DEA-C01 Practice Exam 69 — 20 Questions

Question 1

A data engineer is using Amazon Managed Workflows for Apache Airflow (Amazon MWAA) to orchestrate a data pipeline. The engineer needs to ensure that the Airflow environment can access an Amazon S3 bucket to read and write data. The S3 bucket is in the same AWS account and Region as the MWAA environment. Which configuration is required to allow MWAA to access the S3 bucket?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Attach an IAM policy to the MWAA execution role that grants the necessary S3 permissions.. MWAA environments use an execution role that is assumed by the Airflow components. To grant access to S3, you attach an IAM policy to this role with the necessary S3 permissions. This is the standard and recommended approach. The execution role must also have a trust policy that allows MWAA to assume it, but that is created automatically when you create the environment.

Answer

Configure the S3 bucket policy to allow the MWAA service principal.

Answer

Enable public access on the S3 bucket and use the S3 REST API with presigned URLs.

Answer

Store S3 credentials in AWS Secrets Manager and reference them in the Airflow connection.

Question 2

A data engineer is responsible for an Amazon Redshift cluster that ingests data continuously from Amazon Kinesis Data Streams. The engineer needs to ensure that the raw streaming data is immediately queryable in Redshift with minimal latency. Which approach should the engineer take?

Accepted Answer

Use the Amazon Kinesis Data Firehose delivery stream to load data into Redshift.. Kinesis Data Firehose is the managed service for loading streaming data into Amazon Redshift. It buffers, compresses, and delivers data to an intermediate S3 bucket, then issues COPY commands to load into Redshift. This provides low-latency, near-real-time ingestion, making the data immediately available for querying. Other options either do not support Kinesis as a source or are not optimized for this scenario.

Answer

Use Amazon Redshift Spectrum to query the Kinesis stream directly.

Answer

Use Amazon Redshift federated query to query Kinesis Data Streams.

Answer

Use AWS Database Migration Service (AWS DMS) to replicate from Kinesis to Redshift.

Question 3

A data engineer has an AWS Glue ETL job that processes JSON files from Amazon S3. The job currently uses the DynamicFrame method to write output to Amazon Redshift. The engineer needs to improve write performance by using a staging Amazon S3 bucket and parallel COPY operations. Which AWS Glue connection option should the engineer configure?

Accepted Answer

Enable the 'redshiftTmpDir' connection property to specify an Amazon S3 temporary directory.. The redshiftTmpDir connection property tells AWS Glue to stage data in Amazon S3 and then run a COPY command into Redshift, which supports parallel loading and is far faster than JDBC inserts. The other options either reference non-existent properties or confuse read-side services like Redshift Spectrum with write-side optimizations.

Answer

Increase the number of Glue DPUs allocated to the job to enable parallel writes.

Answer

Set the 'useConnectionProperties' flag to true in the Glue job script.

Answer

Configure the job to write to Amazon Redshift Spectrum using an external schema.

Question 4

A data engineer needs to schedule an AWS Glue extract, transform, and load job to run every day at 02:00 UTC and trigger a dependent Amazon Redshift stored procedure only after the Glue job succeeds. The engineer wants a managed orchestration option that avoids provisioning servers. Which approach should the engineer use?

Accepted Answer

Create an AWS Glue workflow with a daily trigger that starts the job and a conditional trigger that fires the Redshift step on success. Glue workflows are serverless and purpose-built for chaining Glue jobs and dependent actions. A schedule trigger handles the daily 02:00 UTC start, and a conditional trigger keyed to the job's success state ensures the Redshift procedure runs only after the job completes successfully, with no servers to manage.

Answer

Run an Amazon EC2 instance with a cron entry that calls the Glue StartJobRun API and then the Redshift API

Answer

Configure an Amazon EventBridge schedule rule that invokes the Glue job and rely on the job to call Redshift on completion

Answer

Use AWS Step Functions Express Workflows with a cron expression to call Glue and then Redshift

Question 5

A data engineer maintains an AWS Glue ETL job that processes millions of small JSON files stored in Amazon S3. The job's runtime has increased significantly, and CloudWatch logs show many small executor tasks and frequent garbage collection. The engineer wants to improve job performance by reducing the number of small files processed per task. Which action should the engineer take?

