DEA-C01 Practice Exam 70 — 20 Questions

Question 1

A data engineer runs the command shown in the exhibit to check the bucket policy. A user from another AWS account is trying to download an object using HTTP (not HTTPS). What will happen?

Accepted Answer

The download will fail with an access denied error. The bucket policy denies all actions when aws:SecureTransport is false (i.e., HTTP). Therefore, HTTP requests are denied. Option A is wrong because the policy denies HTTP requests. Option C is wrong because the policy does not require encryption at rest. Option D is wrong because the policy explicitly denies HTTP.

Answer

The download will succeed because the principal is not specified

Answer

The download will succeed if the object is encrypted at rest

Answer

The download will succeed because the policy only denies write operations

Question 2

A company uses Amazon DynamoDB with on-demand capacity. They notice higher than expected costs due to a sudden spike in read traffic from a reporting job. The reporting job scans the entire table daily. What is the most cost-effective way to reduce costs while maintaining the same reporting output?

Accepted Answer

Use a Global Secondary Index (GSI) with a sort key that matches the reporting query pattern.. Using a Global Secondary Index (GSI) with a sort key tailored to the reporting query pattern allows the reporting job to query only the relevant items instead of scanning the entire table. This reduces the read capacity units consumed per operation, directly lowering costs under on-demand capacity, which charges per RCU consumed. The reporting output remains identical because the GSI returns the same data filtered by the query pattern.

Answer

Enable DynamoDB Accelerator (DAX) for caching.

Answer

Set a TTL attribute to automatically expire old data.

Answer

Reduce the read capacity units (RCU) in the table.

Question 3

A data engineer notices that an Amazon RDS for PostgreSQL instance's CPU utilization is consistently above 90% during business hours. The database is used for reporting queries. Which action should be taken FIRST to improve performance?

Accepted Answer

Enable Performance Insights and review slow queries.. The first step in diagnosing high CPU utilization on an RDS for PostgreSQL instance used for reporting queries is to identify the root cause. Enabling Performance Insights provides a detailed view of database load, wait events, and SQL query performance, allowing the data engineer to pinpoint slow or inefficient queries that are consuming CPU resources. Without this diagnostic data, any other action would be premature and could lead to unnecessary cost or complexity.

Answer

Enable Multi-AZ deployment for automatic failover.

Answer

Create a read replica to offload reporting queries.

Answer

Increase the instance size to a larger instance class.

Question 4

A company is using Amazon RDS for PostgreSQL with Multi-AZ deployment. The primary instance fails and a failover occurs. After the failover, the application cannot connect to the database. What is the MOST likely cause?

Accepted Answer

The application is using the old primary instance endpoint instead of the RDS CNAME.. After a Multi-AZ failover in Amazon RDS for PostgreSQL, the DNS CNAME record automatically updates to point to the new primary instance in the standby Availability Zone. If the application hardcodes the old primary instance's endpoint (specific IP or DNS name) instead of using the RDS CNAME (which remains constant), it will attempt to connect to the failed instance, causing connectivity loss. The CNAME is the stable connection point that always resolves to the current primary instance.

Answer

The database instance is in a 'stopped' state after failover.

Answer

The Multi-AZ failover requires manual intervention to complete.

Answer

The security group for the RDS instance was not updated during failover.

Question 5

Refer to the exhibit. A data engineer applied this bucket policy to an S3 bucket. What is the effect of this policy?

Accepted Answer

Blocks HTTP requests to get objects. The bucket policy denies the s3:GetObject action when the request is made over HTTP (i.e., when aws:SecureTransport equals false). This effectively blocks HTTP requests to get objects, while allowing HTTPS requests. Therefore, Option B is correct. Option A is incorrect because the policy blocks HTTP, not allows it. Option C is incorrect because the policy blocks HTTP, not allows it. Option D is incorrect because the policy only blocks insecure transport, not all access.

Answer

Allows only HTTPS requests to get objects

Answer

Allows only HTTP requests to get objects

Answer

Blocks all access to the bucket

Question 6

A data engineer is using AWS Glue to run an ETL job that reads data from Amazon DynamoDB and writes to Amazon Redshift. The job fails with a 'ThroughputExceededException' error. What is the most likely cause?

