DEA-C01 Practice Exam 68 — 20 Questions

Question 1

A data engineering team stores clickstream events in an Amazon S3 bucket under the prefix s3://analytics/raw/. New objects arrive continuously, and the team wants Amazon Athena queries to scan only the events for the current day without scanning the entire prefix. The events are written as JSON files partitioned by year/month/day, but queries still scan all partitions because the partition metadata is not registered. Which action should the data engineer take to enable partition pruning in Athena?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Run MSCK REPAIR TABLE on the Athena table to add the year/month/day partitions to the AWS Glue Data Catalog.. Partition pruning requires the query engine to know which partition values exist and where their data lives. Registering the year/month/day folders as partitions in the Data Catalog lets Athena build a plan that reads only the matching day, cutting scanned bytes and cost. Physical optimizations such as acceleration or columnar formats do not supply that partition metadata.

Answer

Create an Amazon CloudFront distribution in front of the S3 bucket and point Athena at the distribution.

Answer

Enable S3 Transfer Acceleration on the bucket so Athena can retrieve the daily events faster.

Answer

Convert the JSON files to Apache Parquet and rely on columnar storage alone to limit the scan to one day.

Question 2

A data engineer is building an AWS Glue job that reads semi-structured JSON from Amazon S3 and must flatten nested arrays into relational columns before writing to Amazon Redshift. The transformation logic is complex and the engineer wants to unit test it locally without provisioning a cluster. Which Glue capability should the engineer use to develop and test this transformation logic?

Accepted Answer

The AWS Glue ETL library (awsglue) run locally with a Python environment and sample datasets.. The AWS Glue ETL library can be installed locally so developers run the same transformation code against sample data without any managed cluster. This enables genuine unit tests of complex nested-array flattening. The visual editor, interactive sessions, and DataBrew all depend on AWS-hosted execution and therefore cannot satisfy the requirement for local testing before deployment.

Answer

AWS Glue DataBrew recipe steps executed against a sample dataset.

Answer

AWS Glue interactive sessions with an AWS Glue Studio notebook.

Answer

AWS Glue Studio visual job editor with a custom transform node.

Question 3

A data engineer is loading data from Amazon S3 into an Amazon Redshift cluster using the COPY command. The S3 bucket contains 500 Parquet files, each about 200 MB, in a single prefix. The COPY job is running slowly and consuming excessive cluster resources. The engineer wants to improve performance without changing the data format or the cluster size. Which action should the engineer take?

Accepted Answer

Split the data into multiple prefixes and run multiple COPY commands in parallel, or use a manifest file to distribute the load across slices.. Redshift COPY achieves high throughput by having multiple slices read files in parallel. When hundreds of files sit in one prefix, the leader node may serialize listing and assignment, and some slices may read more files than others, causing skew and resource contention. Distributing files across prefixes or using a manifest gives COPY finer-grained control over parallel reads, balancing work across slices and improving load speed without altering the format or cluster size.

Answer

Use the COPY command with the PARALLEL OFF option to reduce the number of slices used.

Answer

Convert the Parquet files to CSV and load them with the CSV option to enable faster parsing.

Answer

Add the COMPUPDATE OFF and STATUPDATE OFF options to the COPY command to skip compression and statistics updates.

Question 4

A company stores sensitive financial data in an Amazon S3 bucket. The data engineering team must ensure that all data is encrypted at rest using AWS Key Management Service (AWS KMS) customer managed keys, and that the encryption keys are rotated annually. The team also needs to audit key usage. Which solution meets these requirements?

Accepted Answer

Enable default encryption on the S3 bucket using SSE-KMS with a customer managed key, enable automatic key rotation for the KMS key, and enable AWS CloudTrail to log KMS API calls.. The correct solution uses SSE-KMS with a customer managed key to encrypt data at rest, enables automatic key rotation for that key to meet the annual rotation requirement, and enables AWS CloudTrail to log KMS API calls for auditing key usage. Other options either use incorrect key types (SSE-S3 or AWS managed keys) or do not provide the necessary auditing capabilities.

