DEA-C01 Practice Exam 66 — 20 Questions

Question 1

A company is using AWS KMS to encrypt data in Amazon S3. The security team wants to ensure that only specific IAM roles can decrypt the data. Which TWO steps should the data engineer take? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a customer-managed KMS key with a key policy that grants kms:Decrypt only to the allowed IAM roles. To ensure only specific IAM roles can decrypt data in S3 using KMS, you must create a customer-managed KMS key with a key policy that grants kms:Decrypt only to those roles (C). Then, configure the S3 bucket to use SSE-KMS with that key (E). This restricts decryption to only the allowed roles because the key policy explicitly controls access. Option A uses the default AWS managed key which cannot be restricted to specific roles. Option B (SSE-S3) does not use KMS and hence cannot provide role-based decryption control. Option D, requiring MFA for decryption, adds an extra authentication factor but does not by itself restrict which roles can decrypt; it only strengthens the security of the roles that already have permission. Therefore, D is not a step to ensure only specific roles can decrypt.

Answer

Use the default AWS managed KMS key for S3 (aws/s3)

Answer

Use SSE-S3 encryption instead of KMS

Answer

Add an IAM policy to the role that requires MFA for kms:Decrypt

Question 2

A company ingests IoT sensor data into Amazon Kinesis Data Streams. The data must be enriched with device metadata from Amazon DynamoDB and then stored in Amazon S3 in Apache Parquet format. The solution must minimize latency and cost. Which THREE steps should a data engineer implement? (Choose three.)

Accepted Answer

Deliver the enriched data to Amazon Kinesis Data Firehose and enable Parquet conversion.. The correct three steps are: using Amazon Kinesis Data Analytics for Apache Flink to enrich the stream with data from DynamoDB (null), performing a DynamoDB lookup in the Flink application for each record (E), and delivering the enriched data to Amazon Kinesis Data Firehose with Parquet conversion enabled (A). Kinesis Data Analytics for Apache Flink reads from Kinesis Data Streams, enriches each record via DynamoDB lookups, and outputs the enriched stream to Kinesis Data Firehose. Firehose automatically converts data to Apache Parquet before writing to S3, minimizing latency and cost by leveraging managed services without custom code or additional infrastructure.

Answer

Configure an AWS Lambda function to read from the stream, enrich, and write to S3.

Answer

Use AWS Glue streaming ETL to enrich and convert data to Parquet.

Answer

Use Amazon EMR with Spark Streaming to process and store the data.

Question 3

A company wants to monitor and alert on unauthorized API calls in their AWS account. Which AWS service should be used to detect and notify on such events?

Accepted Answer

AWS CloudTrail and Amazon CloudWatch Events. D is correct because AWS CloudTrail records all API calls in the AWS account, and Amazon CloudWatch Events (or EventBridge) can be configured with rules to detect specific API calls (e.g., unauthorized actions) and trigger notifications. Option A is incorrect because Amazon GuardDuty and AWS Security Hub are threat detection and security management services, not primarily for monitoring all API calls. Option B is incorrect because Amazon VPC Flow Logs capture network traffic metadata, not API calls. Option C is incorrect because AWS Config monitors resource configuration changes, not API calls.

Answer

Amazon GuardDuty and AWS Security Hub

Answer

Amazon VPC Flow Logs and Amazon CloudWatch Logs

Answer

AWS Config and AWS Systems Manager

Question 4

Refer to the exhibit. An IAM policy is attached to a user who needs to read objects from the 'example-bucket' S3 bucket. The user reports being unable to read any object under the 'confidential/' prefix. What is the reason for this access issue?

Accepted Answer

The explicit deny statement overrides the allow statement. An explicit deny statement overrides any allow statement, regardless of the order in which they appear. In this policy, there is an allow for GetObject on all objects in example-bucket, but there is an explicit deny for GetObject on the 'confidential/' prefix. Since explicit deny takes precedence, the user cannot read objects under that prefix. Option A is incorrect because the order of evaluation does not matter; explicit deny always wins. Option B is incorrect because the deny statement does not need an explicit allow; the deny itself is effective. Option D is incorrect because the resource ARN in the deny statement is correctly specified as 'arn:aws:s3:::example-bucket/confidential/*'.