Accepted Answer

The DynamoDB table's read capacity is insufficient for the Glue job's read rate. The 'ThroughputExceededException' error occurs when AWS Glue reads from DynamoDB at a rate that exceeds the table's provisioned read capacity, causing DynamoDB to throttle requests. Option A is incorrect because a timeout setting would result in a different error (e.g., 'Job run timeout'). Option B is incorrect because Redshift concurrency scaling affects query performance, not DynamoDB read throttling. Option D is incorrect because S3 permissions issues would cause 'AccessDenied' errors, not throughput exceedance.

Answer

The Glue job has a timeout setting that is too low

Answer

The Redshift cluster's concurrency scaling is insufficient

Answer

The S3 bucket where Glue writes temporary data does not have proper permissions

Question 7

A company uses a DynamoDB table with on-demand capacity for a gaming application. During a new game launch, the table experienced throttling errors. The engineer checks CloudWatch metrics and sees that the 'ConsumedWriteCapacityUnits' exceeded the 'ProvisionedWriteCapacityUnits' (on-demand uses the table's previous peak). The application is writing at 50,000 WCU but the table's peak was 30,000 WCU. What should the engineer do to resolve throttling?

Accepted Answer

Contact AWS Support to pre-warm the table for higher throughput.. DynamoDB on-demand capacity automatically scales based on traffic but has a maximum throughput limit determined by the table's previous peak usage. When a new peak exceeds this limit, throttling occurs until the table adapts. Contacting AWS Support to pre-warm the table raises the initial throughput limit, allowing higher bursts immediately. Option B is incorrect because increasing partition count does not directly increase the overall throughput limit; it affects distribution of throughput. Option A is incorrect because DAX is a caching layer that improves read performance, not write throughput. Option D is incorrect because switching to provisioned capacity would require setting WCU to 50,000, but this changes the billing model and may still require a limit increase; pre-warming is the direct solution for on-demand throttling.

Answer

Add a DynamoDB Accelerator (DAX) cluster in front of the table.

Answer

Increase the number of partitions by splitting the partition key.

Answer

Switch the table to provisioned capacity and set WCU to 50,000.

Question 8

Refer to the exhibit. An IAM policy is attached to an IAM role used by an application. The application needs to decrypt objects in an S3 bucket using a customer managed KMS key. What is the effect of this policy?

Accepted Answer

The application can decrypt objects only when accessing them through S3.. The IAM policy grants the `kms:Decrypt` permission with a `kms:ViaService` condition key set to `s3.amazonaws.com`. This condition restricts the decryption operation to only when the request is made through the S3 service. Therefore, the application can decrypt objects only when accessing them through S3, not via direct KMS API calls or other services.

Answer

The application cannot perform any KMS operations.

Answer

The application can decrypt objects from any service.

Answer

The application can encrypt but not decrypt objects.

Question 9

A data engineer is designing a data ingestion pipeline for clickstream data that arrives in bursts, up to 100 MB/s, and must be processed with exactly-once semantics. The data must be stored in Amazon S3 partitioned by event date and hour. Which combination of services should the engineer use?

Accepted Answer

Amazon Kinesis Data Firehose with S3 destination and dynamic partitioning.. Amazon Kinesis Data Firehose with dynamic partitioning can directly ingest high-velocity clickstream data (up to 100 MB/s bursts) and automatically partition it by event date and hour in S3 with no custom code. It supports exactly-once delivery to S3 when configured with the `S3DestinationConfiguration` and appropriate error handling, meeting the burst throughput and partitioning requirements without managing consumers.

Answer

Amazon Kinesis Data Streams with AWS Lambda consumer writing to S3.

Answer

AWS Glue streaming ETL job reading from Amazon MSK and writing to S3.

Answer

Amazon Kinesis Data Streams with KCL application writing to S3.

Question 10

A data pipeline uses AWS Glue ETL to process data from an S3 bucket and write results to a Redshift cluster. The job fails with a 'DiskFull' error on the Glue worker nodes. What is the best way to resolve this issue?

Accepted Answer

Increase the number of Glue DPUs or use G.1X worker type.. The 'DiskFull' error on Glue worker nodes indicates that the local storage allocated per worker is insufficient for the data being processed. Increasing the number of DPUs or switching to a G.1X worker type (which provides more disk space per worker) directly addresses this by either distributing the workload across more workers or upgrading to a worker type with higher storage capacity.

Answer

Decrease the number of partitions in the output.

Answer

Use a different file format like Parquet to reduce storage.

Answer

Increase the job timeout setting.

