DEA-C01 Practice Exam 65 — 20 Questions

Question 1

The exhibit shows an AWS CLI command and its output. A data engineer wants to copy only objects larger than 10 MB from the S3 bucket to another bucket for processing. Which approach should be used to automate this task?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use AWS CLI with a script to filter and copy objects. The command lists objects larger than 10 MB. To automate copying, a script using AWS CLI with the --query parameter can filter and copy. Using S3 Batch Operations allows performing actions on a list of objects. The correct approach is to use AWS CLI with a script that iterates over the filtered list and uses aws s3 cp. S3 replication is for continuous sync, not one-time copy. Lambda with S3 events triggers only on new objects, not existing ones. S3 Inventory provides metadata but not direct copy.

Answer

Use S3 replication rules to replicate objects above 10 MB

Answer

Use S3 Inventory to generate a list and then copy

Answer

Use AWS Lambda with S3 event notifications

Question 2

A company is using Amazon Athena to query data in an S3 bucket. Queries are failing with the error 'HIVE_PATH_ALREADY_EXISTS'. The data is partitioned by year, month, day. What is the MOST likely cause?

Accepted Answer

A partition was manually added to the Glue Data Catalog that already exists. The error 'HIVE_PATH_ALREADY_EXISTS' occurs in Athena when attempting to add a partition (via ALTER TABLE ADD PARTITION or MSCK REPAIR TABLE) that already exists in the Glue Data Catalog. Option B (inconsistent data format) would cause schema mismatch errors like 'HIVE_PARTITION_SCHEMA_MISMATCH', not this error. Option C (empty S3 location) would not cause this error; queries might succeed but return no results. Option D (lack of s3:ListBucket permission) would cause permission errors like 'Access Denied'.

Answer

The data format in the partition is inconsistent with the table schema

Answer

The S3 location for the partition is empty

Answer

The IAM role used by Athena lacks s3:ListBucket permission on the bucket

Question 3

A data engineer runs the command shown to check the encryption configuration of an S3 bucket. The output shows SSEAlgorithm: AES256. What does this mean?

Accepted Answer

The bucket uses SSE-S3 with Amazon S3-managed keys. AES256 refers to SSE-S3, where Amazon S3 manages the encryption keys using AES-256. Option B (SSE-KMS) would show 'aws:kms'. Option C (SSE-C) would require the customer to provide keys. Option D (no encryption) is incorrect because encryption is enabled.

Answer

The bucket uses SSE-KMS with a customer-managed key

Answer

The bucket uses SSE-C with customer-provided keys

Answer

The bucket does not have encryption enabled

Question 4

A company uses Amazon S3 as its data lake. A data engineer needs to enforce encryption of data at rest using server-side encryption with AWS KMS. Which S3 bucket property should be configured?

Accepted Answer

Default encryption. Configuring default encryption on an S3 bucket ensures that all objects stored in the bucket are encrypted at rest using server-side encryption. When AWS KMS is specified as the encryption type, S3 automatically encrypts objects with a KMS key (SSE-KMS) upon upload, even if the upload request does not include encryption headers. This enforces encryption at rest without requiring changes to client applications.

Answer

Server access logging

Answer

Versioning

Answer

Bucket policy

Question 5

A data engineer needs to ingest log files from multiple EC2 instances into Amazon S3. The logs are written to local disk on each instance. The engineer wants a simple agent-based solution that can collect, compress, and upload logs to S3 with minimal configuration. The solution must support incremental uploads (only new log lines) and handle log rotation. What should the engineer use?

Accepted Answer

Install and configure Amazon CloudWatch Agent to collect logs and send them to Amazon CloudWatch Logs, then use a subscription filter to export logs to S3.. Amazon CloudWatch Agent is a lightweight agent that can tail log files, compress them on the fly, and send them to CloudWatch Logs. From CloudWatch Logs, a subscription filter can export the logs to Amazon S3, supporting incremental uploads and log rotation. Option B (AWS CLI cp) is manual and does not handle incremental uploads efficiently. Option C (AWS DataSync) is designed for bulk data transfers, not real-time log ingestion. Option D (S3 sync) is also not real-time and lacks agent-based tailing and compression.

