DEA-C01 Practice Exam 67 — 20 Questions

Question 1

A company is using Amazon Kinesis Data Firehose to deliver data to an Amazon S3 bucket. The data is delivered in 5-minute intervals. The company wants to reduce the delivery frequency to 1 minute to get data faster. Which parameter should be changed in the Firehose delivery stream configuration?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Reduce the buffer interval from 300 seconds to 60 seconds.. Kinesis Data Firehose buffers incoming records and delivers them when either the buffer size (e.g., 5 MB) or the buffer interval (e.g., 300 seconds) is reached, whichever comes first. Reducing the buffer interval from 300 seconds to 60 seconds makes Firehose flush every minute, directly achieving the 1-minute delivery frequency the company wants.

Answer

Increase the buffer size to trigger delivery sooner.

Answer

Enable dynamic partitioning to deliver data more frequently.

Answer

Enable compression to reduce data size and speed up delivery.

Question 2

An organization wants to audit all API calls made to AWS services for compliance. Which AWS service should be used to capture and store these API calls?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records API activity across AWS services, capturing who made each call, from which IP, when, and with what parameters, and delivers the events to S3 and/or CloudWatch Logs for auditing. It is the canonical service for compliance auditing of API calls. AWS Config, VPC Flow Logs, and CloudWatch Logs serve different observability purposes.

Answer

AWS Config

Answer

Amazon VPC Flow Logs

Answer

Amazon CloudWatch Logs

Question 3

A company needs to ingest streaming data from multiple sources and store it in Amazon S3. The data volume is up to 5 GB per hour. What is the MOST cost-effective ingestion service?

Accepted Answer

Amazon Kinesis Data Firehose. Amazon Kinesis Data Firehose is the most cost-effective service for ingesting streaming data into Amazon S3 at 5 GB/hour. It is fully managed, automatically scales, and charges only for data ingested (per GB), with no upfront provisioning. While Amazon Kinesis Data Streams (KDS) may have lower throughput cost for steady loads, it requires manual shard management and typically needs additional components (e.g., Lambda functions) to deliver data to S3, increasing operational overhead and total cost. AWS Glue is a batch ETL service, not designed for streaming. AWS Lambda is a compute service and would require custom code and scaling logic, making it more expensive and complex for this use case. Therefore, Kinesis Data Firehose provides the simplest and most cost-effective solution for streaming data ingestion directly to S3.

Answer

AWS Glue

Answer

Amazon Kinesis Data Streams

Answer

AWS Lambda

Question 4

A company is using Amazon EMR with Kerberos authentication. They want to ensure that data in transit between EMR cluster nodes is encrypted. Which configuration should be applied?

Accepted Answer

Configure the EMR cluster to use in-transit encryption.. In-transit encryption on Amazon EMR is enabled through a security configuration that specifies a PEM certificate and, optionally, a TLS certificate provider, which encrypts traffic between cluster nodes and to the EMR service. This is the only option that directly addresses data in transit between nodes.

Answer

Use VPC peering to connect the cluster nodes.

Answer

Enable S3 server-side encryption for the cluster's output data.

Answer

Enable EBS encryption on the cluster instances.

Question 5

A data engineer needs to store semi-structured JSON files that are accessed infrequently but must be retrievable within minutes. The data should be stored cost-effectively. Which storage solution meets these requirements?

Accepted Answer

Amazon S3 Standard-Infrequent Access (S3 Standard-IA) storage class.. Amazon S3 Standard-Infrequent Access (S3 Standard-IA) is the correct choice because it is designed for data accessed infrequently but requires rapid retrieval (within milliseconds). It offers lower storage costs than S3 Standard while maintaining low-latency access, meeting the requirement of retrievability within minutes cost-effectively.

Answer

Amazon S3 Glacier Flexible Retrieval storage class.

Answer

Amazon S3 Glacier Deep Archive storage class.

Answer

Amazon S3 Standard storage class.

Question 6

A data engineer is building an AWS Lake Formation governed data lake. The security team wants to grant a group of analysts access to only the non-sensitive columns of a table in the Data Catalog, while denying access to columns containing Social Security numbers. The analysts use Amazon Athena to query the data. Which Lake Formation permission model should the data engineer use?