Answer

Enable default encryption on the S3 bucket using SSE-S3, and configure S3 server access logging to track key usage.

Answer

Use client-side encryption with a customer provided key stored in AWS Secrets Manager, and enable AWS CloudTrail to log S3 API calls.

Answer

Enable default encryption on the S3 bucket using SSE-KMS with an AWS managed key, and configure S3 Inventory to report on encryption status.

Question 5

A data engineer is optimizing an Amazon S3 data lake for cost and performance. The data lake contains large volumes of CSV files that are queried by Amazon Athena. The engineer wants to reduce query costs and improve query performance. Which TWO actions should the engineer take? (Choose two.)

Accepted Answer

Partition the data by a frequently filtered column, such as date.. Converting CSV to Parquet and partitioning the data by a frequently filtered column are the two most effective actions to reduce Athena query costs and improve performance. Parquet reduces scanned data through columnar compression and predicate pushdown, while partitioning limits the data scanned to relevant partitions. The other actions do not affect query execution or data scanned.

Answer

Enable S3 server access logging on the bucket.

Answer

Enable S3 Transfer Acceleration on the bucket.

Answer

Increase the number of Athena workgroups.

Question 6

A data engineer is building an Amazon Redshift data warehouse. The cluster will ingest data from Amazon S3 using the COPY command. The engineer needs to ensure that the data is loaded in a way that maximizes query performance for future complex analytical queries. The data is currently stored as uncompressed CSV files in S3. Which action should the engineer take to optimize the load and subsequent query performance?

Accepted Answer

Use the COPY command with the COMPUPDATE ON option to automatically apply compression, and define an appropriate distribution key and sort key on the target table.. The correct approach is to use COPY with COMPUPDATE ON to automatically apply compression, and to define an appropriate distribution key and sort key. This optimizes storage, reduces I/O, and improves query performance by ensuring even data distribution and efficient data access patterns. Other options either do not address compression, distribution, or sort keys adequately, or rely on commands that do not achieve the desired optimization.

Answer

Use the COPY command with the GZIP option to load compressed files, which automatically distributes the data evenly across all nodes.

Answer

Load the data into a table with no compression and then run a VACUUM command to reorganize and compress the data.

Answer

Load the data into a single large staging table and then use CREATE TABLE AS (CTAS) to redistribute it into multiple tables.

Question 7

A data engineer is using Amazon Athena to query data stored in Amazon S3. The engineer wants to reduce query costs and improve performance for a table that is frequently queried with filters on a date column. The data is stored as uncompressed CSV files partitioned by year/month/day. Which action should the engineer take?

Accepted Answer

Convert the data to Parquet format and use partitioning by date, then run MSCK REPAIR TABLE.. For Athena, the most effective way to reduce cost and improve performance is to use a columnar format like Parquet and partition the data. Parquet allows column pruning, and partitioning enables partition pruning, so queries scan less data. Updating partitions with MSCK REPAIR TABLE ensures the metadata is current, allowing these optimizations to take effect.

Answer

Use Amazon Redshift Spectrum to query the S3 data instead of Athena.

Answer

Increase the number of S3 buckets storing the data to parallelize reads.

Answer

Enable Athena query result reuse and set a short cache TTL.

Question 8

A data engineer manages an AWS Glue ETL job that reads from an Amazon S3 bucket and writes to another S3 bucket. Both buckets are encrypted with SSE-KMS using customer managed keys. The Glue job execution role has permissions to read from the source bucket and write to the target bucket, and has kms:Decrypt permission on the source key, but the job fails with an error indicating it cannot write to the target bucket due to encryption. What is the MOST likely cause?

Accepted Answer

The Glue job execution role lacks kms:GenerateDataKey permission on the target bucket's KMS key.. Writing to an SSE-KMS encrypted S3 bucket requires the kms:GenerateDataKey permission on the KMS key used for the target bucket. The Glue job role already has read and decrypt permissions on the source, but lacks the necessary permission to encrypt data for the target. Without GenerateDataKey, the S3 PutObject operation fails.

