls but does not actively prevent writes. Option C is incorrect because while S3 default encryption automatically encrypts objects at rest, it does not enforce that write requests include encryption headers; the bucket policy approach ensures encryption is explicitly requested. Option D is incorrect because an IAM role policy can also enforce encryption, but a bucket policy is more comprehensive as it applies to all principals accessing the bucket, including the Glue service role.

Answer

Use AWS CloudTrail to monitor and alert on unencrypted writes

Answer

Enable S3 default encryption on the bucket

Answer

Configure an IAM role for Glue with a policy that denies s3:PutObject without encryption

Question 4

A company is using AWS Glue ETL to process data from Amazon RDS for MySQL to Amazon S3. The job runs daily and takes 2 hours to complete. The engineer wants to improve performance without increasing cost significantly. Which TWO actions should the engineer take? (Choose TWO.)

Accepted Answer

Add a partition column to the source table based on a date column.. Adding a partition column (e.g., based on a date column) to the source table enables AWS Glue to use partition pruning during the read phase. This reduces the amount of data scanned and processed by the ETL job, directly improving performance without increasing cost. Partitioning is a common optimization for large datasets in RDS or S3-based sources.

Answer

Switch to a smaller worker type (e.g., G.1X instead of G.2X).

Answer

Use Spark DataFrames instead of DynamicFrames.

Answer

Enable 'Auto Scaling' in the Glue job configuration.

Question 5

A company is designing a disaster recovery strategy for an Amazon RDS for SQL Server database. The database must be recoverable in another AWS region within 15 minutes of a regional outage. Which TWO actions should the data engineer take?

Accepted Answer

Configure automated cross-region snapshots to be copied to the recovery region.. Cross-region snapshots for Amazon RDS are automatically copied to a destination AWS region, enabling you to restore the database in the recovery region from the most recent snapshot. This meets the 15-minute recovery time objective (RTO) when combined with a pre-provisioned DB instance, as the snapshot copy is asynchronous but can be scheduled to occur frequently (e.g., every 5 minutes for SQL Server).

Answer

Enable Multi-AZ deployment on the primary instance.

Answer

Configure automated backups to copy to the recovery region.

Question 6

A data engineer notices that an S3 bucket policy allows access to a user from another AWS account, but the access is being denied. What could be the reason?

Accepted Answer

The other account's IAM user does not have permissions to access the bucket. For cross-account S3 access to succeed, both the bucket policy (resource-based policy) and the IAM user policy (identity-based policy) in the other account must grant the necessary permissions. Option B is correct because even if the bucket policy allows access from the other account, the IAM user in that account must have an explicit IAM policy that permits the S3 action (e.g., s3:GetObject) on the bucket. Without this, the request is denied by the other account's own IAM evaluation.

Answer

The bucket policy does not include KMS permissions

Answer

S3 does not support cross-account access

Answer

The bucket is in a different region

Question 7

A company is storing large amounts of log data in Amazon S3. The data is accessed frequently for the first 30 days, then rarely after that. The company wants to automatically transition the data to a lower-cost storage class after 30 days. Which S3 feature should the data engineer use?

Accepted Answer

S3 Lifecycle policies. S3 Lifecycle policies allow you to define rules that automatically transition objects between storage classes based on age or other criteria. In this scenario, a lifecycle rule can be configured to transition objects from S3 Standard to a lower-cost class like S3 Glacier Deep Archive after 30 days, directly meeting the requirement for automated cost optimization.

Answer

S3 Intelligent-Tiering

Answer

S3 Cross-Region Replication

Answer

S3 Batch Operations

Question 8

A data engineering team is ingesting streaming data from IoT devices into Amazon Kinesis Data Streams. The data must be transformed in real-time and then loaded into an Amazon S3 bucket for long-term storage. Which AWS service should be used to perform the transformation and delivery to S3 with minimal operational overhead?

Accepted Answer

Amazon Kinesis Data Firehose. Amazon Kinesis Data Firehose is the correct choice because it is a fully managed service designed to automatically load streaming data into Amazon S3, Redshift, Elasticsearch, and Splunk. It can invoke an AWS Lambda function for real-time data transformation before delivery, eliminating the need to manage any infrastructure or write custom code for the delivery pipeline. This directly meets the requirement of minimal operational overhead for transformation and S3 delivery.

