DEA-C01 Practice Exam 65 — 20 Questions

Question 1

A data engineer is designing a data pipeline that ingests data from an on-premises system into Amazon S3 using AWS Transfer Family. The data must be encrypted at rest using a customer-managed key in AWS KMS. The S3 bucket policy must allow only encrypted connections. Which policy condition should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

aws:SecureTransport. The condition aws:SecureTransport is used to enforce that connections to S3 are encrypted in transit using TLS/HTTPS. This ensures data is encrypted during transmission. Option B is incorrect because kms:EncryptionContext is used to add encryption context to KMS operations, not to enforce encrypted connections. Option C is incorrect because s3:x-amz-server-side-encryption-aws-kms-key-id enforces the use of a specific KMS key for server-side encryption, not in-transit encryption. Option D is incorrect because s3:x-amz-server-side-encryption enforces server-side encryption (SSE) for objects at rest, not in-transit encryption.

Answer

kms:EncryptionContext

Answer

s3:x-amz-server-side-encryption-aws-kms-key-id

Answer

s3:x-amz-server-side-encryption

Question 2

Refer to the exhibit. A Lambda function with this IAM policy is used to process records from a Kinesis stream and write to S3. The function is failing with access denied errors when writing to S3. What is the issue?

Accepted Answer

The S3 bucket name in the policy does not match the actual bucket used by the function.. The IAM policy grants s3:PutObject permission on the resource 'my-bucket/*', but the Lambda function is attempting to write to an S3 bucket with a different name. Since the bucket name in the policy does not match the actual bucket used by the function, access is denied. Option A is incorrect because the function does not need Kinesis Data Analytics for transformation. Option B is incorrect because the policy includes GetRecords and other Kinesis actions, so the Kinesis stream ARN is not the issue (if it were invalid, the error would occur when reading, not writing). Option C is incorrect because the policy explicitly allows Kinesis actions like GetRecords and DescribeStream, so the function does have permission to read from the stream.

Answer

The function needs to use Kinesis Data Analytics for transformation.

Answer

The Kinesis stream ARN is incorrect.

Answer

The Lambda function does not have permission to read from the Kinesis stream.

Question 3

A company uses Amazon Kinesis Data Analytics to process real-time data. The application needs to aggregate data over a 10-minute window. The team notices that late-arriving events are being dropped. Which configuration should they adjust?

Accepted Answer

Set the allowed_lateness parameter in the application's windowed aggregation.. Kinesis Data Analytics (now part of Amazon Managed Service for Apache Flink) provides an `allowed_lateness` parameter in windowed aggregations to handle late-arriving events. Option A is incorrect because Kinesis Firehose is used for data delivery and buffering, not for handling late events within Kinesis Data Analytics; the application itself must manage lateness. Option B is incorrect because increasing shard count increases parallelism and throughput but does not affect how late events are treated; they will still be dropped unless a lateness tolerance is set. Option D is incorrect because `RecordColumn` count defines the schema of the input stream and has no impact on late-arriving event handling.

Answer

Configure a Kinesis Firehose delivery stream to buffer the late events.

Answer

Increase the shard count of the source Kinesis stream.

Answer

Increase the RecordColumn count in the input stream mapping.

Question 4

A company needs to ingest data from multiple SaaS applications (e.g., Salesforce, Marketo) into Amazon S3 for centralized analytics. The data volume is several GB per day. Which AWS service is most suitable for this ingestion?

Accepted Answer

AWS Glue. AWS Glue is the most suitable service because it provides a fully managed ETL (Extract, Transform, Load) capability with built-in connectors for SaaS applications like Salesforce and Marketo. Glue can extract data from these sources, transform it as needed, and write it to Amazon S3, handling the several GB per day volume efficiently without requiring custom code for each source.

Answer

Amazon Kinesis Data Firehose

Answer

Amazon Athena

Answer

AWS Data Pipeline

Question 5

A company wants to ingest real-time clickstream data from a website into Amazon S3 with a maximum latency of 60 seconds. The data volume peaks at 500 MB/s. Which service should they use to buffer and deliver the data to S3?

