DEA-C01 Practice Exam 64 — 20 Questions

Question 1

A company is building a data pipeline that ingests streaming data from IoT devices. The data must be stored in a durable, scalable, and cost-effective manner for batch processing. Which TWO AWS services should be used together?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Amazon Kinesis Data Streams. Amazon Kinesis Data Streams (B) is the correct ingestion service for streaming IoT data because it provides a durable, scalable, and real-time data streaming platform that can capture and store data records for up to 365 days. Amazon S3 (E) is the correct storage service for batch processing because it offers virtually unlimited durability (99.999999999%), cost-effective tiered storage, and native integration with batch processing frameworks like Amazon EMR and AWS Glue. Together, they form a classic streaming-to-batch pipeline: Kinesis ingests and buffers the streaming data, which is then persisted in S3 for downstream batch analytics.

Answer

Amazon ElastiCache

Answer

Amazon Redshift

Answer

Amazon DynamoDB

Question 2

A data engineer is troubleshooting an AWS Glue ETL job that reads from Amazon S3 and writes to Amazon Redshift. The job runs successfully but writes duplicate rows into Redshift. The source data is static and does not contain duplicates. Which configuration change is most likely to resolve this issue?

Accepted Answer

Modify the job to use the 'postactions' option with a SQL statement that deletes duplicates before final insert.. The job runs successfully but writes duplicate rows because AWS Glue's Spark-based ETL jobs can retry tasks on failure, and when writing to Redshift using the JDBC connector, the default behavior is to append data without deduplication. Using the 'postactions' option with a SQL DELETE statement that removes duplicates before the final INSERT ensures that only unique rows remain, resolving the duplication without altering the source data.

Answer

Enable the 'upsert' feature in the Redshift connection by setting 'update' to true.

Answer

Use partition pruning on the S3 source to reduce the number of files read.

Answer

Increase the number of DPUs (Data Processing Units) allocated to the job.

Question 3

A company is ingesting data from multiple sources into S3 using AWS Glue. The data engineer notices that the Glue job is failing with an OutOfMemory error. Which step should be taken to resolve this issue?

Accepted Answer

Increase the number of DPUs allocated to the Glue job. AWS Glue jobs run on Apache Spark, which distributes data processing across multiple executors. An OutOfMemory error typically indicates that the data being processed exceeds the memory available to the executors. Increasing the number of DPUs (Data Processing Units) allocates more memory and compute resources to the job, allowing it to handle larger datasets without running out of memory.

Answer

Reduce the volume of incoming data

Answer

Configure the job to use a larger memory setting

Answer

Use a smaller file size for input

Question 4

A company is using AWS Glue to process data stored in Amazon S3. The data includes personally identifiable information (PII) that must be masked before being written to a separate output bucket. Which AWS service or feature can be used to automatically detect and mask sensitive data in the Glue ETL job?

Accepted Answer

Use Amazon Macie to identify sensitive data and apply masking logic in the Glue job.. Amazon Macie can be integrated with AWS Glue to automatically detect sensitive data like PII and apply masking logic within a Glue ETL job. Option A is incorrect because CloudWatch Logs are for monitoring and logging, not for data masking. Option C is incorrect because IAM policies control access permissions but do not mask data. Option D is incorrect because S3 Object Lock prevents object deletion or modification, not masking.

Answer

Configure CloudWatch Logs to filter and mask PII.

Answer

Use an IAM policy to restrict access to the PII columns.

Answer

Enable S3 Object Lock on the output bucket.

Question 5

A company is using AWS Glue to run ETL jobs that transform data from Amazon DynamoDB to Amazon S3. The DynamoDB table has a large number of items (over 10 million) and is heavily used by production applications. The Glue job reads the entire DynamoDB table each time it runs, causing increased read capacity consumption and affecting production performance. The team wants to reduce the impact on the source DynamoDB table while still keeping the S3 data up-to-date. What should the team do?