Accepted Answer

Use the Glue ETL job's 'groupFiles' option to group multiple small files into a single partition.. Grouping small files into larger partitions reduces the number of tasks and the overhead of task scheduling and garbage collection. This is a specific optimization for AWS Glue ETL jobs that read many small files. Enabling job bookmarks or increasing DPUs does not address the root cause. Converting formats via a crawler is not a valid approach because crawlers do not transform data.

Answer

Convert the source files to Parquet format using an AWS Glue crawler before running the ETL job.

Answer

Enable job bookmarks to track previously processed files and skip them on subsequent runs.

Answer

Increase the number of DPUs allocated to the job to provide more memory per executor.

Question 6

A data engineer is responsible for monitoring an AWS Glue ETL job that runs daily. The job reads data from an Amazon S3 bucket and writes to an Amazon Redshift table. The engineer wants to receive an alert if the job fails or if it takes longer than expected to complete. Which AWS service should the engineer use to set up these alerts with the LEAST operational overhead?

Accepted Answer

Amazon CloudWatch Alarms based on AWS Glue job metrics, with Amazon SNS notifications.. Amazon CloudWatch Alarms can monitor AWS Glue job metrics and trigger Amazon SNS notifications when thresholds are exceeded. This setup requires no custom code and provides timely alerts on job failures or prolonged execution, making it the most efficient solution with minimal operational overhead.

Answer

Amazon CloudWatch Events (EventBridge) to trigger an AWS Lambda function that sends an email via Amazon SES.

Answer

AWS Glue job bookmarks to track job progress and send notifications on failure.

Answer

AWS CloudTrail to log AWS Glue API calls and analyze logs for failures.

Question 7

A data engineer needs to ensure that data stored in Amazon S3 is protected against accidental deletion and that the data cannot be altered for a period of 7 years to meet compliance requirements. The engineer must also ensure that the data remains encrypted at rest using SSE-KMS. Which two actions should the engineer take? (Choose two.)

Accepted Answer

Enable S3 Object Lock in compliance mode on the bucket and set a retention period of 7 years for all objects.. To protect data from deletion and alteration for 7 years, S3 Object Lock in compliance mode must be enabled on the bucket with a retention period of 7 years. This ensures objects are immutable. Additionally, default encryption with SSE-KMS ensures data is encrypted at rest. Other options like versioning, lifecycle rules, bucket policies, or AWS Backup do not provide the required immutability for the primary data in S3.

Answer

Use AWS Backup to create a vault lock with a 7-year retention policy and schedule daily backups of the S3 bucket.

Answer

Enable versioning on the bucket and configure a lifecycle rule to transition objects to S3 Glacier Deep Archive after 30 days.

Answer

Create an S3 bucket policy that denies s3:DeleteObject and s3:PutObject for all principals except a specific IAM role.

Question 8

A data engineer is configuring an AWS Glue ETL job that reads from an Amazon S3 bucket and writes to another S3 bucket. The job must be able to handle a large number of small files efficiently and minimize the number of output files to improve downstream query performance. Which two actions should the engineer take? (Choose two.)

Accepted Answer

Use the AWS Glue groupFiles option to group multiple small input files into a single partition for processing.. To handle many small input files, AWS Glue provides the groupFiles option, which combines small files into larger partitions for processing. To minimize output files, the coalesce transformation reduces the number of partitions before writing, resulting in fewer, larger files. Together, these actions improve both read efficiency and downstream query performance. Increasing DPUs, enabling bookmarks, or using the Data Catalog do not directly address these file-count issues.

Answer

Enable the job bookmark feature to track previously processed files and avoid reprocessing.

Answer

Increase the number of DPUs allocated to the job to allow more parallel processing of the small files.

Answer

Use the AWS Glue Data Catalog to store metadata about the small files and let the job read from the catalog.

Question 9

A data engineer is building a data lake on Amazon S3 and needs to catalog metadata for a large number of CSV files stored in a nested folder structure. The engineer wants to automatically discover the schema and update the AWS Glue Data Catalog as new files are added. Which solution should the engineer use?

