DEA-C01 Practice Exam 66 — 20 Questions

Question 1

A marketing analytics team needs to ingest customer transaction data from an on-premises PostgreSQL database into Amazon S3 for analysis. The data volume is about 10 GB daily, and the team wants to perform full refresh daily (truncate and load) into S3 as Parquet files. The company has a Direct Connect connection to AWS. The team needs a simple, managed solution that minimizes operational overhead. What should the team use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use an AWS Glue ETL job with a JDBC connection to the PostgreSQL database, extract data, and write to S3 in Parquet format.. AWS Glue ETL jobs provide a serverless, managed environment to extract data from JDBC sources like PostgreSQL, transform it, and write to S3 in Parquet format. It minimizes operational overhead as it handles provisioning, scaling, and job execution. For a daily full refresh, a Glue job can be scheduled to truncate and load data.

Answer

Set up AWS Database Migration Service (DMS) to continuously replicate data to S3 in Parquet format.

Answer

Use Amazon EMR with a Spark job that reads from PostgreSQL and writes to S3.

Answer

Use AWS Data Pipeline with a SQLActivity to extract data and copy to S3.

Question 2

A company uses Amazon Kinesis Data Firehose to ingest data into an S3 bucket. The data is in JSON format and the team wants to convert it to Parquet before storage. Which TWO configurations are required?

Accepted Answer

Create a Glue table with the schema of the data.. Option B is correct because Firehose data format conversion relies on the AWS Glue Data Catalog: you must create a Glue table (with the appropriate schema and SerDe) that Firehose references so it knows how to interpret the incoming JSON records. Option E is correct because the actual conversion is enabled in the Firehose delivery stream configuration by turning on data format conversion and setting the output format to Parquet (with the Glue table as the schema source). Option A is not required because Kinesis Data Analytics is for SQL/Flink stream processing, not for Firehose's built-in format conversion. Option C is not required because Firehose performs the JSON-to-Parquet conversion natively via Glue, so a custom Lambda transformation is unnecessary. Option D is not required because Athena is a query service for reading data in S3, not a prerequisite for converting it during ingestion.

Answer

Use Kinesis Data Analytics to transform data to Parquet.

Answer

Configure a Lambda function to convert data on the fly.

Answer

Set up an Athena table to read the data.

Question 3

A financial services company is building a real-time fraud detection system. Transaction data is ingested via Amazon Kinesis Data Streams and processed by an Amazon Kinesis Data Analytics for Apache Flink application that runs sliding window aggregations. The output is written to an Amazon S3 bucket for downstream analysis. The Flink application is configured with parallelism of 4 and checkpointing every minute. The company has noticed that the application is experiencing high latency and the checkpointing is frequently failing. The CloudWatch metrics show that the Flink application's CPU utilization is near 100% and the checkpoint duration is spiking to over 5 minutes. The data engineer needs to improve performance. Which action should the data engineer take?

Accepted Answer

Increase the parallelism of the Flink application to distribute the workload across more resources.. The Flink application is experiencing high CPU utilization and checkpointing failures, indicating that the current parallelism of 4 is insufficient to handle the workload. Increasing parallelism distributes the workload across more resources, reducing CPU load per task and allowing checkpointing to complete faster. This is a standard scaling approach for Flink applications in Kinesis Data Analytics.

Answer

Increase the number of shards in the source Kinesis stream to improve throughput.

Answer

Increase the heap memory of the Flink application to handle larger state.

Answer

Decrease the checkpoint interval to 30 seconds to reduce the amount of state being checkpointed.

Question 4

A company wants to grant cross-account access to an S3 bucket without using IAM roles. The data engineer needs to write a bucket policy that allows another AWS account to list objects. Which Principal should be specified in the bucket policy?

