DEA-C01 Practice Exam 69 — 20 Questions

Question 1

Refer to the exhibit. A data engineer runs an AWS Glue job that fails with an 'Access Denied' error when writing to S3. The IAM role attached to the job has s3:PutObject permission on the output bucket. What additional configuration is most likely missing?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The S3 bucket policy does not grant access to the Glue job's IAM role. The IAM role attached to the Glue job has s3:PutObject permission, but the S3 bucket policy must explicitly grant access to that IAM role (or its principal) for the write operation to succeed. Even if the IAM role allows the action, the bucket policy acts as a separate access control layer; if it denies or does not include the role, the request fails with 'Access Denied'. This is a common cross-account or service-specific permission issue where both identity-based and resource-based policies must align.

Answer

The Glue job is not configured to write to S3 with the correct prefix

Answer

The Glue job is running in a VPC without an S3 VPC endpoint

Answer

The S3 bucket is encrypted with AWS KMS and the IAM role lacks kms:Decrypt permission

Question 2

A data engineer runs a Spark job on Amazon EMR that reads data from Amazon S3 and writes results back to S3. The job fails with an 'S3AccessDenied' error. The engineer verifies that the IAM role attached to the EMR cluster has s3:GetObject and s3:PutObject permissions on the relevant buckets. What is the MOST likely cause of the error?

Accepted Answer

The IAM role does not have s3:ListBucket permission on the bucket.. The IAM role attached to the EMR cluster must have the s3:ListBucket permission on the bucket to allow the Spark job to enumerate objects when reading from S3. Without this permission, even with s3:GetObject and s3:PutObject, the job fails with an 'S3AccessDenied' error because the S3 list operation is required for directory listing and file discovery.

Answer

S3 Transfer Acceleration is not enabled on the bucket.

Answer

EMRFS consistent view is not configured.

Answer

The S3 bucket is in a different AWS Region than the EMR cluster.

Question 3

Order the steps to migrate an on-premises database to Amazon RDS using AWS DMS.

Accepted Answer

Step 1: Create a replication instance. Step 2: Configure source and target endpoints. Step 3: Create a migration task. Step 4: Start the migration task. Step 5: Validate the migrated data.. First, create the replication instance. Then configure endpoints, create the migration task, start it, and finally validate the migrated data.

Answer

Step 1: Configure source and target endpoints. Step 2: Create a replication instance. Step 3: Create a migration task. Step 4: Start the migration task. Step 5: Validate the migrated data.

Answer

Step 1: Create a replication instance. Step 2: Create a migration task. Step 3: Configure source and target endpoints. Step 4: Start the migration task. Step 5: Validate the migrated data.

Answer

Step 1: Create a replication instance. Step 2: Configure source and target endpoints. Step 3: Start the migration task. Step 4: Create a migration task. Step 5: Validate the migrated data.

Question 4

An e-commerce company uses Amazon DynamoDB as the primary data store for its product catalog. The table has a simple primary key (ProductID) and handles 10,000 writes per second during peak hours. Recently, the engineering team noticed increased write latency and throttled requests during peak times. The table's provisioned write capacity is set to 12,000 WCU. What is the most likely cause of the throttling?

Accepted Answer

Write traffic is unevenly distributed across partitions. DynamoDB partitions data by the primary key's hash value. If write traffic is unevenly distributed across partitions (e.g., a few ProductIDs receive most writes), those hot partitions can exceed their individual throughput limits (3,000 WCU per partition for provisioned tables), causing throttling even when the table's total provisioned WCU of 12,000 is not fully utilized.

Answer

The table has reached the maximum number of partitions

Answer

DynamoDB Accelerator (DAX) is not configured

Answer

A global secondary index is consuming write capacity

Question 5

A media company stores video metadata in Amazon RDS for PostgreSQL. The database is 500 GB and experiences high write traffic. The data engineer notices that the transaction log (WAL) is growing rapidly, causing storage issues. The company needs to retain backups for 30 days for compliance. The database is currently using automated backups with a retention period of 7 days. Which solution should the engineer implement to address the WAL growth while meeting compliance requirements?

Accepted Answer

Create manual snapshots daily and delete automated backups.. Creating manual snapshots daily and reducing or eliminating automated backups addresses WAL growth. Automated backups in RDS for PostgreSQL depend on WAL files to enable point-in-time recovery. By disabling automated backups or setting a very short retention period, RDS can purge WAL segments more aggressively, preventing accumulation. Manual snapshots can be retained for 30 days to meet compliance requirements without relying on WAL. Increasing backup retention (Option C) would worsen WAL storage, while streaming WAL to S3 (Option D) is not natively supported in RDS. Option B only adds storage without addressing the root cause.

Answer

Change the instance type to a larger one with more storage.

Answer

Increase the backup retention period to 30 days.