Answer

The allow statement is evaluated before the deny statement

Answer

The deny statement is missing an explicit allow for the confidential prefix

Answer

The resource ARN in the deny statement is incorrect

Question 5

A data engineer is responsible for ingesting log files from a fleet of on-premises servers into Amazon S3 for central analysis. Each server generates log files that are rotated every hour, resulting in files of about 500 MB each. The total daily data volume is approximately 1 TB. The network connection between the on-premises data center and AWS is a 100 Mbps VPN. The engineer needs to ensure that all log files are transferred to S3 within 24 hours of generation without data loss. The engineer is considering using AWS DataSync. However, the initial setup shows that the transfer speed is insufficient to meet the 24-hour SLA. What should the engineer do to meet the requirement?

Accepted Answer

Configure AWS DataSync to run on a schedule with incremental transfers and enable data compression.. AWS DataSync can be configured for incremental transfers after an initial full sync, which reduces the amount of data transferred on a daily basis. Additionally, enabling data compression reduces the size of the log files during transfer, making it feasible to meet the 24-hour SLA over a 100 Mbps VPN. Option A is incorrect because while AWS CLI with multipart uploads can improve throughput, it still requires manual scripting and does not provide the same optimization as DataSync. Option B is incorrect because upgrading the VPN bandwidth may not be immediately feasible or cost-effective. Option C is incorrect because ordering an AWS Snowball Edge device is intended for large initial data migrations, not for ongoing daily transfers; it would introduce delays and is not suitable for recurring incremental transfers.

Answer

Use AWS CLI with multipart uploads and parallel threads to maximize throughput.

Answer

Contact the network team to upgrade the VPN bandwidth to at least 1 Gbps.

Answer

Order an AWS Snowball Edge device to transfer the initial data and then use DataSync for incremental changes.

Question 6

A financial services company needs to share sensitive customer data with a third-party analytics firm. The data resides in an S3 bucket encrypted with an AWS KMS customer managed key. The third party has their own AWS account. Which combination of steps is required to securely share the data? (Choose TWO.)

Accepted Answer

Update the KMS key policy to include the third-party account as a principal with kms:Decrypt permission. To share encrypted data cross-account, you must grant the third-party account access to both the S3 objects and the KMS key. Option B is correct: the KMS key policy must include the third-party account as a principal with kms:Decrypt permission to allow decryption. Option E is correct: the S3 bucket policy must grant the third-party account access to the objects (e.g., s3:GetObject). Option A is wrong because sharing the key material is insecure and not necessary; instead, you grant decrypt permissions via the key policy. Option C is wrong: the IAM role should be created in the data owner's account, not the third-party's, and the third-party would assume that role; however, this alone does not provide KMS decrypt access. Option D is wrong because the third party does not need key management permissions (e.g., kms:PutKeyPolicy); only decrypt is needed.

Answer

Share the KMS key material with the third party

Answer

Create an IAM role in the third-party account that can be assumed by the data owner

Answer

Grant the third-party account access to the KMS key management

Question 7

Which TWO services can be used to ingest streaming data into Amazon S3? (Choose two.)

Accepted Answer

Amazon Kinesis Data Streams. Amazon Kinesis Data Streams is a real-time streaming service that can ingest and store streaming data, which can then be consumed and written to Amazon S3 using a Kinesis Data Analytics or a custom consumer application. Amazon Kinesis Data Firehose is a fully managed service that can directly load streaming data into Amazon S3, Amazon Redshift, or Amazon Elasticsearch Service, with optional data transformation and compression.

Answer

Amazon Athena

Answer

AWS Glue

Answer

AWS Database Migration Service (DMS)

Question 8

A company runs a real-time analytics platform on Amazon ECS that ingests streaming data from Amazon Kinesis Data Streams, processes it, and stores results in Amazon DynamoDB. The data volume spikes unpredictably, causing DynamoDB to throttle write requests. The application uses on-demand capacity mode. The data engineer notices that the throttling occurs on a specific partition due to a hot key. The hot key is a customer ID that receives a disproportionate number of writes. The application cannot change the partition key design immediately. The engineer needs to reduce throttling while maintaining low latency. Which solution is most effective?