Accepted Answer

Amazon Kinesis Data Firehose. Amazon Kinesis Data Firehose is the correct choice because it is designed to ingest streaming data, buffer it, and deliver it to destinations like Amazon S3 with configurable buffer intervals (e.g., 60 seconds) and buffer sizes (e.g., up to 128 MB). It can handle the peak throughput of 500 MB/s by automatically scaling, and it meets the maximum latency requirement of 60 seconds by flushing data to S3 based on time or size thresholds.

Answer

Amazon Simple Queue Service (SQS)

Answer

Amazon Kinesis Data Streams

Answer

AWS Lambda

Question 6

A company is using Kinesis Data Firehose to deliver data to an S3 bucket. The delivery stream is failing with 'S3 bucket access denied' errors. The bucket policy allows the Firehose service principal. What could be the issue?

Accepted Answer

The IAM role assigned to Firehose lacks s3:PutObject permission. Even though the S3 bucket policy allows the Firehose service principal, Kinesis Data Firehose uses an IAM role to write data. This role must have the s3:PutObject permission. Without it, Firehose will receive an access denied error. Option A is incorrect because VPC differences affect network connectivity, not IAM permissions. Option B is incorrect because SSE-KMS requires KMS permissions, but the error here is specifically about S3 access. Option C is incorrect because bucket name validation occurs during stream creation, not during data delivery.

Answer

The S3 bucket is in a different VPC

Answer

The S3 bucket uses SSE-KMS and Firehose does not have KMS permissions

Answer

The S3 bucket name contains invalid characters

Question 7

A data engineer needs to encrypt data at rest in Amazon S3 using server-side encryption with a customer-managed KMS key. Which TWO steps are required to ensure that the KMS key can be used for S3 object encryption?

Accepted Answer

Add a statement in the KMS key policy that allows the S3 service to use the key.. Options C and D are correct. For SSE-KMS with a customer-managed key, the KMS key policy must include a statement that allows the S3 service to use the key (e.g., kms:GenerateDataKey and kms:Decrypt). Additionally, the IAM role writing objects must have kms:GenerateDataKey and kms:Decrypt permissions. Option A is not required because a VPC endpoint for KMS is not mandatory for S3 to access the key. Option B is not required because enforcing SSE-KMS via bucket policy is a separate configuration, not a prerequisite for using the key. Option E is not required because S3 does not use a service-linked role for KMS access.

Answer

Configure a VPC endpoint for KMS to allow S3 to access the key.

Answer

Set the S3 bucket policy to require SSE-KMS for all PutObject requests.

Answer

Create a service-linked role for S3 to access KMS.

Question 8

A data engineer is designing an Amazon Redshift data warehouse for a high-traffic analytics workload. The engineer needs to ensure fast query performance and minimize data movement. Which THREE design decisions should be made? (Choose THREE.)

Accepted Answer

Choose DISTSTYLE KEY for tables that are frequently joined.. Correct answers are A, D, and E. DISTSTYLE KEY on frequently joined tables collocates data on the same node, reducing data movement during joins. Applying compression encodings reduces storage and I/O, improving performance. SORT KEYs on columns used in WHERE clauses enable efficient range-restricted scans. Option B is incorrect because the default distribution style (AUTO) may not be optimal; explicit distribution is better for performance. Option C is incorrect because DISTSTYLE ALL stores a copy of the table on every node, which increases storage and load time; it is suitable only for small dimension tables, not large fact tables.

Answer

Use the default distribution style for all tables.

Answer

Use DISTSTYLE ALL for all large fact tables.

Question 9

A data engineer is monitoring an AWS Glue ETL job that processes data from an S3 bucket and writes to a Redshift table. The job completes successfully but takes longer than expected. The engineer notices that the job uses 10 DPUs and the data size is 500 GB. The job runs in standard mode. Which change would MOST reduce job duration?

Accepted Answer

Increase the number of DPUs to 20.. Increasing the number of DPUs from 10 to 20 allows the job to process data in parallel, reducing execution time. AWS Glue standard mode scales linearly with DPUs for ETL jobs that are not I/O bound. In this case, with 500 GB of data and 10 DPUs, the job is likely CPU-bound and can benefit from additional parallelism. Option B is incorrect because using a smaller worker type (G.1X) reduces available memory and CPU, worsening performance. Option C is incorrect because changing the output from Parquet (columnar, compressed) to CSV (row-based, uncompressed) increases data size and I/O, slowing the job. Option D is incorrect because reducing partitions can cause data skew and reduce parallelism, increasing runtime.