Accepted Answer

The AWS account ID of the other account. Specifying the AWS account ID of the other account as the Principal in the bucket policy grants cross-account access to all users and roles in that account, allowing them to list objects. Option A is incorrect because the owning account's ID would grant access to itself, not the other account. Option C is incorrect because specifying an IAM user ARN would restrict access to only that user, not the entire account. Option D is incorrect because the root user is a specific principal, not the account-wide access needed for cross-account delegation.

Answer

The AWS account ID that owns the bucket

Answer

The IAM user ARN in the other account

Answer

The root user of the other account

Question 5

A data engineer needs to ensure that sensitive data stored in Amazon S3 is encrypted at rest. Which TWO options meet this requirement? (Choose TWO.)

Accepted Answer

Server-Side Encryption with AWS KMS-Managed Keys (SSE-KMS). Options A (SSE-KMS) and B (SSE-S3) are correct because both are server-side encryption mechanisms that encrypt S3 objects at rest: SSE-KMS uses AWS KMS customer master keys (CMKs) to generate and manage data keys, while SSE-S3 uses AES-256 keys fully managed by Amazon S3. Both satisfy the requirement that sensitive data stored in S3 be encrypted at rest, and each is applied per-object when the object is written to the bucket. Option C is incorrect because a VPC only controls network-level access to S3 (via endpoints and policies) and does not encrypt data at rest. Option D is incorrect because MFA Delete only adds an authentication requirement for deleting objects or changing versioning state; it provides no encryption. Option E is incorrect because SSL/TLS encrypts data in transit, not at rest, and client-side encryption is a separate approach not represented by that option.

Answer

Using a VPC to restrict network access

Answer

Enabling MFA Delete on the S3 bucket

Answer

Client-Side Encryption with SSL/TLS

Question 6

A company is using Amazon Kinesis Data Streams to ingest real-time clickstream data. The data is consumed by a fleet of EC2 instances running a custom application that processes the records and writes to DynamoDB. The application is experiencing high latency and records are being processed slower than they are produced. The stream has 5 shards. Which action would MOST effectively improve processing speed?

Accepted Answer

Increase the number of shards in the Kinesis stream.. The bottleneck is the number of shards in the Kinesis stream. Each shard provides a fixed read capacity of 2 MB/s and 5 read transactions per second. With only 5 shards, the total read throughput is limited regardless of how many EC2 instances consume the data. Increasing the number of shards increases the total read capacity, allowing more records to be consumed in parallel and reducing processing latency.

Answer

Use the Kinesis Client Library (KCL) to automatically distribute shards among instances.

Answer

Increase the EC2 instance size to provide more CPU and memory.

Answer

Add more EC2 instances consuming from the same stream without changing shard count.

Question 7

A data engineer notices that an AWS Glue ETL job processing data from Amazon S3 to Amazon Redshift has been failing intermittently with the error 'S3ServiceException: SlowDown'. Which action is MOST likely to resolve this issue?

Accepted Answer

Implement exponential backoff and retry logic in the Glue job.. The 'S3ServiceException: SlowDown' error indicates that the AWS Glue job is making requests to Amazon S3 at a rate that exceeds the bucket's request rate limits. Implementing exponential backoff and retry logic (option C) is the most effective solution because it reduces the effective request rate by introducing delays between retries, allowing S3 to recover from throttling. Option A is incorrect because increasing partitions would likely increase the number of concurrent requests, exacerbating throttling. Option B is incorrect because switching to a larger worker type does not affect the rate of S3 requests. Option D is incorrect because S3 Transfer Acceleration improves network transfer speed but does not reduce request throttling.

Answer

Increase the number of partitions in the Glue job to parallelize reads.

Answer

Switch from a Standard to a G.2X large Glue worker type.

Answer

Enable S3 Transfer Acceleration on the source bucket.

Question 8

A company runs an Amazon Redshift cluster for analytics. During peak hours, query performance degrades significantly. The data engineer notices that disk space usage is above 80% on many nodes. Which of the following is the MOST effective long-term solution to improve query performance?