Question 11

Refer to the exhibit. This KMS key policy is attached to a customer managed key. A data engineer finds that the DataEngineer role can encrypt but cannot decrypt data. What is the most likely cause?

Accepted Answer

The role does not have an IAM policy allowing kms:Decrypt. The key policy allows kms:Decrypt and kms:GenerateDataKey for the DataEngineer role, so the role can encrypt. However, KMS requires both key policy and IAM policy permissions for IAM roles. Since the role lacks an IAM policy that grants kms:Decrypt, it cannot decrypt. Option A is incorrect because the key policy does include kms:Decrypt. Option C is incorrect because the key policy explicitly allows kms:Decrypt. Option D is incorrect because kms:GenerateDataKey is allowed in the policy; the issue is with decrypt.

Answer

The key policy does not include kms:Decrypt in the IAM policy section

Answer

The key policy does not allow kms:Decrypt

Answer

The key policy does not allow kms:GenerateDataKey

Question 12

A data engineer is troubleshooting an AWS Glue ETL job that fails with the error: 'An error occurred while calling o123.pyWriteDynamicFrame. Access Denied when writing to S3 bucket: my-bucket'. The job uses a Glue service role named 'GlueServiceRole'. Which TWO actions should the engineer take to resolve the issue? (Choose TWO.)

Accepted Answer

Check if the S3 bucket policy denies access from the GlueServiceRole.. The error message indicates an access denied when writing to S3, which can be caused by a bucket policy that explicitly denies the Glue service role's access, even if the IAM policy allows it. Option D is correct because the IAM policy attached to GlueServiceRole must include the s3:PutObject permission on the specific bucket to allow the Glue job to write data.

Answer

Disable S3 Block Public Access on the bucket.

Answer

Grant the GlueServiceRole permission to write to the AWS Glue Data Catalog.

Answer

Ensure the Glue job is in the same VPC as the S3 bucket.

Question 13

A data engineer needs to store event data from IoT devices that arrives in bursts. The data is key-value and requires single-digit millisecond read and write latency. The engineer also needs to run complex analytical queries on the data for reporting. Which TWO services should be used together? (Choose TWO.)

Accepted Answer

Amazon DynamoDB. Amazon DynamoDB is correct because it provides single-digit millisecond read and write latency at any scale, making it ideal for IoT event data arriving in bursts. Its key-value data model matches the requirement, and it can serve as the operational data store for fast ingestion while supporting complex analytical queries when integrated with Amazon Redshift.

Answer

Amazon ElastiCache for Redis

Answer

Amazon S3

Answer

Amazon RDS for MySQL

Question 14

A company is using Amazon RDS for MySQL with Multi-AZ deployment. The database size is 2 TB and the workload is read-heavy. To improve read performance, which option should be used?

Accepted Answer

Create Read Replicas in the same or different regions. Amazon RDS for MySQL Read Replicas offload read traffic from the primary DB instance, directly improving read performance for a read-heavy workload. With a 2 TB database, Read Replicas can be created in the same or different regions, providing horizontal read scaling without impacting the primary instance's write capacity. Multi-AZ deployment already provides high availability but does not improve read performance, as the standby instance is not used for reads.

Answer

Use Amazon ElastiCache to cache database queries

Answer

Increase the instance size to 16xlarge

Answer

Enable Multi-AZ on additional instances

Question 15

A data engineering team notices that an AWS Glue ETL job fails intermittently with a 'ThrottlingException' error. The job reads from an Amazon S3 bucket and writes to an Amazon Redshift table. What is the MOST likely cause of this error?

Accepted Answer

The Redshift cluster's write throughput is exceeding its provisioned capacity.. The 'ThrottlingException' error occurs when the rate of API requests exceeds the allowed limit. In this scenario, the Glue job writes to Amazon Redshift. Redshift has a provisioned write throughput capacity; if the Glue job attempts to write data faster than Redshift can handle, Redshift throttles the requests, resulting in a ThrottlingException. This is the most likely cause. Option A is incorrect because S3 throttling would manifest as a different error (e.g., 'SlowDown' or 'RequestTimeout'). Option C is incorrect because Glue job concurrency limits would cause a 'ConcurrentRunsExceededException' or similar, not ThrottlingException. Option D is incorrect because insufficient memory would typically lead to an 'OutOfMemoryError' or job failure, not a ThrottlingException.

Answer

The S3 bucket's request rate is exceeding the bucket's performance limits.