Accepted Answer

Use DynamoDB Streams and AWS Lambda to capture changes and write them to S3, then run incremental Glue jobs.. Using DynamoDB Streams with AWS Lambda enables incremental change data capture (CDC), which eliminates the need to read the entire DynamoDB table each time. This reduces read capacity consumption and minimizes impact on production performance. Option B is incorrect because increasing read capacity units would still involve full table scans, further straining the production workload. Option C is incorrect because exporting via the DynamoDB console is a one-time export, not an incremental solution to keep S3 data up-to-date. Option D is incorrect because reducing Glue job parallelism does not change the fact that the entire table is read, and it would increase job duration without addressing the read capacity issue.

Answer

Increase the DynamoDB read capacity units to handle the Glue job's read load.

Answer

Use the DynamoDB console to export the table to S3 in Parquet format.

Answer

Reduce the parallelism of the Glue job to lower the read throughput.

Question 6

A company uses Amazon S3 to store raw data and AWS Glue to run ETL jobs. The data is partitioned by date in the format 'year=YYYY/month=MM/day=DD'. A new data source started sending data with a different date format 'YYYY-MM-DD'. The Glue crawler is configured to create a single table for the entire bucket. The crawler runs daily, but it is not detecting the new partitions from the new data source. The existing partitions are in the format 'year=2024/month=05/day=10', while the new data is stored as '2024-05-10/' without the key-value structure. How should the engineer modify the data pipeline to include the new data?

Accepted Answer

Modify the new data source to store data in the same Hive-style partition format as the existing data.. The new data uses a flat date folder (YYYY-MM-DD) instead of the existing Hive-style partition layout (year=YYYY/month=MM/day=DD). AWS Glue crawlers expect Hive-style partitions to automatically infer partitions. To include the new data without breaking the existing pipeline, the simplest solution is to store the new data in the same Hive-style format as the existing data. Option A is incorrect because partition indexes help with query performance, not with partition format mismatch. Option B is incorrect because custom classifiers affect schema inference, not partition structure. Option D is incorrect because converting to Parquet does not change the partition folder structure.

Answer

Run the crawler with the 'Create partition indexes' option enabled.

Answer

Configure the crawler to add a custom classifier for date formats.

Answer

Convert the new data to Parquet format.

Question 7

A data engineer is ingesting CSV files from an Amazon S3 bucket into a Glue Data Catalog table. The files have headers, but some files have extra columns not present in the first file. The engineer wants the Glue crawler to automatically detect the schema. Which crawler configuration option should be used?

Accepted Answer

Configure the crawler to 'Create a single schema for each S3 path' and enable 'Merge tables'.. When CSV files have varying schemas (extra columns), the Glue crawler must be configured to 'Create a single schema for each S3 path' with 'Merge tables' enabled. This configuration instructs the crawler to union the schemas from all files in the S3 path, adding new columns as they appear, rather than creating separate tables for each schema variation.

Answer

Configure the crawler to 'Inherit schema from table' and set the table name.

Answer

Configure the crawler to 'Create a single schema for each S3 path' without enabling 'Merge tables'.

Answer

Configure the crawler to 'Create a single schema for each S3 path' and set 'Each file as a separate table'.

Question 8

A company is designing a data lake on Amazon S3. Which TWO strategies improve query performance for Amazon Athena?

Accepted Answer

Partition the data by frequently queried columns such as date or region.. Partitioning data by frequently queried columns (e.g., date or region) allows Athena to prune the data scanned by only reading the relevant partitions, reducing the amount of data scanned and improving query performance. This is a core optimization for Athena, which charges based on data scanned and performs better with less I/O.

Answer

Enable S3 Versioning on the bucket.

Answer

Use server-side encryption with AWS KMS (SSE-KMS).

Answer

Store data in CSV format with header rows.

Question 9

A data engineer manages an Amazon Redshift cluster that hosts a 10 TB data warehouse. The cluster uses a single node of type dc2.large (160 GB SSD). The engineer notices that the cluster's disk space is 95% full, and queries are running slowly. The engineer runs the STV_PARTITIONS view and sees that many slices have high 'tossed' counts. The engineer also runs VACUUM and ANALYZE commands, but the disk space does not improve. The engineer suspects that the cluster needs more storage. However, the company wants to minimize cost. Which action should the engineer take to resolve the disk space issue most cost-effectively?