Accepted Answer

Grant column-level SELECT permission on the non-sensitive columns and exclude the Social Security number column.. Lake Formation column-level permissions let you grant SELECT on a subset of columns in a Data Catalog table. Analysts can then query the permitted columns through Athena, and any attempt to select the Social Security number column is denied. Duplicating tables or using broad IAM denies does not achieve the same precise, least-privilege control.

Answer

Grant table-level SELECT permission to the analysts and rely on Athena to hide the sensitive columns.

Answer

Use an IAM policy that denies athena:GetQueryResults for queries that reference the sensitive column.

Answer

Create a separate Data Catalog table that contains only non-sensitive columns and grant access to that table.

Question 7

A data engineer needs to transform data in an AWS Glue job using a custom Python library that is not available by default. The library is packaged as a .whl file stored in Amazon S3. The engineer wants the Glue job to use this library without modifying the job script to install it at runtime. What should the engineer do?

Accepted Answer

Place the .whl file in the Glue job's Python library path parameter (--extra-py-files).. Specifying the wheel via the --extra-py-files job parameter makes the custom Python library available to the AWS Glue job without script changes, which is the correct way to include additional dependencies stored in Amazon S3.

Answer

Add the library to the Glue Data Catalog as a custom classifier.

Answer

Use a Glue development endpoint to install the library, then run the job there.

Answer

Upload the .whl to the Glue job's script bucket and import it directly by filename.

Question 8

A data engineer must ingest a 4 TB Oracle database into Amazon S3 nightly. The database is on-premises and the network link supports only 200 Mbps. The engineer wants to minimize the total transfer time and avoid impacting production. Which approach should the engineer use?

Accepted Answer

Use AWS Snowball Edge devices to transfer the data offline and import into Amazon S3.. For multi-terabyte datasets and limited bandwidth, offline transfer with AWS Snowball Edge is the recommended approach. It bypasses the network bottleneck, reduces transfer time, and avoids impacting production systems. Online methods like DMS, DataSync, or S3 Transfer Acceleration are constrained by the available bandwidth and are not optimal for this volume.

Answer

Use Amazon S3 Transfer Acceleration with multipart uploads from an on-premises script.

Answer

Use AWS DataSync with an on-premises agent to transfer the data over the internet.

Answer

Use AWS Database Migration Service (AWS DMS) with a replication instance and an S3 target endpoint.

Question 9

A data engineer needs to grant an AWS Lambda function permission to read objects from a specific Amazon S3 bucket. The Lambda function assumes an IAM role. Which policy should the engineer attach to the IAM role to allow the Lambda function to read objects from the bucket?

Accepted Answer

An IAM policy with s3:GetObject and s3:ListBucket actions, with the resource set to the bucket ARN and objects ARN.. To read objects from S3, the Lambda function requires s3:GetObject on the object ARN and s3:ListBucket on the bucket ARN. This combination allows listing the bucket and retrieving objects. Policies that omit the object ARN for GetObject or include unnecessary write permissions are incorrect. The correct policy follows the principle of least privilege.

Answer

An IAM policy with s3:PutObject and s3:GetObject actions, with resource set to the bucket ARN and objects ARN.

Answer

An IAM policy with s3:ListBucket action and resource set to the objects ARN only.

Answer

An IAM policy with s3:GetObject action and resource set to the bucket ARN only.

Question 10

A data engineer needs to schedule a daily AWS Glue ETL job that transforms data in Amazon S3. The job must run at 2:00 AM UTC every day. What is the simplest way to achieve this?

Accepted Answer

Create an AWS Glue trigger of type SCHEDULED with a cron expression.. The simplest way to schedule a Glue job is to use an AWS Glue scheduled trigger with a cron expression. It is a built-in feature that directly starts the job at the specified time. Other options involve additional services like Lambda, EventBridge, or Step Functions, which add complexity without benefit for a single scheduled job.

Answer

Use AWS Step Functions with a Wait state and a Glue task to run the job daily.

Answer

Use Amazon EventBridge to schedule a Lambda function that calls the Glue StartJobRun API.

Answer

Configure an AWS Glue workflow with a schedule and add the job as a starting trigger.

Question 11

A company stores application logs in Amazon S3 and needs to query them using standard SQL. The logs are in JSON format and are updated daily. The data engineering team wants a serverless solution that requires minimal management and can automatically discover the schema. Which AWS service should they use?

Accepted Answer

Amazon Athena with an AWS Glue Data Catalog table.. Amazon Athena is a serverless query service that integrates with the AWS Glue Data Catalog to automatically discover schemas and query data directly in S3. It requires no infrastructure management and supports standard SQL, making it ideal for querying JSON logs with minimal operational overhead.