Accepted Answer

Resize the cluster to include additional nodes.. Resizing the cluster to include additional nodes increases both storage and compute capacity, directly addressing the high disk usage and improving query performance. Increasing WLM queue slots (Option A) only manages concurrency but does not add capacity. Compression encoding (Option C) reduces storage but may not alleviate immediate performance degradation, and is not a long-term solution for capacity. Running VACUUM (Option D) reclaims space from deleted rows but does not add new capacity.

Answer

Increase the workload management (WLM) queue slots.

Answer

Apply compression encoding to all columns.

Answer

Run the VACUUM command to reclaim space.

Question 9

A data engineer needs to ensure that an S3 bucket can only be accessed from a specific VPC. Which policy element should be used?

Accepted Answer

Use the condition key aws:SourceVpc in the bucket policy.. The condition key aws:SourceVpc restricts requests to originate from a specific VPC. Option C (aws:SourceVpce) limits access to a VPC endpoint, not the VPC itself. Option B (aws:SourceIp) restricts by IP address, not VPC. Option A (aws:VpcSourceIp) is not a valid condition key.

Answer

Use the condition key aws:VpcSourceIp in the bucket policy.

Answer

Use the condition key aws:SourceIp in the bucket policy.

Answer

Use the condition key aws:SourceVpce in the bucket policy.

Question 10

A company stores log files in Amazon S3. They want to automatically move logs older than 90 days to S3 Glacier Deep Archive to reduce costs. Which S3 feature should be used?

Accepted Answer

S3 Lifecycle configuration. S3 Lifecycle configuration allows you to define rules that automatically transition objects to colder storage classes, such as S3 Glacier Deep Archive, based on age. By setting a rule to move objects older than 90 days to S3 Glacier Deep Archive, you reduce storage costs without manual intervention. This is the correct feature for automating tier-based data lifecycle management.

Answer

S3 Intelligent-Tiering

Answer

S3 Replication

Answer

S3 Object Lock

Question 11

A company uses Amazon Redshift for data warehousing. The security team requires that all data stored in Redshift be encrypted at rest using a customer-managed KMS key. How should the data engineer configure this?

Accepted Answer

Enable encryption using a KMS key when creating the Redshift cluster. Redshift encryption at rest with a customer-managed KMS key must be specified at cluster creation time via the 'Encrypted' and 'KmsKeyId' parameters (console: 'KMS' encryption option). Once a cluster is created unencrypted, it cannot be converted in place — you must create a new encrypted cluster and migrate data. This satisfies the security team's requirement of a CMK rather than the default AWS-managed key.

Answer

Configure S3 SSE-KMS on the underlying S3 storage

Answer

Use the AWS KMS console to encrypt the Redshift cluster after creation

Answer

Set a cluster parameter group with encryption enabled

Question 12

A company stores sensitive data in Amazon S3. To meet compliance requirements, they need to ensure that any data older than 1 year is automatically moved to a lower-cost storage class. Which S3 feature should they use?

Accepted Answer

S3 Lifecycle policies. S3 Lifecycle policies let you define rules that automatically transition objects to a lower-cost storage class (e.g., S3 Standard-IA, S3 Glacier Instant Retrieval, S3 Glacier Flexible Retrieval) after a specified age, such as 365 days. This is the native, declarative mechanism for age-based storage class transitions and satisfies the compliance requirement without custom code.

Answer

S3 Replication

Answer

S3 Glacier

Answer

S3 Intelligent-Tiering

Question 13

Which TWO actions can help optimize Amazon S3 storage costs for a data lake? (Choose two.)

Accepted Answer

Use S3 Intelligent-Tiering for unpredictable access patterns. Option B is correct because S3 Intelligent-Tiering automatically moves objects between frequent and infrequent access tiers based on changing access patterns, eliminating retrieval fees and avoiding the cost of manual tiering when access is unpredictable. Option E is correct because S3 Lifecycle policies can transition aging objects to lower-cost storage classes such as S3 Glacier Instant Retrieval, Glacier Flexible Retrieval, or Glacier Deep Archive, directly reducing storage costs for cold data. Option A is not a cost optimization for a data lake because S3 Replication to another region incurs additional storage, request, and inter-region data transfer charges. Option C reduces data scanned and compute cost for querying, but it does not lower S3 storage costs. Option D speeds up uploads over long distances via AWS edge locations but adds a premium charge, so it increases rather than optimizes storage cost.