Answer

Configure the database to stream WAL files to Amazon S3.

Question 6

A data engineer needs to ingest data from an external partner's FTP server to Amazon S3. The data arrives once daily as a CSV file. Which AWS service should be used for this ingestion?

Accepted Answer

AWS Transfer Family. AWS Transfer Family provides fully managed support for file transfers over SFTP, FTPS, and FTP protocols, making it the correct choice for ingesting CSV files from an external partner's FTP server. It integrates directly with Amazon S3 as a destination, enabling automated, secure, and scheduled transfers without custom infrastructure.

Answer

AWS DataSync

Answer

Amazon Kinesis Data Firehose

Answer

Amazon AppFlow

Question 7

A company needs to store application log files for 90 days for compliance. The logs are generated continuously and are rarely accessed after 30 days. The data engineer must minimize storage costs. Which storage solution should the engineer choose?

Accepted Answer

Amazon S3 Standard with a lifecycle policy to transition to S3 Standard-IA after 30 days and expire after 90 days. Amazon S3 Standard with a lifecycle policy to transition to S3 Standard-IA after 30 days and expire after 90 days is correct because it aligns with the access pattern: logs are frequently accessed only in the first 30 days, then rarely accessed for the remaining 60 days. S3 Standard-IA offers lower storage costs for infrequently accessed data while still providing millisecond retrieval, and the lifecycle policy automates the transition and eventual deletion, minimizing costs without sacrificing availability.

Answer

Amazon CloudWatch Logs with a retention policy of 90 days

Answer

Amazon S3 Glacier Deep Archive

Answer

Amazon EBS gp3 volumes attached to an EC2 instance

Question 8

A company is streaming clickstream data from a website into Amazon Kinesis Data Streams. The data must be transformed in near real-time and stored in Amazon S3 for analytics. Which AWS service should be used to transform the data as it is ingested?

Accepted Answer

Amazon Kinesis Data Analytics. Amazon Kinesis Data Analytics is the correct choice because it can process and transform streaming data in near real-time using SQL or Apache Flink, and then output the transformed data to destinations like Amazon S3. This service is specifically designed for real-time stream processing, making it ideal for transforming clickstream data as it is ingested into Kinesis Data Streams.

Answer

AWS Lambda (streaming function)

Answer

Amazon EMR (Spark Streaming)

Answer

AWS Glue (ETL jobs)

Question 9

A company needs to store streaming data from IoT devices with a retention period of 7 days for real-time analysis. Which AWS service is most suitable?

Accepted Answer

Amazon Kinesis Data Streams. Amazon Kinesis Data Streams is the most suitable service because it is designed for real-time ingestion and processing of streaming data, such as IoT device telemetry, with a default retention period of 24 hours, extendable up to 365 days. The requirement for a 7-day retention period for real-time analysis aligns perfectly with Kinesis Data Streams' ability to retain data for exactly that duration, allowing consumers to process records in near real-time using the Kinesis Client Library (KCL) or AWS Lambda.

Answer

Amazon DynamoDB

Answer

Amazon Kinesis Data Firehose

Answer

Amazon S3

Question 10

A financial services company has an Amazon DynamoDB table named 'Transactions' with provisioned read capacity of 10,000 RCU and write capacity of 5,000 WCU. The table stores transaction records for the past 90 days. The application performs point reads by transaction ID (partition key) and range queries by customer ID and timestamp (GSI). Recently, the company started a new marketing campaign, causing a sudden spike in write traffic. The write capacity is now at 4,500 WCU, and the application is experiencing occasional throttling on writes. The data engineer needs to ensure that writes are not throttled during future campaigns, while keeping costs low. The table currently has auto scaling enabled with a maximum capacity of 10,000 WCU. Which solution should the engineer implement?

Accepted Answer

Switch the table to DynamoDB on-demand capacity mode.. DynamoDB on-demand capacity mode automatically scales to accommodate traffic spikes, eliminating throttling without manual intervention and without fixed capacity limits, making it cost-effective for unpredictable traffic. Option B is wrong because DAX is a read cache and does not handle write throttling. Option C is wrong because using SQS adds latency and complexity; not ideal for real-time writes. Option D is wrong because increasing the maximum write capacity still has a limit and may not react quickly enough to sudden spikes, and may increase costs.

Answer

Use DynamoDB Accelerator (DAX) to cache write requests.

Answer

Implement an Amazon SQS queue to buffer write requests and process them in batches.

Answer

Increase the maximum write capacity in the auto scaling configuration to 20,000 WCU.

Question 11

A company stores time-series sensor data in Amazon S3. They need to query the data using SQL with minimal latency and no infrastructure management. Which service should they use?