Answer

AWS Glue

Answer

Amazon EMR

Answer

Amazon Kinesis Data Analytics

Question 9

A company runs a real-time analytics platform using Amazon Kinesis Data Streams with a shard count of 10. The data is consumed by an AWS Lambda function that writes to an Amazon DynamoDB table. The DynamoDB table has a partition key of 'user_id' and a sort key of 'timestamp'. The table is provisioned with 5000 RCUs and 5000 WCUs. Recently, the application experienced increased write latency and throttling errors (ProvisionedThroughputExceededException) on the DynamoDB table. The CloudWatch metrics show that ConsumedWriteCapacityUnits averages 4500 with occasional spikes to 6000. The Lambda function’s concurrency is set to 1000. The data engineer suspects the issue is due to hot partitions. Upon investigation, the engineer finds that a small number of users generate a disproportionately large amount of data. Which course of action would best resolve the throttling while minimizing cost?

Accepted Answer

Enable DynamoDB adaptive capacity and implement write sharding by adding a suffix to the partition key for high-volume users. The root cause is hot partitions caused by a small number of high-volume users. Enabling DynamoDB adaptive capacity allows the table to automatically adjust throughput to accommodate uneven access patterns, but the key fix is write sharding — adding a random or calculated suffix to the partition key for those high-volume users. This distributes writes across multiple physical partitions, eliminating the hot spot without requiring a global increase in provisioned capacity, thus resolving throttling while minimizing cost.

Answer

Increase the provisioned WCUs to 10000 to handle spikes

Answer

Switch the DynamoDB table to on-demand capacity mode

Answer

Reduce the Lambda function concurrency to 100 to limit write requests

Question 10

A company has a multi-account AWS environment with a centralized data lake in the Security account. Data producers in other accounts use AWS Glue to write data to S3 buckets in the Security account. The Security account uses AWS Lake Formation to manage permissions. The data engineer is setting up cross-account access so that users in the Producer account can query the data using Athena in their own account. The engineer has registered the S3 buckets and Data Catalog tables in Lake Formation. The IAM roles in the Producer account have the necessary permissions. However, when a user in the Producer account tries to query the table, they get an AccessDenied error. The error message indicates that the principal is not authorized to perform lakeformation:GetTable on the resource. What is the most likely cause?

Accepted Answer

The Lake Formation permissions in the Security account do not include a grant to the Producer account's IAM role.. Lake Formation requires explicit cross-account grants to the producer account's IAM role for the Data Catalog tables. Even if the S3 buckets and Data Catalog tables are registered, the producer account's role must be granted SELECT and DESCRIBE permissions on the table in Lake Formation. Option A is incorrect because a Glue Data Catalog resource policy is not required when Lake Formation is used for cross-account access; Lake Formation handles the authorization. Option B is incorrect because the S3 bucket policy must allow the producer account's role, but the error specifically mentions lakeformation:GetTable, not S3 access. Option C is incorrect because the KMS key policy is not relevant to the lakeformation:GetTable error.

Answer

The Glue Data Catalog resource policy is missing a statement to allow cross-account access.

Answer

The S3 bucket policy does not allow the Producer account's IAM role to read the data.

Answer

The KMS key policy does not allow the Producer account's IAM role to decrypt objects.

Question 11

A company is using Amazon S3 to store critical data and needs to ensure that objects are automatically transitioned to S3 Glacier Deep Archive after 180 days to reduce costs. Which S3 lifecycle action should be configured?

Accepted Answer

Transition. The S3 lifecycle 'Transition' action is specifically designed to move objects between storage classes after a specified number of days. To reduce costs by moving objects to S3 Glacier Deep Archive after 180 days, you configure a lifecycle rule with a Transition action that targets the 'DEEP_ARCHIVE' storage class at the 180-day mark.