Accepted Answer

Implement a write buffer using Amazon SQS, and have consumers write to DynamoDB at a controlled rate.. Buffering writes through Amazon SQS decouples the ingestion rate from DynamoDB's capacity, allowing consumers to write at a controlled pace. This directly mitigates throttling on the hot key without requiring a partition key redesign, and SQS provides low-latency, durable buffering suitable for real-time analytics.

Answer

Switch to provisioned capacity with auto scaling and increase the write capacity units.

Answer

Enable DynamoDB Accelerator (DAX) to cache the hot key writes.

Answer

Use DynamoDB Streams to trigger a Lambda function that retries throttled writes.

Question 9

A financial services company uses Amazon Redshift for its data warehouse. The cluster has two nodes and is used for complex analytical queries. The company recently migrated from a single-node cluster to a two-node cluster to improve performance. After the migration, the data engineer notices that query performance has not improved as expected. Some queries are even slower than before. The engineer checks the workload management (WLM) queue configuration and sees that there is only one queue with a concurrency level of 5. The queries are mostly large scans and aggregations. The cluster's CPU utilization is low, but disk I/O is high. What should the data engineer do to improve query performance?

Accepted Answer

Add more nodes or upgrade to a larger node type to increase memory and reduce disk spills.. The high disk I/O and low CPU utilization indicate that queries are spilling to disk because the cluster lacks sufficient memory for large scans and aggregations. Adding more nodes or upgrading to larger node types (e.g., from dc2.large to dc2.8xlarge) increases the total memory, reducing disk spills and improving performance. Option A is incorrect because applying compression reduces the amount of data scanned, but the bottleneck here is memory, not scan volume. Option B is incorrect because increasing the concurrency level would allow more queries to run simultaneously, increasing contention and likely worsening performance. Option D is incorrect because changing distribution style to DISTSTYLE ALL can help with data redistribution but does not directly address memory spilling; the primary issue is insufficient memory.

Answer

Apply compression to the tables to reduce the amount of data scanned.

Answer

Increase the concurrency level in the WLM queue to allow more queries to run simultaneously.

Answer

Change the distribution style of large tables to DISTSTYLE ALL to avoid data redistribution.

Question 10

A company uses AWS Glue to run ETL jobs that transform data from an Amazon S3 bucket (raw) to another S3 bucket (curated). The jobs run on a schedule and process data incrementally. The data engineer notices that the jobs are taking longer to complete each day, and the job metrics show that the number of DPUs (Data Processing Units) is underutilized. The engineer wants to improve job performance. What should the data engineer do?

Accepted Answer

Increase the number of DPUs allocated to the Glue job to enable more parallelism.. Increasing the number of DPUs can improve parallelism and reduce job duration when the workload is parallelizable and DPUs are underutilized. Option B is wrong because AWS Glue Streaming is designed for real-time data, not scheduled batch processing, and would not address the performance issue. Option C is wrong because job bookmarks are already used for incremental processing and do not directly impact job speed. Option D is wrong because decreasing DPUs would reduce parallelism and likely increase job duration.

Answer

Switch from batch processing to streaming using AWS Glue Streaming.

Answer

Enable job bookmarks to skip already processed data more efficiently.

Answer

Decrease the number of DPUs to reduce resource contention.

Question 11

A healthcare company is ingesting patient data from a legacy system into an Amazon S3 data lake using AWS Glue. The legacy system produces CSV files with inconsistent schemas (columns may appear or disappear in different files). The data engineer needs to create a Glue ETL job that can handle schema evolution and transform the data into a standardized parquet format. The job should also be able to process new files as they arrive. Which approach should the data engineer use?

Accepted Answer

Use AWS Glue DynamicFrames to read the CSV files and apply transformations using resolveChoice and applyMapping.. AWS Glue DynamicFrames support schema evolution by allowing schema-on-read, and the `resolveChoice` and `applyMapping` transformations can handle inconsistent schemas across CSV files. Option A is wrong because crawlers only catalog schemas, not perform ETL transformations. Option C is wrong because Python shell jobs are not designed for large-scale ETL and lack native schema evolution handling. Option D is wrong because a static schema would reject files with missing or extra columns, failing to handle schema evolution.