Answer

Use a smaller worker type like G.1X.

Answer

Change the output format from Parquet to CSV.

Answer

Reduce the number of partitions in the data.

Question 10

A company needs to ingest streaming data from multiple sources and store it in Amazon S3. The data volume is up to 5 GB per hour. What is the MOST cost-effective ingestion service?

Accepted Answer

Amazon Kinesis Data Firehose. Amazon Kinesis Data Firehose is the most cost-effective service for ingesting streaming data into Amazon S3 at 5 GB/hour. It is fully managed, automatically scales, and charges only for data ingested (per GB), with no upfront provisioning. While Amazon Kinesis Data Streams (KDS) may have lower throughput cost for steady loads, it requires manual shard management and typically needs additional components (e.g., Lambda functions) to deliver data to S3, increasing operational overhead and total cost. AWS Glue is a batch ETL service, not designed for streaming. AWS Lambda is a compute service and would require custom code and scaling logic, making it more expensive and complex for this use case. Therefore, Kinesis Data Firehose provides the simplest and most cost-effective solution for streaming data ingestion directly to S3.

Answer

AWS Glue

Answer

Amazon Kinesis Data Streams

Answer

AWS Lambda

Question 11

A data engineering team is responsible for ingesting streaming data from a fleet of IoT devices into Amazon S3 using Kinesis Data Firehose. The data volume spikes unpredictably, and the team has configured Kinesis Data Firehose with a buffer size of 5 MB and buffer interval of 60 seconds. During spikes, the team notices that the delivery to S3 is delayed, and some records are lost due to exceeding the service limits. The team needs to ensure no data loss and reduce delivery latency. What should the team do?

Accepted Answer

Use Amazon Kinesis Data Streams as the data source for Firehose to decouple ingestion and delivery.. Using Kinesis Data Streams as the data source for Firehose decouples ingestion and delivery. The stream acts as a durable buffer that can absorb unpredictable spikes, preventing data loss due to Firehose service limits. Firehose can then be configured with smaller buffer size/interval to reduce delivery latency, as the stream retains data until successful delivery. Option B increases buffer size and interval, which would increase latency, contradicting the requirement. Option A adds complexity and does not directly address buffering. Option D is unrelated to Firehose buffering.

Answer

Implement an AWS Lambda function to pre-process the data and send it to Firehose in a throttled manner.

Answer

Increase the buffer size to 10 MB and buffer interval to 120 seconds to allow more data accumulation before delivery.

Answer

Enable S3 Transfer Acceleration on the destination bucket.

Question 12

A company uses Kinesis Data Streams to ingest real-time clickstream data. The data is processed by a Lambda function that writes to an S3 bucket. Recently, the Lambda function has been failing with 'ProvisionedThroughputExceededException' errors. Which action should be taken to resolve this issue?

Accepted Answer

Increase the number of shards in the Kinesis stream.. The 'ProvisionedThroughputExceededException' error indicates that the Lambda function is reading data from the Kinesis stream faster than the stream's shard-level throughput limits allow. Each shard in a Kinesis Data Stream supports up to 2 MB/s read throughput or 5 read transactions per second. Increasing the number of shards distributes the read load across more shards, raising the total available read throughput and resolving the throttling.

Answer

Increase the Lambda function's memory allocation.

Answer

Enable enhanced fan-out for the stream.

Answer

Reduce the batch size in the Lambda event source mapping.