Answer

Expiration

Answer

AbortIncompleteMultipartUpload

Answer

NoncurrentVersionTransition

Question 12

A data engineer is designing a data ingestion pipeline for IoT sensor data. The sensors send JSON messages every second. The data must be available in Amazon S3 within 5 minutes and must be transformed (JSON to Parquet) before storage. Which combination of services meets these requirements?

Accepted Answer

Amazon Kinesis Data Firehose with data transformation and Parquet conversion. Amazon Kinesis Data Firehose can ingest streaming data, apply a transformation (e.g., convert JSON to Parquet), and deliver the transformed data to Amazon S3 with a buffer interval of up to 60 seconds, easily meeting the 5-minute latency requirement. Option A is incorrect because AWS Glue streaming ETL adds complexity and is not necessary for simple JSON-to-Parquet conversion; Kinesis Data Firehose handles this natively. Option C is incorrect because Kinesis Data Analytics is designed for real-time analytics and does not directly output to S3 in a transformed format without additional components. Option D is incorrect because S3 Event Notifications to Lambda would incur impractically high invocation costs and latency for per-second sensor data, and transforming on write to S3 would exceed the 5-minute window.

Answer

Amazon Kinesis Data Streams with AWS Glue streaming ETL

Answer

Amazon Kinesis Data Analytics with output to S3

Answer

Amazon S3 with S3 Event Notifications to AWS Lambda for transformation

Question 13

A company uses Amazon S3 to store images that are accessed by a web application. The application generates presigned URLs for users to download images. Recently, the application has been experiencing errors when generating presigned URLs for objects that were uploaded using multipart upload. The errors indicate that the presigned URL does not work. The data engineer needs to ensure that presigned URLs work for all objects, including those uploaded via multipart upload. What should the data engineer do?

Accepted Answer

Ensure that the IAM user or role used to generate the presigned URL has s3:GetObject permission for the object.. Presigned URLs work regardless of whether the object was uploaded via single-part or multipart upload. The error typically occurs because the IAM user or role used to generate the presigned URL lacks the s3:GetObject permission for the object. Option B is correct. Option A (changing signing algorithm) is unnecessary; SigV4 is the default and works for all cases. Option C (enabling versioning) does not affect presigned URL generation. Option D (re-uploading) is not required as multipart uploads do not break presigned URLs.

Answer

Use a different signing algorithm when generating the presigned URL.

Answer

Enable S3 Versioning on the bucket.

Answer

Re-upload the objects using single-part upload instead of multipart upload.

Question 14

A data engineer is troubleshooting a slow Amazon Redshift query. The query plan shows a large number of 'DS_DIST_ALL_INNER' and 'DS_BCAST_INNER' operations. Which TWO actions would likely improve query performance?

Accepted Answer

Change the distribution style of large tables to KEY on the join column.. Using DISTSTYLE KEY on the join column for large tables colocates data with the same key on the same slice, reducing the need for data redistribution operations like DS_DIST_ALL_INNER and DS_BCAST_INNER. Option C is correct because increasing the number of slices by resizing the cluster distributes data across more compute nodes, allowing more parallelism and reducing the relative impact of data redistribution. Option A is incorrect because setting DISTSTYLE to ALL on both tables would broadcast each table to all nodes, increasing data movement and likely worsening performance. Option D is incorrect because SORTKEYs optimize range-restricted scans and sorting, not join data movement. Option E is incorrect because dropping and recreating tables with the same DDL does not change distribution or sort strategies, so it does not address the root cause of excessive redistribution.

Answer

Set DISTSTYLE to ALL for both tables.

Answer

Define SORTKEYs on the join columns.

Answer

Drop and recreate the tables with the same DDL.

Question 15

A company ingests streaming data from social media feeds into Amazon Kinesis Data Streams. The data is consumed by an AWS Lambda function that transforms and writes to Amazon S3. Recently, the Lambda function started timing out and dropping records. The data volume has tripled. Which actions should the data engineer take to resolve this? (Choose TWO.)