Answer

The Glue job execution role lacks s3:PutObjectAcl permission on the target bucket.

Answer

The target S3 bucket's default encryption uses SSE-S3 instead of SSE-KMS, causing a conflict.

Answer

The Glue job execution role lacks kms:Decrypt permission on the target bucket's KMS key.

Question 9

A data engineer is building an AWS Glue ETL job that reads data from Amazon S3 and must write the output partitioned by year, month, and day for efficient downstream querying in Amazon Athena. The engineer wants the job to create the partition folders and register them in the Glue Data Catalog automatically. (Choose two.)

Accepted Answer

Set the DynamicFrame write option partitionKeys to the year, month, and day columns.. Producing partitioned output and registering it in the Glue Data Catalog from a Glue job is achieved by specifying partitionKeys on the write and enabling the job to update the Data Catalog. Together these create the year/month/day folder structure and add the corresponding catalog partitions during the run. Manual API calls or a separate crawler can work but are not the automatic in-job mechanism the scenario requires.

Answer

Call the Glue catalog's create_partition API for each partition after the job writes files.

Answer

Run an AWS Glue crawler on the output prefix after every job run.

Answer

Store the output as a single Parquet file per run to preserve partition metadata.

Question 10

A data engineer is configuring an AWS Glue job that reads from an Amazon RDS for MySQL database and writes to Amazon S3. The security team requires that the data be encrypted in transit between AWS Glue and Amazon RDS. Which action should the engineer take to meet this requirement?

Accepted Answer

Configure the AWS Glue connection to use SSL by setting the JDBC URL with the sslMode=REQUIRED parameter and providing the RDS root certificate.. To encrypt data in transit between AWS Glue and Amazon RDS for MySQL, the JDBC connection must be configured to use SSL. Setting sslMode=REQUIRED in the JDBC URL and providing the RDS root certificate ensures that the connection is encrypted and the server certificate is validated. This is the correct approach for meeting the encryption in transit requirement.

Answer

Attach an IAM policy to the Glue job role that allows rds:DescribeDBInstances and rds:Connect, which enforces SSL.

Answer

Use AWS Glue's built-in encryption context to encrypt the data before writing to RDS.

Answer

Enable encryption at rest on the RDS instance, which automatically encrypts data in transit as well.

Question 11

A financial services company stores trade records in Amazon DynamoDB. An application performs many reads per second for individual trades by tradeId and also runs a nightly analytics job that must read every trade for a given trading day. The table uses tradeId as the partition key only. The nightly job currently performs a full table scan and is slow and expensive. The company wants to optimize the nightly access pattern with minimal application changes. Which change should the data engineer make?

Accepted Answer

Create a global secondary index with a partition key of tradingDay and a sort key of tradeId, then query that index for each day.. DynamoDB access is most efficient when queries target a specific partition key value. Because the base table partitions by tradeId, retrieving all trades for a day requires a Scan. A global secondary index partitioned by tradingDay gives each day its own logical partition, so the nightly job can use Query to read only that day's items. The base table schema and write path stay the same, so application changes are minimal.

Answer

Add a local secondary index on the base table with tradeId as the sort key and query it for each day.

Answer

Increase the table's provisioned read capacity units and schedule the full table scan during off-peak hours.

Answer

Enable DynamoDB Streams on the table and have the nightly job consume the stream to reconstruct the day's trades.

Question 12

A data engineer needs to run a transformation on a small dataset of 500 MB stored in Amazon S3 and load the result into Amazon Redshift. The transformation logic is simple column renaming and filtering. The engineer wants to minimize operational overhead and avoid managing servers. Which approach is most appropriate?

Accepted Answer

Use AWS Glue with a Python shell job to perform the transformation and load the data.. AWS Glue Python shell jobs are serverless and optimized for small to medium ETL workloads that do not need Spark's distributed processing. For a 500 MB dataset with simple transformations, they provide the lowest operational overhead while integrating with S3 and Redshift. EMR, EC2, and Lambda each introduce either management burden or technical limits that make them less suitable for this scenario.