Answer

Amazon EMR with Apache Hive.

Answer

Amazon RDS for PostgreSQL with the aws_s3 extension.

Answer

Amazon Redshift Spectrum.

Question 12

A data engineer is setting up an Amazon Redshift cluster and needs to load data from Amazon S3. The data is in CSV format and contains a large number of rows. The engineer wants to achieve the fastest possible load time. Which method should the engineer use?

Accepted Answer

Use the COPY command to load the data from Amazon S3 into the Redshift cluster.. The COPY command is specifically designed for bulk loading data from Amazon S3 into Redshift. It uses parallel processing to load data quickly and efficiently, supports CSV format, and can handle large volumes. Other methods like DMS or Firehose are not optimized for this use case, and INSERT is too slow.

Answer

Use Amazon Kinesis Data Firehose to stream the data from S3 to Redshift.

Answer

Use AWS Database Migration Service (AWS DMS) to migrate the data from S3 to Redshift.

Answer

Use the INSERT INTO command to load the data row by row from S3.

Question 13

A company is ingesting log files from multiple EC2 instances into Amazon S3 using the CloudWatch agent. The logs are delivered to a CloudWatch Logs group, and a subscription filter sends them to a Lambda function for transformation, then to Firehose. The Firehose stream is configured with a buffer interval of 60 seconds and buffer size of 5 MB. The logs are critical and must be available in S3 within 5 minutes. What is the most cost-effective way to reduce the delivery latency?

Accepted Answer

Decrease the buffer interval to 10 seconds. Decreasing the Firehose buffer interval to 10 seconds directly reduces the maximum time data waits in the buffer before being delivered to S3, ensuring logs reach S3 within the required 5-minute window. Since the current 60-second buffer interval is the primary contributor to latency, lowering it to 10 seconds minimizes delivery delay without incurring additional costs, as Firehose charges are based on data volume, not buffer frequency.

Answer

Replace Firehose with Amazon Kinesis Data Streams

Answer

Increase the buffer size to 10 MB

Answer

Increase the buffer interval to 120 seconds

Question 14

A data engineer is troubleshooting an AWS Glue job that is reading from an Amazon Kinesis Data Stream. The job is configured with a 1-minute window and is supposed to process the latest records. However, the engineer notices that the job is reprocessing old data from the stream. What is the most likely cause of this issue?

Accepted Answer

The Glue job is configured with the starting position 'TRIM_HORIZON', which reads all available records from the beginning of the stream.. When an AWS Glue job reads from Kinesis, the starting position determines where reading begins. 'TRIM_HORIZON' reads from the oldest record, while 'LATEST' reads only new records. If the job is reprocessing old data, the starting position is likely set to 'TRIM_HORIZON'. Adjusting this to 'LATEST' will make the job process only new data going forward.

Answer

The Glue job's checkpointing is disabled, so it restarts from the beginning each time it runs.

Answer

The Kinesis stream has multiple shards, and the Glue job is not parallelizing reads across all shards, causing it to reread from one shard.

Answer

The Glue job's bookmarking is enabled, causing it to track processed records and reprocess them if the job fails.

Question 15

A retail company uses Amazon DynamoDB to store product catalog data. The table has a partition key of ProductID and a sort key of Category. The company needs to retrieve all products in a specific category, sorted by ProductID. Which operation should be used?

Accepted Answer

Create a global secondary index (GSI) with Category as the partition key and ProductID as the sort key, then query the GSI.. To efficiently retrieve all products in a specific category sorted by ProductID, a global secondary index (GSI) is needed. The GSI should use Category as the partition key and ProductID as the sort key. This allows Query operations on the GSI to return the desired items in sorted order, leveraging DynamoDB's indexing capabilities for performance and cost efficiency.

Answer

Scan the table with a filter expression on Category.

Answer

Query the table using the partition key and sort key condition.

Answer

Use the BatchGetItem operation with Category as a key.

Question 16

A data engineer is building an AWS Glue ETL job that reads from an Amazon S3 bucket containing nested JSON files and must flatten the nested structures before writing to Amazon Redshift. The job uses the Glue DynamicFrame API. The engineer wants the transformation to run as a single pass without an intermediate shuffle. Which operation should the engineer use?