Answer

Use AWS Glue crawlers to create a schema in the Data Catalog and then use a standard Spark DataFrame for transformation.

Answer

Use a Python shell job in Glue to manually parse each file and write to parquet.

Answer

Use a Glue ETL job with a static schema defined in the script and ignore files that don't match.

Question 12

A company runs a Redshift cluster for analytics. The data engineering team notices that COPY commands from S3 are failing for large files (>1 GB) with the error 'S3ServiceException: SlowDown'. What is the most effective solution?

Accepted Answer

Split the large files into smaller parts (e.g., 100 MB each) and use parallel COPY.. The SlowDown error indicates throttling from S3. Splitting large files into smaller parts increases parallelism and reduces the chance of throttling per object. Option A is wrong because using Redshift Spectrum is for querying external tables, not for addressing S3 throttling during COPY. Option B is wrong because enabling automatic compression is for compression, not throttling. Option C is wrong because increasing the number of Redshift nodes does not directly address S3 throttling.

Answer

Use Redshift Spectrum to query the data directly in S3.

Answer

Enable automatic compression on the target tables.

Answer

Increase the number of Redshift nodes to distribute the load.

Question 13

A company uses Amazon DynamoDB as the primary data store for a web application. The application experiences occasional throttling on write requests. The data engineer needs to implement a solution that handles throttling gracefully without losing data. Which approach should the engineer use?

Accepted Answer

Implement exponential backoff in the application's write retry logic. Implementing exponential backoff in the application's write retry logic is the standard AWS-recommended approach for handling DynamoDB throttling (ProvisionedThroughputExceededException). Exponential backoff gradually increases the wait time between retries, reducing the retry rate and allowing the throttling condition to subside, while ensuring no write data is lost as long as the retries eventually succeed. This approach is lightweight, requires no additional AWS services, and aligns with best practices for building resilient applications against DynamoDB throttling.

Answer

Increase the provisioned write capacity to a higher value

Answer

Use an Amazon SQS queue to buffer write requests before sending to DynamoDB

Answer

Enable DynamoDB Accelerator (DAX) to cache writes

Question 14

An application uses the 'orders' DynamoDB table with the schema and provisioned throughput shown in the exhibit. The application frequently queries by customer_id (range key) without specifying the order_id (partition key). What is the most likely impact on performance?

Accepted Answer

Queries will require a full table scan, consuming significant read capacity.. The application queries by customer_id (the sort key) without specifying order_id (the partition key). In DynamoDB, a Query operation requires the partition key to be specified; without it, the only way to retrieve items is a full table Scan, which reads every item in the table. This consumes read capacity proportional to the entire table size, leading to high latency and cost.

Answer

Queries will be throttled because the table does not have a global secondary index.

Answer

Queries will be fast because the sort key is indexed.

Answer

Queries will cause hot partitions on the table.

Question 15

A company uses AWS DMS to migrate data from an on-premises Oracle database to Amazon Redshift. The migration is successful, but after a few days, data in Redshift becomes inconsistent with the source due to ongoing changes. The company needs to keep Redshift synchronized with minimal latency. Which approach should the data engineer use?

Accepted Answer

Configure DMS with ongoing replication using change data capture (CDC).. AWS DMS supports ongoing replication using change data capture (CDC), which captures incremental changes from the Oracle source (via Oracle LogMiner or binary logs) and applies them to Amazon Redshift in near real-time. This approach ensures that Redshift remains synchronized with the source database with minimal latency, meeting the requirement for ongoing consistency after the initial full load.

Answer

Use Amazon Redshift COPY with S3 staging and AWS Lambda triggers.

Answer

Schedule a full DMS load every night.

Answer

Set up Amazon Redshift Spectrum to query the Oracle database directly.

Question 16

A data engineer is designing a data store for real-time analytics on high-velocity clickstream data. The data must be stored in a schema-on-read format and support SQL queries with sub-second latency. Which service should be used?