Answer

Launch an Amazon EMR cluster, run a Spark job, and terminate the cluster after the job completes.

Answer

Create an AWS Lambda function to read the S3 object and write directly to Redshift.

Answer

Provision an Amazon EC2 instance, install Apache Spark, and run the transformation as a scheduled cron job.

Question 13

A data engineer is using Amazon Kinesis Data Firehose to deliver streaming data to an Amazon S3 bucket. The engineer notices that some data records are missing from S3, and the Firehose delivery stream metrics show increased DeliveryToS3.DataFreshness. The engineer needs to ensure all records are delivered. Which action should the engineer take?

Accepted Answer

Enable error logging on the Firehose delivery stream and review the error output in Amazon CloudWatch Logs.. Enabling error logging on the Firehose delivery stream is crucial for diagnosing why records are not delivered to S3. The logs in CloudWatch will show specific errors such as access denied or invalid records, allowing the engineer to take corrective action. This directly addresses the missing data and high data freshness.

Answer

Increase the number of shards in the source Kinesis data stream to improve throughput.

Answer

Enable Amazon S3 server access logging on the destination bucket to capture failed deliveries.

Answer

Configure the Firehose delivery stream to use a longer buffering interval to reduce the number of S3 PUT requests.

Question 14

A data engineer is using AWS Glue Studio to build a job that reads from an Amazon S3 data source, applies a filter transformation, and writes to Amazon S3 in Parquet. The engineer notices that the job is reading all files in the prefix, including files that do not match the expected schema, causing job failures. Which action should the engineer take to ensure only valid files are processed?

Accepted Answer

Configure the S3 data source with a path that includes only valid partitions or use a glob pattern to exclude invalid files. The root cause is that the job reads all objects under the prefix, including files that do not match the schema. Restricting the S3 source path with a glob pattern or limiting to valid partitions ensures only conforming files are read. This is a configuration change that directly prevents the failures without adding compute or custom classification logic.

Answer

Enable job bookmarks and set the transformation context to filter invalid records

Answer

Increase the number of DPUs and enable auto-scaling to handle the invalid files

Answer

Use a Glue crawler with a custom classifier to catalog only valid files and update the job to read from the catalog table

Question 15

A data engineer is optimizing an AWS Glue ETL job that reads a large dataset from Amazon S3 and writes to Amazon Redshift. The job currently runs slowly and consumes many DPUs. The engineer wants to improve performance and reduce cost. Which two actions should the engineer take? (Choose two.)

Accepted Answer

Partition the source data in Amazon S3 and use predicate pushdown in the Glue job. Job bookmarks reduce the data read on subsequent runs by tracking processed files, and partitioning with predicate pushdown reduces the data scanned per run. Together they lower runtime and DPU consumption, improving performance while reducing cost. Increasing DPUs or converting to CSV would increase cost or hurt performance, and disabling auto-scaling removes a cost-saving feature.

Answer

Increase the number of DPUs to the maximum allowed for the job

Answer

Convert the output to CSV instead of Parquet to reduce write time

Answer

Disable auto-scaling to keep the job at a fixed capacity

Question 16

A data engineer needs to load data from an Amazon S3 bucket into an Amazon Redshift cluster as part of an ETL pipeline. The source files are already in Parquet format and the engineer wants the fastest load with minimal transformation. Which Redshift load method should the engineer use?

Accepted Answer

Use the COPY command with the PARQUET format option.. The Redshift COPY command is the native bulk loader and supports Parquet directly via the PARQUET format option, which reads columnar data efficiently from S3. For Parquet files with no required transformation, COPY is faster and simpler than a Glue job, and the other options either move data the wrong direction or add streaming overhead.

Answer

Use an AWS Glue ETL job to read the Parquet files and write to Redshift using the Redshift connector.

Answer

Use the Redshift UNLOAD command to move the Parquet files into the cluster.

Answer

Use an Amazon Kinesis Data Firehose delivery stream with Redshift as the destination.