Accepted Answer

Create an AWS Glue crawler that points to the S3 bucket and schedule it to run periodically.. AWS Glue crawlers are designed to automatically scan data stores, infer schemas, and create or update tables in the Data Catalog. Scheduling a crawler ensures that new files are detected and the catalog stays current. This is the standard, low-effort solution for the described scenario. Other options either require manual intervention or do not provide automatic schema discovery.

Answer

Run an AWS Glue ETL job that reads the CSV files and writes to a new location.

Answer

Use AWS Lake Formation to define a data lake and register the S3 location.

Answer

Manually define tables in the AWS Glue Data Catalog using the AWS Management Console.

Question 10

A data engineer must ensure that all objects written to an S3 bucket by an AWS Glue ETL job are encrypted with a customer-managed AWS KMS key, even if the job does not explicitly specify encryption parameters. The bucket policy already denies unencrypted PUT requests. Which configuration will enforce the required encryption with the LEAST operational overhead?

Accepted Answer

Set the default encryption on the S3 bucket to SSE-KMS with the customer-managed key.. Default bucket encryption with SSE-KMS using the customer-managed key automatically encrypts all objects written without explicit encryption headers, satisfying the requirement without modifying the Glue job. It also works with the existing bucket policy denial for non-compliant requests. This approach minimizes operational effort and ensures consistent encryption across all writers.

Answer

Enable S3 Bucket Keys for the bucket to reduce KMS costs.

Answer

Attach an IAM policy to the Glue job role that allows only s3:PutObject with the s3:x-amz-server-side-encryption condition.

Answer

Modify the Glue job to set the --encryption-type parameter to SSE-KMS for all writes.

Question 11

A data engineer is using AWS Step Functions to orchestrate a daily ETL workflow that includes an AWS Glue job, an Amazon EMR step, and an Amazon Redshift stored procedure. The workflow occasionally fails and the engineer needs to troubleshoot and recover. Which TWO actions should the engineer take to identify the failure and resume from the failed step? (Choose two.)

Accepted Answer

Use the Step Functions 'Redrive' capability to restart the execution from the failed state after fixing the underlying issue.. To troubleshoot a failed Step Functions execution, enabling logging and reviewing execution history provides the necessary error details. Once the root cause is fixed, the Redrive feature allows resuming from the failed state without re-running successful steps. These two actions together enable efficient diagnosis and recovery.

Answer

Delete the state machine and recreate it with a retry policy on every state.

Answer

Configure the state machine to use an Amazon SQS dead-letter queue for failed states and reprocess messages manually.

Answer

Manually trigger the AWS Glue job and Amazon EMR step from the console, then restart the Step Functions execution from the beginning.

Question 12

A data engineer is using AWS Glue to process data from an Amazon Kinesis Data Stream. The Glue job is configured to run every 15 minutes and uses job bookmarks to track processed data. Recently, the job started reprocessing old data, leading to duplicate records in the target Amazon S3 bucket. The engineer verifies that the job bookmark is enabled and the job is not being run manually. Which TWO actions should the engineer take to resolve the duplicate processing issue? (Choose two.)

Accepted Answer

Check that the Glue job's bookmark key is not being changed between runs, as a changed bookmark key resets the bookmark state.. Duplicate processing with AWS Glue job bookmarks often occurs when the bookmark key changes or when concurrent runs interfere with bookmark updates. Verifying the bookmark key remains constant and preventing concurrent runs with the same bookmark are key steps. These actions ensure the bookmark state is preserved and correctly updated, preventing reprocessing of already-processed data.

Answer

Increase the Kinesis stream's retention period to 168 hours to allow the Glue job more time to process data.

Answer

Configure the Glue job to use the '--job-bookmark-option' parameter set to 'job-bookmark-enable'.

Answer

Verify that the Kinesis stream's shard iterator type is set to LATEST in the Glue job's connection options.

Question 13

A data engineer needs to run an AWS Glue for Apache Spark ETL job that joins a 40 GB Amazon S3 Parquet dataset with a small 8 MB reference lookup table stored as CSV in Amazon S3. The reference table is read on every join and the job's executors are spending a large amount of shuffle time on the join. The reference table changes only once per month. Which approach MOST efficiently reduces shuffle overhead in the Glue job?