Answer

Enable S3 Replication to another region

Answer

Use S3 Select to retrieve only needed data

Answer

Enable S3 Transfer Acceleration

Question 14

A company stores sensitive data in an S3 bucket. To meet compliance requirements, they must ensure that all objects are encrypted at rest using server-side encryption with AWS KMS. Which bucket policy statement should be applied to deny uploads that do not use the required encryption?

Accepted Answer

{"Effect":"Deny","Principal":"*","Action":"s3:PutObject","Resource":"arn:aws:s3:::bucketname/*","Condition":{"StringNotEquals":{"s3:x-amz-server-side-encryption":"aws:kms"}}}. It uses the `s3:x-amz-server-side-encryption` condition key with `StringNotEquals` set to `aws:kms`, which denies any `s3:PutObject` request where the encryption header does not specify `aws:kms`. This ensures all uploaded objects are encrypted at rest using server-side encryption with AWS KMS, meeting the compliance requirement.

Answer

{"Effect":"Deny","Principal":"*","Action":"s3:PutObject","Resource":"arn:aws:s3:::bucketname/*","Condition":{"StringNotEquals":{"s3:x-amz-server-side-encryption":"AES256"}}}

Answer

{"Effect":"Deny","Principal":"*","Action":"s3:PutObject","Resource":"arn:aws:s3:::bucketname/*","Condition":{"StringNotEquals":{"s3:x-amz-server-side-encryption-aws-kms-key-id":"arn:aws:kms:us-east-1:123456789012:key/abc123"}}}

Answer

{"Effect":"Deny","Principal":"*","Action":"s3:PutObject","Resource":"arn:aws:s3:::bucketname/*","Condition":{"Null":{"s3:x-amz-server-side-encryption":"true"}}}

Question 15

A data engineer needs to grant an IAM user the ability to view Amazon CloudWatch Logs log groups and stream log events from a specific log group. Which IAM policy action should be used?

Accepted Answer

logs:DescribeLogGroups and logs:GetLogEvents. Viewing log groups requires logs:DescribeLogGroups, and reading/streaming log events from a specific group requires logs:GetLogEvents (or logs:FilterLogEvents for filtered reads). Together these two actions satisfy the read-only requirement. They map directly to the CloudWatch Logs API calls DescribeLogGroups and GetLogEvents.

Answer

logs:PutLogEvents

Answer

logs:CreateLogGroup

Answer

logs:DeleteLogGroup

Question 16

A company stores sensitive data in an Amazon S3 bucket. To comply with regulations, all data must be encrypted at rest using server-side encryption. The security team wants to ensure that any attempt to upload an unencrypted object is automatically denied. Which S3 bucket policy condition should be used?

Accepted Answer

s3:x-amz-server-side-encryption. The bucket policy condition key s3:x-amz-server-side-encryption matches the x-amz-server-side-encryption request header that S3 requires on PUT requests when server-side encryption is specified. By using a Deny effect with a StringNotEquals condition on this key (or Null check), any PutObject request that does not include the encryption header is rejected before the object is written. This enforces encryption at rest at the API layer, regardless of client behavior.

Answer

s3:x-amz-server-side-encryption-aws-kms-key-id

Answer

s3:x-amz-acl

Answer

s3:x-amz-storage-class

Question 17

A company uses Amazon Kinesis Data Firehose to deliver streaming data to an Amazon S3 bucket. The data is then processed by a scheduled AWS Glue ETL job that loads it into an Amazon Redshift table. Recently, the Glue job has been failing with the error: 'S3ServiceException: Access Denied'. The Firehose delivery stream is configured with a prefix and error logging to the same S3 bucket. The Glue job uses the same IAM role that has s3:GetObject and s3:ListBucket permissions on the bucket. What is the most likely cause?