Accepted Answer

Amazon Kinesis Data Firehose to S3 with Athena. Amazon Kinesis Data Firehose can ingest high-velocity clickstream data and deliver it to Amazon S3, where it is stored in a schema-on-read format (e.g., Parquet or ORC). Amazon Athena then allows SQL queries directly on the data in S3 with sub-second latency when using partitions, columnar formats, and optimizations like AWS Glue Catalog. This combination meets the requirements for real-time analytics without predefining a schema.

Answer

Amazon Redshift

Answer

Amazon Kinesis Data Analytics

Answer

Amazon DynamoDB

Question 17

A company is using Amazon DynamoDB for a high-traffic web application. They notice increased read latency during peak hours. Which design change would best reduce read latency without increasing cost?

Accepted Answer

Enable DynamoDB Accelerator (DAX). DynamoDB Accelerator (DAX) is an in-memory cache that reduces read latency from single-digit milliseconds to microseconds for eventually consistent reads, without requiring any changes to provisioned capacity. Since the question specifies reducing latency without increasing cost, DAX is ideal because it offloads read traffic from the underlying table, allowing you to potentially lower read capacity units (RCUs) while maintaining performance.

Answer

Increase read capacity units

Answer

Use DynamoDB global tables

Answer

Switch to strongly consistent reads

Question 18

A company runs a batch ETL job on Amazon EMR every night. Recently, the job started failing with 'Out of Memory' errors in the Spark executors. The data volume has grown 20% in the past month. The cluster uses uniform instance groups with 5 core nodes of r5.xlarge (4 vCPU, 32 GB RAM). Which change should the data engineer implement to resolve the issue with minimal cost increase?

Accepted Answer

Configure instance fleets to include r5.xlarge and r5.2xlarge instances.. Using instance fleets allows the cluster to include both r5.xlarge and r5.2xlarge instances, enabling the Spark executors to use the larger instances for memory-intensive tasks while still leveraging the existing r5.xlarge nodes. This provides a cost-effective way to handle the 20% data growth by adding memory capacity without replacing the entire cluster or over-provisioning all nodes. Instance fleets also support Spot Instances, which can further reduce costs while addressing the Out of Memory errors.

Answer

Increase the number of core nodes to 7.

Answer

Change instance type to r5.2xlarge (8 vCPU, 64 GB RAM) for all nodes.

Answer

Tune Spark memory configurations to reduce executor memory overhead.

Question 19

A data engineer needs to encrypt data at rest in an Amazon Redshift cluster. The company requires that the encryption key be managed by the customer and rotated annually. Which solution meets these requirements?

Accepted Answer

Use AWS KMS with automatic key rotation enabled.. AWS KMS with a customer-managed key (CMK) allows you to control the encryption key and enables automatic annual rotation. Amazon Redshift natively integrates with KMS for encryption at rest, making this a straightforward solution. Option D is incorrect because CloudHSM is not directly integrated with Redshift for encryption at rest; it requires custom configuration and is typically overkill for the requirement of annual rotation. Option A is incorrect because SSE-C is used for S3 objects, not Redshift. Option B is incorrect because Secrets Manager is designed for secrets like database credentials, not for encryption keys used by Redshift.

Answer

Use S3 server-side encryption with customer-provided keys (SSE-C).

Answer

Use AWS Secrets Manager to store the encryption key and configure Redshift to reference it.

Answer

Use AWS CloudHSM to create and manage the encryption key, and configure Redshift to use it.

Question 20

A data engineer is designing a data ingestion pipeline to load millions of small JSON files from an on-premises FTP server into Amazon S3. The pipeline should minimize cost and operational overhead. Which approach is most suitable?

Accepted Answer

Deploy AWS DataSync to transfer files from the FTP server to S3. AWS DataSync is the most suitable option because it is designed to efficiently transfer large volumes of data from on-premises storage (including FTP servers) to AWS, handling millions of small files with minimal operational overhead. It automates data transfer, retries, and validation, and it is cost-effective as you pay only for the data transferred, with no need for additional infrastructure or complex scripting.

Answer

Use S3 Transfer Acceleration to upload files directly from the FTP server

Answer

Use AWS Snowball Edge to ship the data to AWS

Answer

Set up an AWS Direct Connect connection and use AWS CLI to copy files