Accepted Answer

Replace the cluster with a single ds2.xlarge node.. The current cluster uses a single dc2.large node with only 160 GB SSD, which is nearly full. Replacing it with a single ds2.xlarge node provides 2 TB HDD storage, offering a significant capacity increase at a lower cost per GB compared to other options. Option A is wrong because switching to RA3 nodes introduces managed storage with higher costs and is unnecessary for this capacity need. Option C is wrong because scaling to a single dc2.8xlarge node provides 2.56 TB SSD but is more expensive than the ds2.xlarge option. Option D is wrong because adding another dc2.large node only doubles the storage to 320 GB, which may not be sufficient and still leaves the cluster with limited SSD capacity, while also increasing CPU and memory unnecessarily.

Answer

Switch to a ra3.xlplus node with managed storage.

Answer

Scale the cluster to a single dc2.8xlarge node.

Answer

Add another dc2.large node to the cluster to increase total storage.

Question 10

A company uses AWS Glue to run ETL jobs daily. The jobs consume data from an Amazon RDS for MySQL database and write results to Amazon S3. The company wants to minimize the impact on the source database during extraction. Which THREE actions should the data engineer take to achieve this? (Choose THREE.)

Accepted Answer

Schedule the Glue job to run during off-peak hours.. Scheduling the Glue job to run during off-peak hours minimizes the load on the source RDS for MySQL database by avoiding high-traffic periods, reducing contention for CPU, memory, and I/O resources. This is a straightforward operational practice to reduce impact on production databases during extraction.

Answer

Increase the number of Glue DPUs to process data faster.

Answer

Disable Glue job bookmarks to force full refresh.

Question 11

A company uses AWS KMS to encrypt data in Amazon Redshift. The data engineer needs to rotate the customer-managed KMS key annually. Which TWO actions must be taken to successfully rotate the key without data loss?

Accepted Answer

Create a new KMS key and update the Redshift cluster to use the new key. You must create a new KMS key and update the Redshift cluster to use the new key for encrypting future data. Option B is correct because the old key must remain enabled to allow decryption of data that was encrypted with it; without the old key, existing data becomes inaccessible. Option C is incorrect because CloudTrail is used for auditing API calls, not as a required action for key rotation. Option D is incorrect because storing the key in Amazon S3 is unnecessary; KMS already securely stores keys. Option E is incorrect because automatic key rotation on the existing key does not create a new key; it rotates the key material automatically, which is not the scenario described (a new key must be created and the cluster updated).

Answer

Use AWS CloudTrail to verify the key rotation was successful

Answer

Store the new key in Amazon S3 for backup

Answer

Enable automatic KMS key rotation on the existing key

Question 12

A data engineer is monitoring an Amazon Redshift cluster using Amazon CloudWatch. The engineer notices that the 'WriteThroughput' metric is consistently below the provisioned IOPS for the cluster's EBS volumes. The query performance is slower than expected. Which action is MOST likely to improve write performance?

Accepted Answer

Upgrade to a larger node type with more CPU and memory.. The 'WriteThroughput' metric being consistently below the provisioned IOPS indicates that the EBS volumes are not the bottleneck; the bottleneck is more likely insufficient compute resources (CPU/memory). Upgrading to a larger node type (e.g., from DC2 to RA3 or a higher node size) increases CPU and memory, which can improve query processing and write performance. Option A is incorrect because reducing concurrent queries may help with contention, but if the underlying node lacks resources, it won't fully address the low throughput. Option C is incorrect because sort keys primarily optimize read performance (e.g., range-restricted scans), not write throughput. Option D is incorrect because increasing IOPS on EBS volumes will not help when the provisioned IOPS are already not being fully utilized.

Answer

Reduce the number of concurrent queries to the database.

