DEA-C01 Practice Test 7 — 10 Questions

Question 1

A company is building a data lake on Amazon S3 and wants to ingest data from multiple AWS services (CloudTrail, VPC Flow Logs, and ALB logs). The data should be stored in a central S3 bucket with a common partitioning scheme. Which service can be used to collect and centralize this data with minimal configuration?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure each source service to deliver logs directly to the central S3 bucket.. CloudTrail, VPC Flow Logs, and ALB logs can each be configured to deliver logs directly to a specified S3 bucket, including a central bucket, with no intermediary service required. This approach minimizes configuration overhead and avoids data movement costs, as each service writes natively to S3 using its own built-in delivery mechanism.

Answer

Use AWS Data Pipeline to copy logs from each source S3 bucket to the central bucket.

Answer

Use AWS Glue to crawl the logs from each source and write to a central S3 bucket.

Answer

Set up Amazon Kinesis Data Firehose to ingest logs from each service and write to S3.

Question 2

A data engineer needs to store archival data that is rarely accessed but must be retained for 7 years. The data should be retrievable within 12 hours. Which Amazon S3 storage class is MOST cost-effective?

Accepted Answer

S3 Glacier Deep Archive. S3 Glacier Deep Archive is the most cost-effective storage class for archival data that is rarely accessed and requires a 7-year retention period, with retrieval times up to 12 hours. It offers the lowest storage cost among S3 classes, making it ideal for long-term retention of data that does not need immediate access.

Answer

S3 Intelligent-Tiering

Answer

S3 Glacier Flexible Retrieval

Answer

S3 Standard

Question 3

An organization is using AWS Glue to process sensitive data. The data is stored in S3 with server-side encryption using AWS KMS (SSE-KMS). The Glue job fails with an error indicating that it cannot read the data. The IAM role used by Glue has the following policy. What is missing?

Accepted Answer

The kms:Decrypt permission on the KMS key. The Glue job fails because the IAM role lacks the kms:Decrypt permission on the KMS key used for SSE-KMS encryption. When S3 objects are encrypted with SSE-KMS, any principal reading the object must have both s3:GetObject on the object and kms:Decrypt on the KMS key. Without kms:Decrypt, S3 returns an AccessDenied error even though the s3:GetObject permission is present.

Answer

The s3:GetObject permission on the bucket

Answer

The kms:GenerateDataKey permission on the KMS key

Answer

The kms:ReEncrypt permission on the KMS key

Question 4

Refer to the exhibit. A data engineer queries AWS CloudTrail to investigate a PutObject event. What does the exhibit reveal about the object sensitive.csv?

Accepted Answer

The object was uploaded with server-side encryption using AWS KMS.. The CloudTrail event contains `x-amz-server-side-encryption: aws:kms`, which confirms the object was uploaded with server-side encryption using AWS KMS (SSE-KMS). Option A is incorrect because the event shows a successful upload, not a failure. Option C is incorrect because the event indicates encryption was applied. Option D is incorrect because SSE-S3 would show `AES256`, not `aws:kms`.

Answer

The upload failed due to encryption mismatch.

Answer

The object was not encrypted at rest.

Answer

The object was encrypted with SSE-S3.

Question 5

A company needs to ingest data from multiple SaaS applications (Salesforce, Marketo) into Amazon S3 for analytics. The data volume is moderate (~100 GB per day). The pipeline must handle schema changes, deduplicate records, and provide low latency (under 1 hour). Which THREE services should be used? (Choose THREE.)

Accepted Answer

Amazon AppFlow. Amazon AppFlow is the correct choice because it is a fully managed integration service specifically designed to transfer data from SaaS applications like Salesforce and Marketo to AWS services such as Amazon S3. It supports incremental transfers, handles schema changes automatically via its schema evolution feature, and can achieve sub-hour latency for moderate data volumes (~100 GB/day) without custom coding.

Answer

Amazon Kinesis Data Streams

Answer

AWS Database Migration Service (DMS)

Question 6

Which THREE factors should be considered when choosing a partition key for an Amazon DynamoDB table?