Accepted Answer

Amazon Athena. Amazon Athena is the correct choice because it is a serverless interactive query service that allows you to analyze data directly in Amazon S3 using standard SQL without any infrastructure to manage. It is optimized for querying structured, semi-structured, and unstructured data stored in S3, making it ideal for time-series sensor data with minimal latency requirements.

Answer

Amazon Kinesis Data Analytics

Answer

Amazon Redshift

Answer

Amazon DynamoDB

Question 12

A data team uses AWS Glue ETL jobs to process data from an S3 bucket (s3://data-lake-raw) and write results to another S3 bucket (s3://data-lake-processed). Both buckets are encrypted with SSE-KMS using the same KMS key (alias 'data-key'). The Glue job runs in the same account. The team recently enabled S3 Server Access Logging for the raw bucket, sending logs to a separate logging account. After enabling logging, the Glue job starts failing with 'AccessDenied' when reading from the raw bucket. The Glue job's IAM role has s3:GetObject permission on the raw bucket. Which additional permission is most likely missing?

Accepted Answer

kms:Decrypt on the KMS key (alias 'data-key').. When S3 Server Access Logging is enabled for a bucket encrypted with SSE-KMS, the S3 service must write log objects to the target bucket. If the target bucket is in a different account, the S3 service needs permission to use the KMS key. However, the failure is on the Glue job reading from the raw bucket, not writing logs. The issue could be that the raw bucket's S3 access log delivery writes to a target bucket that uses a different KMS key, but that would affect logging, not Glue reads. Re-reading: The Glue job reading the raw bucket fails after enabling logging. It's likely that the raw bucket policy was modified to allow log delivery, inadvertently restricting other access. Actually, the most likely cause is that the S3 bucket policy now includes a condition that denies access unless a specific header is present, or the KMS key policy was changed. Given the options, the correct answer is that the KMS key policy for the data-key now denies the Glue role because the S3 service principal was added for cross-account logging. But the Glue role needs kms:Decrypt permission. The scenario says the same key is used for both buckets. The correct answer is B: The KMS key policy does not allow the Glue role to decrypt because the S3 log delivery service is using the key and the key policy may have a condition. Actually, the most direct answer: The Glue role is missing kms:Decrypt permission on the KMS key. But the team might have added a statement to allow S3 logging that inadvertently denies the Glue role. However, the simplest answer is that the Glue role lacks kms:Decrypt. But the question says 'Which additional permission is most likely missing?' The options are specific permissions. I'll go with the need for kms:Decrypt on the KMS key.

Answer

s3:GetBucketLocation on the raw bucket.

Answer

s3:PutObject on the processed bucket.

Answer

kms:GenerateDataKey on the KMS key.

Question 13

A data engineering team is ingesting streaming data from IoT devices into Amazon Kinesis Data Streams. The data is then consumed by an AWS Lambda function that transforms each record and writes it to Amazon S3. Recently, the Lambda function started failing with 'ProvisionedThroughputExceededException' errors when writing to S3. The team has already increased the Lambda function's memory and timeout. Which action should the team take to resolve the issue?

Accepted Answer

Implement retries with exponential backoff in the Lambda function for S3 put operations.. The 'ProvisionedThroughputExceededException' error indicates that the Lambda function is being throttled by S3 due to exceeding the bucket's request rate limits. Implementing retries with exponential backoff in the Lambda function for S3 put operations is the correct solution because it allows the function to gracefully handle transient throttling errors by waiting progressively longer between retries, which aligns with AWS's guidance for managing S3 request rate limits.

Answer

Use S3 Batch Operations to write data in batches.

Answer

Increase the number of shards in the Kinesis data stream.

Answer

Enable S3 Transfer Acceleration on the destination bucket.

Question 14

A company runs a nightly AWS Glue ETL job that reads from a JDBC source (PostgreSQL) and writes to S3 in Parquet format. The job takes over 6 hours, but the SLA requires completion within 4 hours. The source table has 500 million rows and is updated frequently. Which approach will most reliably reduce job duration?

Accepted Answer

Partition the source table by year and use pushdown predicates in the Glue job.. Partitioning the source table by year and using pushdown predicates allows AWS Glue to read only the relevant partitions from PostgreSQL, drastically reducing the data scanned and transferred. This directly addresses the 500 million row volume by minimizing the JDBC read workload, which is the primary bottleneck. Option B, using multiple JDBC connections in parallel via hash partitioning, can improve performance but is less reliable: it significantly increases load on the source database, may hit connection limits, and its effectiveness depends on the JDBC driver's support for hashfield/hashexpression. Moreover, it still reads all rows, whereas pushdown predicates reduce the data volume at the source, making option C more reliable for meeting the 4-hour SLA.

Answer

Enable job bookmark and schedule the job to run more frequently.

Answer

Use multiple JDBC connections in parallel by setting 'hashexpression' and 'hashfield'.