Answer

Add sort keys to the tables to improve data distribution.

Answer

Increase the provisioned IOPS on the EBS volumes.

Question 13

An AWS Glue job that performs data transformation on large Parquet files in Amazon S3 is taking a long time to complete. The job uses the default number of DPUs. Which change would most likely improve the job's performance?

Accepted Answer

Increase 'Max capacity' (number of DPUs) for the job.. Increasing the number of DPUs (Option A) adds more parallelism and memory, which directly improves the performance of the Glue job when processing large Parquet files. Option B (coalesce) reduces the number of output files but does not speed up the transformation itself. Option C (reduce partitions) may lead to data skew or out-of-memory errors. Option D (change to CSV) would make processing slower because CSV is less efficient than Parquet.

Answer

Use 'coalesce' to reduce the number of output files.

Answer

Reduce the number of partitions in the source data.

Answer

Change the input format from Parquet to CSV.

Question 14

A data engineer needs to store sensitive data in Amazon S3 and automatically classify the data using a managed service. The data is uploaded via an S3 bucket. Which AWS service can automatically detect and classify sensitive data?

Accepted Answer

Amazon Macie. Amazon Macie is the correct answer because it is a fully managed data security and data privacy service that uses machine learning and pattern matching to discover, monitor, and protect sensitive data in Amazon S3. Option B, AWS WAF, is a web application firewall for protecting web applications, not for data classification. Option C, Amazon Inspector, is an automated vulnerability management service for EC2 instances and containers, not for S3 data classification. Option D, AWS Shield, is a managed DDoS protection service, unrelated to data classification.

Answer

AWS WAF

Answer

Amazon Inspector

Answer

AWS Shield

Question 15

A company stores sensitive data in Amazon S3. The security team requires encryption at rest and that the encryption keys are managed by the company using AWS KMS. The data is frequently accessed by multiple AWS services. Which THREE steps should be taken to meet these requirements?

Accepted Answer

Configure the KMS key policy to allow the necessary AWS services to use the key for decryption. The security team requires that encryption keys be managed by the company using AWS KMS, and that multiple AWS services can access the data. To allow those services to decrypt objects encrypted with a customer-managed KMS key, the KMS key policy must explicitly grant the necessary AWS services (e.g., AWS Lambda, Amazon Athena) permission to use the key for decryption (kms:Decrypt). Without this policy, even if the bucket is configured for SSE-KMS, the services will fail to read the encrypted objects.

Answer

Use client-side encryption with the KMS key before uploading to S3

Answer

Enable default encryption on the S3 bucket using SSE-S3

Question 16

A company runs a data pipeline that uses AWS Lambda to process files uploaded to an S3 bucket. Recently, some files have been processed multiple times. The Lambda function is triggered by S3 event notifications. What is the MOST likely cause of duplicate processing?

Accepted Answer

S3 event notifications are delivered at least once.. S3 event notifications are delivered at least once, meaning they can be sent multiple times, causing the Lambda function to be invoked repeatedly for the same file. This is the most likely cause of duplicate processing. Option A is incorrect: while Lambda retries on error for asynchronous invocations, it retries the same failed invocation, not creating multiple invocations for a successful event. Option B is incorrect: lack of idempotency does not cause duplicates; it simply means the function might not handle duplicates properly, but the root cause is the duplicate trigger. Option C is incorrect: reserved concurrency limits the number of concurrent executions but does not generate duplicate invocations.

Answer

The Lambda function has a high error rate and retries.

Answer

The Lambda function is not idempotent.

Answer

The Lambda function has a reserved concurrency setting.

Question 17

A data engineer is designing a data pipeline that ingests streaming data from Kinesis Data Streams, transforms it using AWS Lambda, and writes to S3. The Lambda function sometimes fails due to transient errors, and the engineer wants to ensure no data is lost. Which approach should be used?