Accepted Answer

Increase the number of shards in the Kinesis data stream. (increase shards) increases the Kinesis stream's throughput capacity to handle the tripled data volume, reducing backpressure on the Lambda consumer. Option E (increase Lambda memory) also increases CPU allocation, allowing the Lambda function to process each record faster, which helps prevent timeouts. Option B (replace Lambda with Firehose) could be an alternative but is not a direct fix for the existing Lambda-based architecture and may not be suitable for complex transformations. Option C (increase timeout to 15 minutes) might allow more time but does not address the underlying root cause of insufficient throughput or processing power. Option D (reserved concurrency) prevents other functions from affecting this function's concurrency but does not increase total processing capacity; it could even limit scaling if set too low.

Answer

Replace Lambda with Amazon Kinesis Data Firehose for the transformation

Answer

Increase the Lambda function timeout to 15 minutes

Answer

Set a reserved concurrency on the Lambda function

Question 16

Which TWO of the following are benefits of using Amazon DynamoDB Accelerator (DAX)? (Choose TWO.)

Accepted Answer

Provides microsecond read latency. Amazon DynamoDB Accelerator (DAX) is an in-memory cache that sits between your application and DynamoDB, providing microsecond response times for read-heavy workloads. It achieves this by caching frequently accessed data in memory, reducing the latency from single-digit milliseconds to microseconds for eventually consistent reads.

Answer

Improves write throughput

Answer

Provides data durability across Availability Zones

Answer

Reduces storage costs

Question 17

A company is running a critical data pipeline using AWS Glue. The pipeline must be highly available and fault-tolerant. Which TWO strategies should the data engineer implement? (Choose TWO.)

Accepted Answer

Configure the Glue job to run in multiple Availability Zones.. Configuring the Glue job to run in multiple Availability Zones ensures that if one AZ experiences a failure, the job can continue processing in another AZ, providing high availability and fault tolerance. This is a fundamental strategy for resilient data pipeline design in AWS.

Answer

Use a single instance type for all Glue workers.

Answer

Increase the number of concurrent runs for the Glue job.

Answer

Disable job bookmarks to avoid reprocessing.

Question 18

Which TWO AWS services can be used to transform data in an Amazon S3 data lake before loading into Amazon Redshift? (Choose 2.)

Accepted Answer

AWS Glue. AWS Glue (Option D) is correct because it provides a fully managed ETL service that can crawl, catalog, and transform data in Amazon S3 data lakes. With AWS Glue, you can create ETL jobs using a serverless Spark environment to transform raw data into optimized formats (e.g., Parquet) and load it into Amazon Redshift via JDBC connections, making it ideal for preparing data before ingestion.

Answer

AWS Lambda

Answer

Amazon Athena

Answer

Amazon EMR

Question 19

A data engineer needs to grant cross-account access to an S3 bucket. The engineer wants to use a role in the source account and assume that role from the target account. Which permissions are required?

Accepted Answer

Role in source account with trust policy allowing target account, and bucket policy granting access to the role. Cross-account access via role assumption requires the source account to have an IAM role with a trust policy that explicitly allows the target account's AWS account ID to assume it. The bucket policy must then grant the necessary S3 actions (e.g., s3:GetObject) to that role's ARN, enabling the target account's assumed role session to access the bucket. This two-step mechanism—trust policy for authentication and bucket policy for authorization—is the standard AWS pattern for secure cross-account S3 access.

Answer

Bucket policy in source account allowing the target account's root user

Answer

Role in target account with trust policy allowing source account

Answer

IAM policy in target account allowing s3:GetObject on the bucket

Question 20

A company is using Amazon S3 as a data lake. Data is ingested hourly from multiple sources. The data engineer needs to ensure that once an object is written to S3, it cannot be overwritten or deleted for 30 days. Which S3 feature should be used?

Accepted Answer

Enable S3 Object Lock with a retention period of 30 days.. S3 Object Lock with a retention period of 30 days enforces a write-once-read-many (WORM) policy that prevents objects from being overwritten or deleted during the retention period. This meets the requirement exactly, as it applies to both new and existing objects when enabled on a versioning-enabled bucket.

Answer

Use S3 Lifecycle policies to transition objects to Glacier after 30 days.

Answer

Enable S3 Versioning and MFA Delete.

Answer

Configure a bucket policy that denies s3:DeleteObject for all principals.