Answer

Use AWS CLI cp command with --recursive in a cron job to copy logs to S3 every minute.

Answer

Install AWS DataSync agent on each EC2 instance to sync logs to S3 daily.

Answer

Use an S3 sync command from the AWS CLI scheduled every hour.

Question 6

A company is using Amazon RDS for MySQL with Multi-AZ deployment. The primary DB instance experiences a hardware failure, causing automatic failover to the standby. After the failover, the application reports that the database endpoint is unreachable for about 60 seconds. What is the MOST likely cause?

Accepted Answer

The DNS record for the DB instance endpoint needed to update to point to the new primary.. After an automatic failover in Amazon RDS Multi-AZ, the DNS record for the DB instance endpoint is updated to point to the new primary. This DNS change can take up to 60 seconds to propagate, during which the application may receive 'unreachable' errors if it caches the old DNS resolution. The 60-second outage aligns with the typical TTL (Time To Live) of 30 seconds for RDS DNS records plus propagation delays.

Answer

The standby instance took longer than expected to promote to primary.

Answer

The standby instance was not in a synchronized state and required a manual promotion.

Answer

The application was using the wrong endpoint and needed to be reconfigured.

Question 7

A data engineer is designing a data lake on S3 with sensitive data. The security policy mandates that data must be encrypted at rest and in transit, and that an inventory of all objects must be maintained for compliance. Which actions should be taken?

Accepted Answer

Enforce HTTPS via bucket policy, enable default SSE-S3 encryption, and enable S3 Inventory.. It covers all requirements: encryption in transit (HTTPS enforcement via bucket policy), encryption at rest (default SSE-S3), and compliance inventory (S3 Inventory). Option B uses SSE-KMS which is not required and lacks inventory. Option C includes at-rest encryption and inventory but misses in-transit encryption. Option D includes in-transit encryption but lacks at-rest encryption and compliance inventory.

Answer

Use SSE-KMS encryption and enable CloudTrail for S3 events.

Answer

Enable S3 default encryption using SSE-S3 and enable S3 Inventory.

Answer

Enforce HTTPS using bucket policy and enable S3 Server Access Logging.

Question 8

A data engineer needs to store large amounts of data that is accessed infrequently but must be retrieved immediately when needed. Which Amazon S3 storage class is most cost-effective?

Accepted Answer

S3 Standard-IA. S3 Standard-IA (Infrequent Access) is the most cost-effective choice because it offers low per-GB storage costs for data accessed infrequently, while still providing millisecond retrieval latency for immediate access when needed. This matches the requirement of storing large amounts of data that is rarely accessed but must be available instantly.

Answer

S3 Intelligent-Tiering

Answer

S3 One Zone-IA

Answer

S3 Glacier Deep Archive

Question 9

A company is using Amazon DynamoDB as a data store for a real-time application. The application reads a single item by primary key and occasionally updates it. The data engineer notices high read latency during peak hours. Which TWO actions would most effectively reduce read latency?

Accepted Answer

Increase the read capacity units for the table.. Option A is correct because the workload is read-heavy with single-item reads by primary key, and if the table is provisioned with insufficient read capacity units (RCUs), requests will throttle or queue during peak hours, so raising the provisioned RCUs directly increases available read throughput and reduces latency. Option E is correct because DynamoDB Accelerator (DAX) is an in-memory cache purpose-built for DynamoDB that serves eventually consistent reads of individual items in microseconds, which is ideal for this read-by-primary-key pattern and offloads repeated reads from the table. Option B is not appropriate because global tables provide multi-Region active-active replication for availability and locality, not lower latency for a single-Region read pattern, and they add replication overhead. Option C is not appropriate because a local secondary index only provides an alternative sort key on the same partition key and does not speed up reads that already use the primary key. Option D is wrong because disabling auto-scaling and fixing read capacity removes the ability to scale with peak demand and would likely worsen throttling and latency.

Answer

Enable DynamoDB global tables.

Answer

Add a local secondary index on the table.