Accepted Answer

Broadcast the reference table by reading it with the Spark DataFrame API and applying broadcast() before the join.. The small, slowly changing reference table is an ideal broadcast candidate. Replicating it to every executor lets Spark perform a broadcast hash join where the large Parquet side stays in place and is never redistributed. Increasing DPUs, converting formats, or pre-partitioning all leave the shuffle of the large dataset intact, so they fail to address the actual bottleneck.

Answer

Partition both datasets by the join key and write them to S3 before the join so Spark can perform a partition-wise merge join.

Answer

Increase the number of Glue DPUs so that more executors are available to parallelize the shuffle stage of the join.

Answer

Convert the reference CSV to Parquet and enable Glue job bookmarks so the lookup is only read once per month.

Question 14

A company uses AWS Lake Formation to manage access to a data lake in Amazon S3. A data engineer needs to grant a specific IAM role access to only the columns containing non-sensitive data in a table, while hiding columns with personally identifiable information (PII). The engineer has already registered the S3 bucket and the table in Lake Formation. What should the engineer do to meet this requirement?

Accepted Answer

Create a Lake Formation data filter that excludes the PII columns and grant SELECT permission on the filtered table to the IAM role.. Lake Formation data filters enable column-level security by allowing you to exclude specific columns from a table. When you grant SELECT permission on a filtered table, the user can only access the included columns. This meets the requirement of hiding PII columns while providing access to non-sensitive data, without duplicating data or altering S3 objects.

Answer

Attach a bucket policy to the S3 bucket that allows the IAM role to read only specific objects.

Answer

Use an IAM policy that denies access to the S3 prefixes containing the PII columns.

Answer

Configure an AWS Glue job to create a new table that omits the PII columns and grant access to that table.

Question 15

A data engineer is configuring an AWS Glue ETL job that processes data from an Amazon S3 bucket. The security team requires that all data in transit between AWS Glue and Amazon S3 be encrypted using TLS. The engineer needs to ensure that the Glue job uses HTTPS endpoints when reading from and writing to S3. Which action should the engineer take?

Accepted Answer

No action is needed; AWS Glue uses HTTPS for S3 by default.. AWS Glue uses the AWS SDK to interact with Amazon S3, and the SDK uses HTTPS endpoints by default. This means data in transit is encrypted with TLS without any additional configuration. There is no need for special job parameters, connection settings, or IAM permissions to enable TLS. The correct action is to recognize that no action is needed.

Answer

Ensure that the Glue job's IAM role has permissions to use HTTPS, and no further configuration is needed.

Answer

Add the --enable-s3-ssl parameter to the Glue job's job parameters.

Answer

Configure the Glue connection to use an S3 endpoint with the https:// prefix.

Question 16

A data engineer is ingesting records from Amazon Kinesis Data Streams into Amazon S3 using AWS Lambda as the consumer. Each stream shard delivers up to 1,000 records per second, and the Lambda function writes each record as an individual small object, causing many tiny S3 files and high PUT costs. The engineer wants fewer, larger objects while keeping near-real-time delivery. What should the engineer do?

Accepted Answer

Replace the Lambda consumer with Amazon Data Firehose, which buffers records and delivers batched objects to S3.. The inefficiency comes from writing one S3 object per Kinesis record. Amazon Data Firehose natively buffers records by configurable size and time windows and delivers them as consolidated objects, which reduces file count and PUT costs while still meeting near-real-time needs. Tuning Lambda memory, adding shards, or enabling enhanced fan-out changes throughput and parallelism but not the per-record write pattern.

Answer

Enable enhanced fan-out on the stream so consumers get dedicated throughput per shard.

Answer

Increase the Lambda function memory so each invocation can write more records per second.

Answer

Add more shards to the Kinesis data stream to increase parallelism.

Question 17

A data engineer needs to ensure that all data stored in an Amazon S3 bucket is encrypted at rest using a customer managed key in AWS KMS. The engineer also needs to enforce that any attempt to upload an object without specifying the correct KMS key is denied. Which combination of actions should the engineer take?