Accepted Answer

If the table has a write-heavy workload, the partition key should distribute writes evenly.. Option B is correct because a write-heavy workload requires the partition key to spread write traffic across many partitions; otherwise a hot partition throttles throughput, since each partition supports a limited write capacity (up to 1,000 WCU per partition). Option C is correct because DynamoDB retrieves items by partition key, so aligning the key with the most common query access pattern enables efficient Query operations instead of expensive Scan operations. Option E is correct because high cardinality produces many distinct partition key values, which distributes items and traffic evenly across partitions and avoids hot partitions. Option A is not a valid factor because item size does not determine partition key choice; DynamoDB partitions data by key value, and large items only consume more capacity, not improve partitioning. Option D is not a valid factor because RCU consumption is driven by item size and consistency model, not by selecting a partition key to minimize reads.

Answer

The partition key should be chosen to maximize the size of items in each partition.

Answer

The partition key should be chosen to minimize read capacity unit consumption.

Question 7

Match each AWS database service to its primary use case.

Accepted Answer

Amazon RDS: Relational database for online transaction processing (OLTP) workloads.. Correct matches: RDS -> OLTP relational, DynamoDB -> NoSQL low-latency, Redshift -> data warehousing, ElastiCache -> in-memory caching. Common confusions include swapping RDS and DynamoDB use cases.

Answer

Amazon RDS: NoSQL key-value database for low-latency applications.

Answer

Amazon DynamoDB: Relational database for OLTP workloads.

Question 8

A financial services company uses AWS Glue ETL jobs to process sensitive customer data stored in Amazon S3. The data is encrypted at rest with SSE-KMS using a customer-managed key. Recently, the security team discovered that the Glue job's IAM role has an overly permissive policy that allows the 'kms:Decrypt' action for all KMS keys in the account. The company wants to follow the principle of least privilege. The Glue job runs on a schedule and reads from a specific S3 bucket. The security team needs to update the IAM policy to restrict KMS decryption to only the specific key used for that bucket. What should they do?

Accepted Answer

Update the policy to allow 'kms:Decrypt' only for the specific KMS key ARN used by the S3 bucket containing the customer data.. To follow least privilege, the IAM role for the Glue job should only have access to decrypt using the specific KMS key that encrypts the S3 bucket containing the customer data. This is done by allowing 'kms:Decrypt' with a resource set to the exact ARN of that key, not a wildcard or all keys. Option A is incorrect because using a wildcard in the key ARN (key/*) still grants access to all keys under that key hierarchy, which is overly permissive. Option B is incorrect because allowing 'kms:Decrypt' with resource '*' would grant access to all keys in the account, violating least privilege. Option D is incorrect because removing 'kms:Decrypt' from the IAM policy would prevent the Glue job from decrypting the data; the job's IAM role needs the permission, and relying solely on S3 bucket policies cannot grant decryption permissions cross-account or for IAM roles.

Answer

Update the policy to allow 'kms:Decrypt' with a resource of 'arn:aws:kms:us-east-1:123456789012:key/*' to cover all keys in the account.

Answer

Update the policy to allow 'kms:Decrypt' with a resource of '*' to ensure the job can always decrypt data.

Answer

Remove the 'kms:Decrypt' action from the policy and rely on S3 bucket policies to grant decryption permissions.

Question 9

Match each AWS data analytics service to its primary function.

Accepted Answer

Amazon Athena: Query data in Amazon S3 using standard SQL. The correct matches are: Amazon Athena for serverless SQL querying on S3, Amazon Redshift for data warehousing, Amazon EMR for big data processing, and Amazon Kinesis for real-time streaming. Common confusions include swapping the roles of Athena and Redshift.

Answer

Amazon Athena: Fully managed data warehouse

Answer

Amazon Redshift: Query data in S3 using SQL

Question 10

A company needs to ingest data from multiple SaaS sources (e.g., Salesforce, Marketo) into Amazon S3 for analytics. Which AWS service is designed for this purpose?

Accepted Answer

Amazon AppFlow. Amazon AppFlow is a fully managed integration service specifically designed to securely transfer data between SaaS applications (like Salesforce, Marketo, Slack, and Zendesk) and AWS services such as Amazon S3 and Amazon Redshift. It supports scheduled, event-driven, or on-demand data ingestion with built-in transformations, filtering, and validation, making it the ideal choice for this use case.

Answer

AWS Transfer Family

Answer

AWS Glue

Answer

AWS DataSync