Answer

Disable auto-scaling and set a fixed read capacity.

Question 10

A company uses Amazon DynamoDB with global tables in three AWS Regions. The data engineer needs to ensure that writes to the table in us-east-1 are replicated to other regions with minimal latency. Which DynamoDB feature should be used?

Accepted Answer

DynamoDB Global Tables. DynamoDB Global Tables is the correct feature because it provides multi-region, multi-master replication, automatically replicating writes from us-east-1 to other regions with sub-second latency. This is achieved through DynamoDB Streams and a last-writer-wins conflict resolution mechanism, ensuring data consistency across regions without requiring custom replication logic.

Answer

DynamoDB Time to Live (TTL)

Answer

DynamoDB Streams

Answer

DynamoDB Accelerator (DAX)

Question 11

A data engineer is configuring an S3 bucket policy to allow cross-account access for a partner account to read objects. The bucket is encrypted with SSE-KMS using a customer-managed key. What additional configuration is needed to allow the partner account to decrypt the objects?

Accepted Answer

Update the KMS key policy to grant the partner account kms:Decrypt permission. For cross-account access with SSE-KMS, the KMS key policy must grant the partner account access to use the key. The bucket policy alone is insufficient. The partner account does not need VPC endpoints, and the bucket policy for decryption is not needed. The partner account does not need access to the S3 bucket's encryption configuration.

Answer

Add a bucket policy that grants the partner account s3:GetObject

Answer

Create a VPC endpoint for S3 and add it to the bucket policy

Answer

Add a bucket policy that grants s3:GetObject and s3:GetEncryptionConfiguration

Question 12

A data engineer needs to ingest data from a relational database (MySQL) into Amazon S3 for analytics. The database is 500 GB and the job must run daily with incremental updates. Which AWS service is BEST suited for this task?

Accepted Answer

AWS Database Migration Service (DMS) with a replication task.. AWS DMS with a replication task is the best choice because it is specifically designed for continuous, incremental data replication from relational databases like MySQL to Amazon S3. DMS supports ongoing replication (change data capture) to capture incremental changes without custom scripting, and it can handle the initial 500 GB load efficiently. Other services either lack native incremental support or require additional configuration for this use case.

Answer

Amazon EMR with Apache Sqoop.

Answer

Amazon Kinesis Data Firehose with a database source.

Answer

AWS Glue ETL job with a JDBC connection.

Question 13

A company wants to ensure that all S3 buckets are encrypted using server-side encryption. Which AWS service can be used to automatically remediate non-compliant buckets?

Accepted Answer

AWS Config. AWS Config can use managed rules like s3-bucket-server-side-encryption-enabled to check compliance and trigger auto-remediation via SSM Automation or Lambda. Option D is correct.

Answer

AWS CloudTrail

Answer

Amazon Inspector

Answer

AWS Trusted Advisor

Question 14

A data engineer is troubleshooting a Lambda function that reads from the Kinesis stream 'my-data-stream'. The Lambda function is able to read data but occasionally fails with 'KMS.AccessDeniedException'. What is the most likely cause?

Accepted Answer

The Lambda function's execution role does not have kms:Decrypt permission for the KMS key.. The KMS.AccessDeniedException indicates that the Lambda function's execution role lacks the kms:Decrypt permission for the AWS KMS key used to encrypt the Kinesis stream. When a Kinesis stream is encrypted with a customer managed KMS key, the consumer (Lambda) must have explicit decrypt permissions on that key to read the data records.

Answer

The retention period is too short; increase it.

Answer

The stream has too few shards; increase shard count.

Answer

The Lambda function is not authorized to consume from Kinesis streams.

Question 15

A data engineer notices that an Amazon Redshift cluster is running low on disk space. The cluster has three nodes of type dc2.large. Which action will increase the available storage capacity?

Accepted Answer

Increase the number of nodes in the cluster.. Amazon Redshift stores data on the local instance store volumes attached to each node in the cluster. With a dc2.large cluster, each node provides approximately 160 GB of SSD storage. Adding nodes increases the total available storage linearly because each new node contributes its local storage to the cluster. Therefore, increasing the number of nodes is the correct way to expand disk capacity.