Answer

Increase the number of DPUs for the Glue job to 100.

Question 15

A company runs a SQL Server transactional database on Amazon RDS. They need to capture change data (inserts, updates, deletes) in near real-time and replicate them to an Amazon S3 data lake. Which AWS service is most suitable?

Accepted Answer

AWS Database Migration Service (DMS) with change data capture. AWS DMS with change data capture (CDC) is the most suitable service because it can continuously capture and replicate incremental changes (inserts, updates, deletes) from a SQL Server transactional database on Amazon RDS to an S3 data lake in near real-time. DMS uses native SQL Server transaction logs (e.g., MS-CDC or log-based replication) to read changes without impacting source performance, and it supports target S3 in formats like Parquet or CSV. This directly meets the requirement for near-real-time CDC replication to a data lake.

Answer

AWS Glue DataBrew

Answer

Amazon Kinesis Data Streams with Kinesis Client Library

Answer

Amazon Redshift Spectrum

Question 16

A company is using Amazon S3 to store sensitive customer data. The security team requires that all data be encrypted in transit and at rest. Additionally, they want to prevent any accidental public access. Which combination of actions should the data engineer take?

Accepted Answer

Enable default encryption with SSE-S3, enforce HTTPS only via bucket policy, and enable S3 Block Public Access.. Enabling default encryption with SSE-S3 ensures data is encrypted at rest automatically, enforcing HTTPS only via bucket policy ensures encryption in transit by rejecting HTTP requests, and enabling S3 Block Public Access prevents any accidental public exposure regardless of bucket policies or ACLs. This combination satisfies all security requirements: encryption in transit, encryption at rest, and prevention of public access.

Answer

Enable default encryption with SSE-KMS, allow both HTTP and HTTPS, and set bucket ACLs to private.

Answer

Use client-side encryption, enforce HTTPS via bucket policy, and enable S3 Block Public Access.

Answer

Enable default encryption with SSE-S3, allow HTTP and HTTPS, and use bucket ACLs to block public access.

Question 17

Match each AWS data compression format to its typical use case.

Accepted Answer

Snappy: Designed for high speed and efficient compression, ideal for real-time data processing.. In AWS data engineering, compression format choice depends on trade-offs between compression ratio and speed. Snappy and LZO are optimized for speed, Gzip and Bzip2 for higher compression (with Bzip2 highest), and Zstandard offers a middle ground. Common misassociations include confusing Gzip with Bzip2 for highest compression and missing Snappy's speed focus.

Answer

Gzip: Provides the highest compression ratio, best for archival storage.

Answer

Bzip2: Commonly used for log files due to good compression ratio.

Question 18

A company stores log files in Amazon S3. They want to automatically move logs older than 90 days to S3 Glacier Deep Archive to reduce costs. Which S3 feature should be used?

Accepted Answer

S3 Lifecycle configuration. S3 Lifecycle configuration allows you to define rules that automatically transition objects to colder storage classes, such as S3 Glacier Deep Archive, based on age. By setting a rule to move objects older than 90 days to S3 Glacier Deep Archive, you reduce storage costs without manual intervention. This is the correct feature for automating tier-based data lifecycle management.

Answer

S3 Intelligent-Tiering

Answer

S3 Replication

Answer

S3 Object Lock

Question 19

A data engineer is designing a data lake on Amazon S3. The data lake must support both batch and streaming ingestion. Which TWO AWS services can ingest data directly into S3? (Choose TWO.)

Accepted Answer

AWS Glue. AWS Glue is correct because it can ingest data directly into S3 via AWS Glue crawlers and ETL jobs, which read from various sources and write the processed data to S3. Amazon Kinesis Data Firehose is correct because it is a fully managed service that can capture, transform, and load streaming data directly into S3 without requiring custom code.

Answer

Amazon RDS

Answer

Amazon EMR

Answer

Amazon DynamoDB

Question 20

A data engineer is designing a serverless data ingestion pipeline that uses Amazon Kinesis Data Firehose to deliver data to Amazon S3. The data must be transformed using AWS Lambda before being written to S3. Which two steps are required to enable this transformation? (Select TWO.)

Accepted Answer

Configure a Lambda function as a data transformation source in the Firehose delivery stream.. Amazon Kinesis Data Firehose can be configured to invoke a Lambda function as a data transformation source. This allows Firehose to pass incoming records to the Lambda function, which processes and returns the transformed records before they are delivered to the S3 destination. Option C is correct because the Lambda function must return data in the specific format that Firehose expects, including a record ID, result status, and base64-encoded data, otherwise the transformation will fail.

Answer

Set up an S3 event notification to trigger the Lambda function on object creation.

Answer

Subscribe the Lambda function to the CloudWatch Logs log group for the Firehose stream.

Answer

Have the Lambda function write the transformed data directly to the S3 bucket.