Accepted Answer

Enable default encryption on the bucket with SSE-KMS using the customer managed key, and add a bucket policy that denies s3:PutObject requests that do not include the correct x-amz-server-side-encryption header.. To enforce encryption with a specific customer managed KMS key, enable default SSE-KMS encryption on the bucket and add a bucket policy that denies PutObject requests unless they include the correct x-amz-server-side-encryption header. This ensures all objects are encrypted with the designated key and prevents uploads with other encryption methods.

Answer

Configure the bucket to use SSE-KMS with the customer managed key and attach an IAM policy to all users that allows only s3:PutObject with the correct encryption header.

Answer

Enable default encryption with SSE-S3 and use AWS KMS grants to restrict access to the customer managed key.

Answer

Use an S3 Object Lambda access point to encrypt objects on upload with the customer managed key.

Question 18

A data engineer needs to run a transformation that processes semi-structured JSON records already stored in Amazon S3 and write the results back to S3 in Parquet format. The team prefers a serverless, Apache Spark-based approach with minimal infrastructure management and wants to use the AWS Glue Data Catalog for metadata. Which approach should the engineer use?

Accepted Answer

Create an AWS Glue ETL job using the Spark engine and write output with the Glue Parquet writer.. AWS Glue ETL jobs provide a serverless Apache Spark runtime that reads JSON from Amazon S3, applies transformations, and writes Parquet using the Glue Parquet writer. This combination satisfies the serverless and Spark-based preferences while integrating with the AWS Glue Data Catalog for table metadata. EMR adds cluster management overhead, and Lambda or a crawler cannot perform the required rewrite.

Answer

Run an AWS Glue crawler to convert the JSON files to Parquet automatically.

Answer

Use AWS Lambda with pandas to convert each JSON file to Parquet.

Answer

Launch an Amazon EMR cluster with Spark and submit the job manually.

Question 19

A data engineer is designing a data lake on Amazon S3. The team wants to optimize query performance and reduce storage costs for a large dataset of JSON logs that are queried frequently by Amazon Athena. The logs are currently stored as uncompressed JSON files, each around 1 GB, in a single prefix. The engineer needs to improve query performance and reduce costs without changing the data format. Which action should the engineer take?

Accepted Answer

Compress the JSON files with gzip and split them into smaller files of approximately 128 MB.. Compressing the JSON files with gzip reduces the storage footprint and the amount of data scanned by Athena, lowering costs. Splitting the large files into smaller, more manageable sizes allows Athena to process them in parallel, significantly improving query performance. This solution respects the requirement to keep the data in JSON format and directly addresses both performance and cost concerns.

Answer

Convert the JSON files to Apache Parquet and partition the data by date.

Answer

Move the data to Amazon Redshift and query it using Redshift Spectrum.

Answer

Enable S3 Transfer Acceleration on the bucket to speed up data retrieval.

Question 20

A data engineer is using AWS Step Functions to orchestrate a daily pipeline that runs several AWS Glue jobs in sequence. One Glue job intermittently fails due to a transient Amazon S3 503 error. The engineer wants the state machine to automatically retry only that Glue job up to three times with exponential backoff, without retrying the other jobs. What should the engineer do?

Accepted Answer

Add a Retry field to the Glue job task state with ErrorEquals set to States.TaskFailed, MaxAttempts set to 3, and an appropriate IntervalSeconds and BackoffRate.. Step Functions retry logic is declared inside the state definition, so attaching a Retry field to the Glue job task scopes retries to that task alone. Specifying MaxAttempts of 3 with IntervalSeconds and BackoffRate produces exponential backoff for transient failures. The other choices either apply retries at the wrong layer, change pipeline structure, or use services that cannot restart executions.

Answer

Set the Glue job's MaximumRetries property to 3 in the job definition, then add a Catch field in the state machine to handle final failures.

Answer

Configure an Amazon CloudWatch alarm on Glue job failures and use an Application Auto Scaling policy to restart the state machine execution.

Answer

Wrap the entire state machine in a Map state and set MaxConcurrency to 1 so that failures are retried automatically by Step Functions.