Question 13

A company uses AWS Glue DataBrew to clean and prepare data for machine learning. The source data is in an S3 bucket with server-side encryption using AWS KMS (SSE-KMS). The DataBrew project is set up with an IAM role that has permissions to read from the S3 bucket and use the KMS key. When the DataBrew job runs, it fails with an error indicating that it cannot access the data. The IAM role has the following policy: { 'Version': '2012-10-17', 'Statement': [ { 'Effect': 'Allow', 'Action': ['s3:GetObject', 's3:ListBucket'], 'Resource': ['arn:aws:s3:::my-bucket', 'arn:aws:s3:::my-bucket/*'] }, { 'Effect': 'Allow', 'Action': 'kms:Decrypt', 'Resource': 'arn:aws:kms:us-east-1:123456789012:key/my-key' } ] }. What is the most likely cause of the failure?

Accepted Answer

The IAM role is missing s3:PutObject permission on the DataBrew output bucket.. The IAM role has permissions to read from the source S3 bucket (s3:GetObject, s3:ListBucket) and to decrypt using the KMS key (kms:Decrypt). However, DataBrew needs to write intermediate results to a separate output S3 bucket. The error indicates that the job cannot access data, which in the context of DataBrew often means it cannot write to the output bucket. Therefore, the role is missing s3:PutObject permission on the output bucket. Option B is incorrect because the role already has s3:ListBucket on the source bucket. Option C is incorrect because the S3 bucket being in a different region would not cause an access denied error if the role has proper cross-region permissions; DataBrew can access buckets in any region. Option D is incorrect because kms:Decrypt is sufficient for reading encrypted objects; kms:GenerateDataKey is needed for writing.

Answer

The IAM role is missing s3:ListBucket permission on the source bucket.

Answer

The S3 bucket is in a different region than the DataBrew project.

Answer

The IAM role is missing kms:GenerateDataKey permission for the KMS key.

Question 14

A company needs to store JSON documents that are accessed by a key-value pattern. The data is 500 GB and requires single-digit millisecond latency. Which AWS database is most suitable?

Accepted Answer

Amazon DynamoDB. Amazon DynamoDB is the most suitable choice because it is a fully managed NoSQL key-value and document database that delivers single-digit millisecond latency at any scale, making it ideal for storing and retrieving JSON documents via a key-value access pattern. It supports document data types natively and can handle 500 GB of data efficiently with consistent low-latency performance.

Answer

Amazon Redshift

Answer

Amazon Neptune

Answer

Amazon RDS for MySQL

Question 15

A company wants to use AWS CloudTrail to monitor data events for an S3 bucket. Which TWO configurations are required to capture object-level API operations?

Accepted Answer

Configure the CloudTrail trail to log data events for the S3 bucket.. And Option D are correct. To capture object-level API operations for an S3 bucket, you must configure the CloudTrail trail to log data events for the bucket (Option A). Additionally, the CloudTrail trail must be created in the same AWS Region as the S3 bucket (Option D) because CloudTrail trails are region-specific. Option B is incorrect because management events capture bucket-level operations, not object-level. Option C is incorrect because S3 server access logs are a separate logging mechanism, not part of CloudTrail. Option E is incorrect because CloudWatch Events is not required for CloudTrail to capture events.

Answer

Enable management events in the CloudTrail trail.

Answer

Enable S3 server access logs on the bucket.

Answer

Set up an Amazon CloudWatch Events rule to capture S3 events.

Question 16

A data analytics company uses Amazon Athena to query data stored in an S3 bucket. The data contains personally identifiable information (PII). The security team wants to ensure that only authorized users can access the data through Athena, and that the data is encrypted at rest in S3. Which combination of actions should the company take? (Choose two.)

Accepted Answer

Attach an IAM policy to users that grants Athena access and S3 read access to the bucket.. Attaching an IAM policy that grants Athena access and S3 read access to the bucket ensures that only authorized users can access the data through Athena via IAM permissions. Option E is correct because enabling server-side encryption (SSE-S3) on the S3 bucket ensures data is encrypted at rest. Option B is incorrect because while Lake Formation can be used for data lake permissions, it is not required for this scenario; IAM policies are sufficient. Option C is incorrect because Kinesis is a streaming service, not used for querying data in Athena. Option D is incorrect because an S3 Access Point with a restricted policy could be used but is not necessary when IAM policies already provide the required access control.

Answer

Use AWS Lake Formation to define data lake permissions.

Answer

Use AWS Kinesis to stream data to Athena.

Answer

Create an S3 Access Point with a restricted policy.