Accepted Answer

Use Kinesis Data Firehose as the delivery stream with Lambda for transformation and configure error handling with retries and a backup S3 bucket. Kinesis Data Firehose natively integrates with Lambda for data transformation and provides built-in error handling with retries. If transformation fails after the retry limit, Firehose can automatically redirect failed records to a backup S3 bucket, ensuring no data is lost. This approach handles transient errors without requiring custom checkpointing or manual retry logic.

Answer

Use the Kinesis Client Library to process records with checkpointing

Answer

Increase the Lambda function's timeout and memory

Answer

Configure a dead-letter queue (DLQ) on Lambda to capture failed records

Question 18

A company is using Amazon Redshift for its data warehouse. The data engineering team needs to improve query performance for a large fact table that is frequently joined with multiple dimension tables. Which THREE strategies should be considered?

Accepted Answer

Define sort keys on columns used in WHERE clauses.. Defining sort keys on columns used in WHERE clauses allows Amazon Redshift to use zone maps to skip large blocks of data that do not satisfy the filter condition, dramatically reducing the amount of data scanned. This is especially effective for large fact tables where selective filters can prune entire disk blocks, improving query performance without additional hardware.

Answer

Use DISTSTYLE EVEN to distribute data evenly.

Answer

Increase the number of nodes in the cluster.

Question 19

A data engineer is designing a data pipeline that processes sensitive personal data. The data is ingested via Amazon Kinesis Data Firehose and stored in Amazon S3. The pipeline must ensure that the data is encrypted at rest and in transit. The engineer also needs to audit access to the data. Which combination of services meets these requirements?

Accepted Answer

S3 server-side encryption (SSE-S3) for at-rest encryption, HTTPS for in-transit encryption, and AWS CloudTrail for auditing.. S3 server-side encryption (SSE-S3) encrypts data at rest in S3. HTTPS (TLS) encrypts data in transit between the data source and Kinesis Data Firehose, and between Firehose and S3. AWS CloudTrail logs S3 API calls (e.g., GetObject, PutObject) for auditing data access. Option A is incorrect because Kinesis Data Analytics does not provide encryption in transit; it processes data but does not handle encryption. Option B is incorrect because CloudWatch Logs is for monitoring and storing logs, not for auditing data access; CloudTrail is the appropriate service for auditing. Option D is incorrect because client-side encryption requires manual key management and does not use AWS-managed encryption; AWS Config tracks configuration changes, not data access.

Answer

AWS KMS for encryption at rest, Kinesis Data Analytics for in-transit encryption, and AWS CloudTrail for auditing.

Answer

AWS KMS for encryption at rest, Amazon CloudWatch Logs for auditing, and TLS for in-transit encryption.

Answer

S3 client-side encryption, AWS Config for auditing, and TLS for in-transit encryption.

Question 20

A data engineer is designing a data pipeline that processes PII data using AWS Glue and stores results in S3. Which TWO actions should be taken to protect the data? (Choose 2)

Accepted Answer

Store database credentials in AWS Secrets Manager and reference them in Glue connections.. Options B and D are correct. Option B: Storing database credentials in AWS Secrets Manager and referencing them in AWS Glue connections ensures that sensitive credentials are not hard-coded or exposed in plaintext, following security best practices for PII data. Option D: Configuring AWS Glue to use a KMS key for encrypting data written to S3 ensures that data at rest in S3 is encrypted with customer-managed keys, providing additional control over encryption. Option A is incorrect because S3 default encryption with SSE-S3 uses Amazon-managed keys and does not provide the same level of control as KMS; more importantly, the question asks for actions to protect PII, and using SSE-S3 alone is not sufficient for compliance with many regulations that require encryption with customer-managed keys. Option C is incorrect because enabling S3 object deletion protection with a retention policy is about preventing accidental deletion, not directly about protecting data from unauthorized access or encryption. Option E is incorrect because HTTPS encrypts data in transit, but the question also requires encryption at rest; HTTPS alone does not protect data at rest in S3.

Answer

Use S3 default encryption with SSE-S3 for the output bucket.

Answer

Enable S3 object deletion protection by setting a retention policy.

Answer

Use HTTPS for all data transfer between Glue and S3.