Accepted Answer

Relationalize. Relationalize is the Glue DynamicFrame transform specifically designed to unnest nested JSON into multiple flat frames in one traversal. It produces a root frame and one frame per nested array, each with a join key back to the parent. This matches the requirement to flatten nested structures before loading into Redshift without an intermediate shuffle.

Answer

ResolveChoice

Answer

ApplyMapping

Answer

DropNullFields

Question 17

A company's security policy states that no S3 bucket in the data platform account may ever be made public, even accidentally. A data engineer must implement a guardrail that blocks any attempt to set a public bucket ACL or public bucket policy, regardless of who makes the change. Which solution enforces this requirement?

Accepted Answer

Enable S3 Block Public Access at the account level and ensure the setting remains on for all existing and future buckets.. S3 Block Public Access at the account level prevents public ACLs and policies for every bucket, including future ones, and can be locked down via AWS Organizations. Detective controls such as AWS Config rules or logging only report exposure after the fact. The requirement is preventive, account-wide, and independent of who attempts the change, which the account-level block setting delivers.

Answer

Configure AWS Config with the s3-bucket-public-read-prohibited and s3-bucket-public-write-prohibited managed rules and rely on their evaluations.

Answer

Turn on S3 server access logging and create an Amazon EventBridge rule that notifies the security team when a public ACL is applied.

Answer

Create an S3 bucket policy that denies s3:PutBucketAcl and s3:PutBucketPolicy for all principals in the account.

Question 18

A data engineer is using AWS Step Functions to orchestrate a series of AWS Glue jobs. The engineer notices that one of the Glue jobs occasionally fails due to a transient network error. The engineer wants to implement a retry mechanism that retries the failed job up to three times with an exponential backoff. Which Step Functions state configuration should the engineer use?

Accepted Answer

Add a 'Retry' field with 'MaxAttempts': 3, 'IntervalSeconds': 2, and 'BackoffRate': 2.0 to the task state.. The 'Retry' field in Step Functions is designed to handle transient errors by retrying the task with optional exponential backoff. Specifying 'MaxAttempts': 3, 'IntervalSeconds': 2, and 'BackoffRate': 2.0 achieves the desired retry behavior. Other options either require complex workarounds or do not support exponential backoff, making the 'Retry' field the correct choice.

Answer

Configure the Glue job itself to retry on failure by setting the 'MaxRetries' parameter in the job definition.

Answer

Use a 'Parallel' state to run the Glue job multiple times simultaneously and take the first successful result.

Answer

Add a 'Catch' field with 'ErrorEquals': ['States.TaskFailed'] and a 'Next' state that increments a counter and loops back.

Question 19

A data engineer is building an AWS Glue ETL job that reads from an Amazon S3 bucket with millions of small JSON files. The job is running slowly and often fails with out-of-memory errors. The engineer needs to improve performance and reliability. What should the engineer do?

Accepted Answer

Use AWS Glue's groupFiles and groupSize parameters to combine small files into larger groups.. When an AWS Glue job reads millions of small files, the overhead of listing and opening each file causes performance degradation and memory issues. The groupFiles and groupSize parameters allow Glue to combine multiple small files into larger read groups, reducing task count and improving throughput. This is the most direct and effective solution for this scenario.

Answer

Enable job bookmarks to process only new files and reduce the workload.

Answer

Increase the number of DPUs for the Glue job to handle the large number of files.

Answer

Convert the JSON files to Parquet using an AWS Glue crawler before running the ETL job.

Question 20

A data engineer is designing a data ingestion pipeline using Amazon Kinesis Data Firehose to deliver streaming data to Amazon S3. The data is in JSON format and must be converted to Apache Parquet before storage. The engineer wants to minimize costs and operational effort. Which two actions should the engineer take to meet these requirements? (Choose two.)

Accepted Answer

Enable record format conversion in the Firehose delivery stream and select Apache Parquet as the output format.. To convert JSON to Parquet in Firehose with minimal effort, enable record format conversion and create an AWS Glue table defining the schema. These two actions allow Firehose to perform the conversion automatically. Other options either add overhead, do not address the conversion, or are supplementary but not required.

Answer

Enable compression on the Firehose delivery stream to reduce storage costs.

Answer

Configure the Firehose delivery stream to invoke an AWS Lambda function to convert each record from JSON to Parquet.

Answer

Set the Firehose buffer size to the maximum value to reduce the number of S3 PUT operations.