Answer

The Glue job is exceeding the maximum number of concurrent runs allowed.

Answer

The Glue job's allocated memory is insufficient for the data volume.

Question 16

A team is designing a data lake on S3 and needs to enforce encryption at rest. They want to use server-side encryption with a KMS key that they manage. Which encryption option should they configure on the S3 bucket?

Accepted Answer

SSE-KMS. SSE-KMS is the correct choice because it provides server-side encryption using a customer-managed KMS key. This allows the team to enforce encryption at rest with their own key, giving them control over key rotation, access policies, and audit trails via AWS CloudTrail, which aligns with the requirement to manage the encryption key themselves.

Answer

Client-side encryption

Answer

SSE-S3

Answer

SSE-C

Question 17

A data engineer is setting up a data pipeline that ingests streaming data from Amazon Kinesis Data Streams into an S3 data lake using Amazon Kinesis Data Firehose. The data contains personally identifiable information (PII). The security team requires that all data be encrypted at rest in S3 using an AWS KMS customer managed key (CMK) that is specific to the application. Additionally, the data must be encrypted in transit between all services. The engineer creates the KMS key and configures Firehose to use server-side encryption with the key for the S3 destination. However, Firehose delivery fails with an error indicating that the KMS key is not accessible. What is the most likely cause?

Accepted Answer

The KMS key policy does not grant the firehose.amazonaws.com service principal the required permissions.. Kinesis Data Firehose needs permission to use the KMS key. The key policy must grant the Firehose service principal (firehose.amazonaws.com) permission to call kms:GenerateDataKey and kms:Decrypt. Without this, Firehose cannot encrypt the data.

Answer

The Kinesis data stream is not encrypted at rest.

Answer

The Firehose delivery stream is not in the same region as the KMS key.

Answer

The S3 bucket policy does not grant the Firehose delivery stream access to write objects.

Question 18

A company is using Amazon Redshift Spectrum to query data in Amazon S3. The S3 bucket uses SSE-KMS encryption. The Redshift cluster has an IAM role that allows access to S3 and KMS. However, queries fail with an 'Access Denied' error. What is the most likely cause?

Accepted Answer

The external schema does not have the IAM role specified.. When using Redshift Spectrum with SSE-KMS encrypted data in S3, the IAM role must be explicitly associated with the external schema via the `CREATE EXTERNAL SCHEMA` command using the `IAM_ROLE` parameter. Even if the cluster has the IAM role attached, Spectrum queries fail with 'Access Denied' if the role is not specified at the schema level, because Redshift needs to pass that role to S3 and KMS for each query execution. Option B correctly identifies this missing configuration as the most likely cause.

Answer

The Redshift cluster does not have the IAM role attached.

Answer

The IAM role does not have the kms:Decrypt permission.

Answer

The external table is not defined in the schema.

Question 19

Order the steps to troubleshoot a failed AWS Glue job that reads from JDBC and writes to S3.

Accepted Answer

Check AWS Glue job logs, then verify network connectivity, then verify IAM permissions, then test JDBC connection, then review the Glue script.. Start with logs to identify errors, then check connectivity, IAM permissions, test connection, and review script.

Answer

Verify IAM permissions, then check AWS Glue job logs, then verify network connectivity, then test JDBC connection, then review the Glue script.

Answer

Test JDBC connection, then check AWS Glue job logs, then verify network connectivity, then verify IAM permissions, then review the Glue script.

Answer

Review the Glue script, then check AWS Glue job logs, then verify network connectivity, then verify IAM permissions, then test JDBC connection.

Question 20

A data engineer needs to transform CSV files arriving in an S3 bucket into Parquet format and store them in another S3 bucket. The transformation is simple and on-demand, triggered by data arrival. Which solution is the MOST cost-effective and requires the least operational overhead?

Accepted Answer

Use S3 Events to trigger an AWS Lambda function that transforms the data. Using S3 Events to trigger an AWS Lambda function is the most cost-effective and operationally lightweight solution for simple, on-demand CSV-to-Parquet transformations. Lambda scales automatically with each S3 PUT event, incurs no idle cost, and requires no cluster management, making it ideal for event-driven, low-volume transformations.

Answer

Use Amazon EMR with Spark streaming

Answer

Use Amazon Athena to create a new table with Parquet format

Answer

Use AWS Glue ETL jobs scheduled to run every hour