Accepted Answer

The S3 bucket has default encryption enabled with AWS KMS (SSE-KMS), and the Glue job's IAM role lacks kms:Decrypt permission.. The Glue job's IAM role has s3:GetObject and s3:ListBucket, which are sufficient for reading objects from S3 in the absence of encryption. However, when the bucket uses SSE-KMS default encryption, reading an object requires the kms:Decrypt permission on the KMS key in addition to s3:GetObject. The 'Access Denied' error is the classic symptom of a missing kms:Decrypt grant, making option D the most likely cause.

Answer

The Glue job expects a different data format than what Firehose writes.

Answer

The Glue job's IAM role does not have s3:GetObjectVersion permission.

Answer

The Glue job is using the wrong IAM role that does not have permissions to the S3 bucket.

Question 18

A company runs a critical application on Amazon RDS for MySQL. To ensure high availability and automatic failover, the database is deployed as a Multi-AZ DB instance. The application uses read-heavy workloads. Which additional configuration should be used to offload read traffic without impacting write performance?

Accepted Answer

Create one or more Read Replicas in different AZs.. Amazon RDS Read Replicas are designed to offload read traffic from the primary DB instance without affecting write performance. Unlike the Multi-AZ standby instance, which is not accessible for reads, Read Replicas can be placed in different Availability Zones and serve read queries independently, improving read scalability while the primary handles writes.

Answer

Use the Multi-AZ standby instance for read queries.

Answer

Use Amazon ElastiCache to cache read queries.

Answer

Change to a Single-AZ deployment with a larger instance size.

Question 19

A data engineer needs to audit all AWS KMS key usage events for the past 90 days to verify compliance. Which AWS service should be used?

Accepted Answer

AWS CloudTrail. (AWS CloudTrail). AWS CloudTrail logs all API calls made to AWS KMS, including key usage events, and retains event history for the past 90 days by default, making it suitable for auditing. Option A (VPC Flow Logs) captures network traffic, not API calls. Option C (AWS Config) tracks resource configuration changes, not API calls. Option D (Amazon Inspector) performs vulnerability assessments, not API logging.

Answer

VPC Flow Logs

Answer

AWS Config

Answer

Amazon Inspector

Question 20

A large e-commerce company uses Amazon DynamoDB to store shopping cart data. The table has a partition key of 'user_id' and a sort key of 'item_id'. The application performs frequent updates to the 'quantity' attribute for items in a user's cart. Recently, the operations team noticed that write requests are being throttled during peak shopping hours. The table is provisioned with 10,000 write capacity units (WCUs) and uses DynamoDB Accelerator (DAX) for read caching. The data engineer suspects that the throttling is due to hot partitions. The application uses a single AWS SDK client configured with retries. After reviewing the Amazon CloudWatch metrics, the engineer sees that the WriteThrottleEvents metric spikes for a few partition keys. The table has a high number of partitions. What should the data engineer do to resolve the throttling issue with minimal application changes?

Accepted Answer

Configure DynamoDB Auto Scaling with a maximum WCU setting of 20,000 and a target utilization of 70%.. DynamoDB Auto Scaling can dynamically adjust write capacity in response to traffic patterns, reducing throttling on hot partitions without requiring application changes. Option A is incorrect because permanently increasing WCUs does not adapt to variable demand and may lead to over-provisioning. Option B (Global Tables) replicates data across regions but does not increase write capacity for a single table, so it does not resolve hot partition throttling. Option C (DAX) is a read cache and does not offload write traffic; it only improves read performance.

Answer

Increase the provisioned write capacity to 20,000 WCUs permanently.

Answer

Enable DynamoDB Global Tables to distribute writes across regions.

Answer

Add more nodes to the DAX cluster to offload write traffic.