Question 17

A data engineer stores sensitive records in an Amazon S3 bucket. The security team wants to guarantee that every object is encrypted before it is written to disk and that the bucket automatically rejects any unencrypted PUT request, regardless of which IAM principal sends it. Which configuration should the data engineer apply?

Accepted Answer

Attach a bucket policy that denies s3:PutObject when the request lacks the s3:x-amz-server-side-encryption condition key.. The only mechanism that blocks an unencrypted PUT before the object is stored is a bucket policy using a Deny effect with the s3:x-amz-server-side-encryption condition key. Default encryption and console warnings are passive safeguards that cannot stop an explicit unencrypted request from an SDK or CLI. Block Public Access and lifecycle rules address different concerns entirely.

Answer

Enable S3 Block Public Access at the account level so that only encrypted objects can be uploaded.

Answer

Enable default bucket encryption with SSE-S3 and rely on the S3 console warning for unencrypted uploads.

Answer

Configure an S3 Lifecycle rule to transition objects to S3 Glacier Instant Retrieval, which encrypts data at rest.

Question 18

A data engineer is designing a data lake on Amazon S3 that will store sensitive financial data. The security team requires that access to the data be audited, that data be encrypted at rest with customer-managed keys, and that the engineer be able to identify which IAM principals accessed specific objects. Which TWO AWS services or features should the engineer use to meet these requirements? (Choose two.)

Accepted Answer

AWS CloudTrail data events for S3. CloudTrail data events provide the necessary audit trail for object-level access, identifying IAM principals. SSE-KMS with customer managed keys satisfies the encryption at rest requirement with customer-managed keys. Together, they meet the auditing and encryption needs.

Answer

Amazon S3 server access logging

Answer

Amazon Macie for sensitive data discovery

Answer

AWS Secrets Manager for storing encryption keys

Question 19

A company stores raw customer records in an Amazon S3 bucket and processes them with AWS Glue. A governance requirement states that a specific tag named DataClass must exist on every catalog table, and any table missing that tag must not be queryable. Where should the data engineer enforce this requirement with the least operational effort?

Accepted Answer

Use AWS Lake Formation tag-based access control by defining an LF-Tag and granting table permissions only when the DataClass tag value matches.. Lake Formation tag-based access control centralizes permission decisions on tags instead of individual tables. Defining an LF-Tag named DataClass and granting access only for matching tag values means any table lacking the required tag value has no applicable grant and is therefore not queryable, satisfying the governance rule with minimal administrative effort.

Answer

Enable AWS CloudTrail data events on the S3 bucket and alert when untagged tables are queried.

Answer

Write an AWS Lambda function that scans the Data Catalog hourly and deletes any table missing the DataClass tag.

Answer

Attach an IAM policy to all analyst roles that denies glue:GetTable unless the table has the DataClass tag.

Question 20

A data engineer manages an AWS Glue ETL job that processes JSON files from Amazon S3 and writes to Amazon Redshift. The job fails with the error 'Unable to find a suitable JDBC driver in the classpath'. The engineer has included the Redshift JDBC driver as a job parameter in the Glue job configuration. Which step should the engineer take to resolve the error?

Accepted Answer

Add the JDBC driver as an additional jar in the Glue job's 'Dependent jars path' and ensure the job's IAM role has s3:GetObject permission on the jar location.. To use a custom JDBC driver with AWS Glue, you must upload the driver jar to Amazon S3 and specify its path in the job's 'Dependent jars path' parameter. Additionally, the IAM role associated with the job must have s3:GetObject permission for that jar. This ensures the driver is available in the classpath at runtime, resolving the 'Unable to find a suitable JDBC driver' error.

Answer

Modify the job script to include the JDBC driver URL directly in the 'connection_options' when calling the write_dynamic_frame method.

Answer

Increase the number of workers in the Glue job to ensure the driver is loaded in parallel across all executors.

Answer

Convert the Glue job to use a development endpoint and manually install the JDBC driver on the underlying EC2 instance.