Question 17

A company uses AWS Glue DataBrew for data preparation. The data source is an S3 bucket with millions of small CSV files (each < 1 MB). The DataBrew project takes a long time to load the sample data. What is the most likely cause and solution?

Accepted Answer

The large number of small files causes S3 LIST overhead; concatenate files into larger files. DataBrew loads a sample of the data by listing objects in the S3 bucket. With millions of small CSV files, the S3 LIST API call becomes a bottleneck because each list operation has a 1000-object limit per response, requiring multiple paginated requests. Concatenating the small files into larger files reduces the number of objects, dramatically decreasing LIST overhead and speeding up sample loading.

Answer

Use Amazon Athena to query the data instead of DataBrew

Answer

The DataBrew job is under-provisioned; increase the number of DPUs

Answer

Use AWS Glue ETL instead of DataBrew for this volume

Question 18

An IAM policy includes the above resource ARN for CloudWatch Logs. A data engineer needs to allow a Lambda function to create log streams and put logs to the log group 'my-log-group'. However, the Lambda function is failing with access denied. What is the issue?

Accepted Answer

The ARN does not include the log-stream portion.. The ARN provided in the policy is for the log group itself (arn:aws:logs:region:account-id:log-group:my-log-group), but CloudWatch Logs requires separate permissions for the log-stream subresource. To allow a Lambda function to create log streams and put logs, the ARN must include the log-stream portion, typically with a wildcard like arn:aws:logs:region:account-id:log-group:my-log-group:log-stream:*. Without this, the IAM policy does not grant access to the log-stream actions (CreateLogStream, PutLogEvents), causing an access denied error even if the log group ARN is correct.

Answer

The region in the ARN does not match the Lambda function's region.

Answer

The Lambda function does not have an execution role.

Answer

The ARN is incorrectly formatted because of the wildcard.

Question 19

A team uses Amazon Redshift for analytics. They notice that some queries are slow and the system shows high disk usage. The team wants to improve query performance without adding more nodes. Which action should they take first?

Accepted Answer

Run the VACUUM and ANALYZE commands on the tables.. VACUUM and ANALYZE are the first actions to take because they reclaim disk space from deleted rows and update table statistics, which can significantly improve query performance and reduce disk usage. Option B is incorrect because enabling compression on all columns is not a first step; compression is typically set during table creation and may not address current disk usage issues. Option C is incorrect: redistributing tables by changing the distribution key requires recreating the table, which is an invasive operation and not the first troubleshooting step. Option D is incorrect: modifying the WLM queue affects concurrency management, not disk usage or query performance directly related to high disk usage.

Answer

Enable compression on all columns.

Answer

Redistribute the tables by changing the distribution key to a column with high cardinality.

Answer

Modify the workload management (WLM) queue to increase concurrency.

Question 20

A company uses Amazon S3 to store log files from multiple applications. The logs are written in JSON format. A data engineer wants to use Amazon Athena to query these logs. The logs are stored in a bucket with the following structure: 's3://logs/app1/date=2021-01-01/'. The engineer creates an Athena table with partitions. However, when querying, Athena returns zero results for partitions that exist. The engineer has run MSCK REPAIR TABLE to add partitions. What is the most likely cause of the issue?

Accepted Answer

The partition key name in the table definition does not match the S3 folder naming convention.. The most likely cause is that the partition key name in the Athena table definition does not match the S3 folder naming convention. When using MSCK REPAIR TABLE, Athena relies on the partition folder structure (e.g., 'date=2021-01-01') to automatically add partitions. If the table's partition key is named differently (e.g., 'dt' instead of 'date'), MSCK REPAIR will not recognize the folders and will not register the partitions, resulting in zero results. Option A is incorrect because MSCK REPAIR does not fail silently; it either adds partitions or reports none if the structure doesn't match. Option C is incorrect because Athena fully supports JSON format. Option D is incorrect because the bucket location does not affect partition registration; data can be queried in any bucket as long as the table points to it.

Answer

The MSCK REPAIR TABLE command failed silently.

Answer

The log files are in JSON format and Athena does not support JSON.

Answer

The log files need to be copied to a different bucket in the same region.