Answer

Mount an Amazon S3 bucket as a file system to store data.

Answer

Change the volume type to Provisioned IOPS SSD (io1) to increase capacity.

Answer

Enable automatic compression on the tables.

Question 16

A company is using Amazon S3 to store critical data and needs to ensure that objects are automatically transitioned to S3 Glacier Deep Archive after 180 days to reduce costs. Which S3 lifecycle action should be configured?

Accepted Answer

Transition. The S3 lifecycle 'Transition' action is specifically designed to move objects between storage classes after a specified number of days. To reduce costs by moving objects to S3 Glacier Deep Archive after 180 days, you configure a lifecycle rule with a Transition action that targets the 'DEEP_ARCHIVE' storage class at the 180-day mark.

Answer

Expiration

Answer

AbortIncompleteMultipartUpload

Answer

NoncurrentVersionTransition

Question 17

A data pipeline ingests daily CSV files from an FTP server into an Amazon S3 bucket. The files must be converted to Parquet format and partitioned by date for efficient querying using Amazon Athena. Which AWS service is most suitable for this transformation?

Accepted Answer

AWS Glue. AWS Glue is the most suitable service because it provides a fully managed ETL (Extract, Transform, Load) capability that can natively read CSV files from S3, convert them to Parquet format, and write the output partitioned by date. Glue's built-in transform 'ConvertToParquet' and dynamic frame partitioning make this a straightforward, serverless solution without needing to manage infrastructure.

Answer

Amazon Kinesis Data Firehose

Answer

Amazon EMR

Answer

AWS Lambda

Question 18

A data engineer is ingesting streaming data from thousands of IoT devices into AWS. The data is JSON-formatted and must be stored in Amazon S3 for long-term analytics. Which service is most appropriate for real-time ingestion and routing to S3?

Accepted Answer

Amazon Kinesis Data Firehose. Amazon Kinesis Data Firehose is the most appropriate service because it is designed for real-time ingestion of streaming data and can directly deliver data to Amazon S3 without requiring custom code. It automatically handles buffering, compression, and partitioning of JSON data, making it ideal for long-term analytics storage.

Answer

Amazon SQS

Answer

Amazon Kinesis Data Streams

Answer

AWS Glue

Question 19

A social media company ingests user activity data from multiple sources using Amazon Kinesis Data Firehose. The data is delivered to Amazon S3 in near-real-time. The company wants to transform the data by adding a timestamp and masking email addresses before storing it in S3. The transformation should be applied to all records. What is the most cost-effective way to implement this transformation?

Accepted Answer

Configure the Firehose delivery stream to invoke a Lambda function for data transformation.. Amazon Kinesis Data Firehose supports invoking an AWS Lambda function for inline data transformation before delivering data to the destination. This allows adding timestamps and masking email addresses in near-real-time as data flows through the delivery stream. It is the most cost-effective and operationally efficient way because it avoids additional storage, batch processing, or separate compute resources.

Answer

Use Amazon Athena to run a CTAS query that transforms the data and writes to a new location.

Answer

Use AWS Glue to schedule a batch job every 5 minutes to transform the data.

Answer

Use Amazon S3 Events to trigger a Lambda function whenever a new object is created.

Question 20

A data pipeline ingests streaming data from Kinesis Data Streams into S3 via Kinesis Data Firehose. Occasionally, small files are written to S3, increasing downstream processing costs. What is the most efficient way to reduce the number of small files?

Accepted Answer

Increase the Firehose buffering interval to 300 seconds and buffering size to 64 MB.. Kinesis Data Firehose allows you to configure buffering hints (size and interval) to control when data is delivered to S3. By increasing the buffering interval to 300 seconds and the buffering size to 64 MB, Firehose accumulates more records before writing, which reduces the number of small files. This is the most efficient approach as it requires no additional infrastructure or post-processing.

Answer

Use a Lambda function to aggregate records before sending to Firehose.

Answer

Use the Kinesis Client Library (KCL) to write larger batches to S3 directly.

Answer

Run a daily AWS Glue job to concatenate small files.