DEA-C01 Mock Exam 71 — 25 Questions

Question 1

A company uses Amazon Kinesis Data Firehose to deliver log data to Amazon S3. The data is transformed by a Lambda function that adds a timestamp field. Recently, the Firehose delivery stream has been failing with 'Lambda invocation failed' errors. The Lambda function's CloudWatch Logs show that the function is timing out. What is the MOST likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The Firehose buffer size is too large, causing the Lambda function to receive too many records.. Kinesis Data Firehose sends batches of records to the Lambda function for transformation. If the buffer size (or batch size) is too large, the Lambda function receives too many records and exceeds its configured timeout, causing 'Lambda invocation failed' errors. The timeout errors in CloudWatch Logs confirm this. Option A is incorrect because the function is being invoked, so Lambda permissions are working. Option C is incorrect because a 1-minute timeout may be insufficient for large batches. Option D is incorrect because the logs indicate a timeout, not an out-of-memory error.

Answer

The Lambda function lacks permission to write to CloudWatch Logs.

Answer

The Lambda function timeout is set to 1 minute, which is adequate.

Answer

The Lambda function is running out of memory.

Question 2

A company is using AWS Glue to process data from Amazon S3. The Glue job reads CSV files and writes Parquet files to a different S3 bucket. The job occasionally fails with 'java.lang.OutOfMemoryError: Java heap space'. The data size varies. Which change should the engineer make to avoid this error?

Accepted Answer

Increase the number of DPUs allocated to the Glue job.. The 'java.lang.OutOfMemoryError: Java heap space' error in AWS Glue indicates that the Spark executors ran out of memory while processing the data. Increasing the number of DPUs (Data Processing Units) allocated to the Glue job increases the total memory available across the cluster, allowing larger datasets to be processed without hitting the heap limit. Each DPU provides 4 vCPUs and 16 GB of memory, so adding more DPUs scales memory linearly.

Answer

Convert the CSV files to JSON format before processing.

Answer

Decrease the Spark shuffle partitions in the job script.

Answer

Increase the job timeout setting.

Question 3

A data engineer runs this CLI command. Which query is MOST efficient against this table?

Accepted Answer

Query the CustomerIndex GSI by CustomerID and OrderDate.. The CLI command likely created a global secondary index (GSI) named CustomerIndex on CustomerID and OrderDate. Querying this GSI directly is the most efficient because it uses the index's sort key to retrieve only the relevant items without scanning the entire table, minimizing read capacity consumption.

Answer

Scan the table to find all orders for a CustomerID.

Answer

Create a local secondary index on CustomerID.

Answer

Query by OrderID and filter by OrderDate.

Question 4

A data engineer notices that a nightly AWS Glue ETL job has been failing for the past three days with the error 'Unable to locate credentials'. The job uses an IAM role for execution. What is the most likely cause of this error?

Accepted Answer

The IAM role's trust policy does not include glue.amazonaws.com as a trusted entity.. The error 'Unable to locate credentials' indicates that the AWS Glue job cannot obtain AWS credentials to authenticate API calls. Since the job uses an IAM role for execution, the most likely cause is that the trust policy of that IAM role does not include 'glue.amazonaws.com' as a trusted entity. Without this trust relationship, AWS Glue cannot assume the role and thus has no credentials to sign requests.

Answer

The IAM role does not have an access key attached.

Answer

The S3 bucket name in the job parameters is misspelled.

Answer

The JDBC connection string contains an incorrect password.

Question 5

A company has an S3 bucket with versioning enabled and a bucket policy that denies access if the request does not include encryption. A data engineer notices that some objects are not encrypted. What is the most likely cause?

Accepted Answer

The policy only applies to new uploads; existing objects remain unencrypted.. A bucket policy that denies unencrypted requests only applies to new uploads made after the policy is effective. Objects already in the bucket remain unencrypted. Option A is wrong because bucket policies apply to all requests, including those from the same account. Option C is wrong because default encryption would only apply to new objects, not existing ones. Option D is wrong because versioning does not retroactively encrypt existing objects.

Answer

The bucket policy does not evaluate requests from the same account.

Answer

Default encryption was not enabled at the bucket level.

Answer

Versioning was enabled after the objects were uploaded.

Question 6

A company runs a data lake on Amazon S3 with AWS Glue and Amazon Athena. The security team recently ran a report using Amazon Macie and found that multiple S3 objects containing PII are publicly accessible. The data engineer is tasked with remediating this issue immediately. The S3 bucket is configured with a bucket policy that grants public read access to all objects. The data engineer needs to ensure that no objects are publicly accessible while maintaining the ability for authorized IAM users and roles to access the data via Athena. The bucket must also remain accessible to the Glue crawler. What is the MOST effective course of action?

Accepted Answer

Remove the bucket policy granting public access and attach an IAM policy to the Glue and Athena roles to allow access to the bucket.. The most effective because it removes the public access grant while using IAM policies to authorize only the necessary roles (Glue and Athena). Option A is incorrect because Amazon Macie only identifies PII and cannot remediate access controls. Option C is insufficient because setting the bucket ACL to private does not change existing object ACLs that may grant public access, and using a bucket policy alone does not address object ACL overrides. Option D is incorrect because S3 Block Public Access prevents all public access but using service principals (like the Glue or Athena service principal) is not appropriate for intra-account access; IAM roles must be used to allow authorized users and services.

Answer

Use Amazon Macie to automatically remediate the public access by updating the object ACLs.

Answer

Set the bucket ACL to private and add a bucket policy that allows access to the Glue crawler and Athena.

Answer

Enable S3 Block Public Access on the bucket and use a bucket policy to allow access from the Glue and Athena service principals.

Question 7

A data engineer is designing a data pipeline that ingests streaming data from IoT devices into Amazon S3 using Amazon Kinesis Data Firehose. The data must be transformed from JSON to Parquet format before storage. Which TWO actions should the data engineer take to achieve this?

Accepted Answer

Create a Glue Data Catalog table defining the schema and configure Firehose to use the table for Parquet conversion.. Amazon Kinesis Data Firehose can directly convert incoming JSON data to Parquet format by referencing a table schema defined in the AWS Glue Data Catalog. This allows Firehose to perform the schema-aware conversion without custom code, leveraging the Glue table's column definitions and SerDe for Parquet serialization.

Answer

Enable Firehose's built-in Parquet conversion without any additional configuration.

Answer

Use Amazon Kinesis Data Analytics to convert the data format.

Answer

Configure Firehose to convert the data to Apache Avro format.

Question 8

A data engineer needs to ensure that an S3 bucket policy follows the principle of least privilege. Which of the following are valid conditions to restrict access based on the requester's identity? (Choose TWO.)

Accepted Answer

aws:PrincipalOrgID. Options A and E are correct. aws:PrincipalOrgID restricts access to IAM principals within a specific AWS Organization, directly tied to the requester's identity. aws:userId restricts access to a specific IAM user ID, also an identity attribute. Option D (aws:SourceIp) is a network condition based on IP address, not the requester's identity, so it does not meet the requirement. Options B (s3:x-amz-server-side-encryption) and C (aws:Referer) are not identity-based conditions.

Answer

s3:x-amz-server-side-encryption

Answer

aws:Referer

Answer

aws:SourceIp

Question 9

Which TWO options are valid ways to encrypt data at rest in Amazon S3? (Choose two.)

Accepted Answer

Server-Side Encryption with S3-Managed Keys (SSE-S3). Server-Side Encryption with S3-Managed Keys (SSE-S3) is a valid method for encrypting data at rest in Amazon S3 because it uses AES-256 encryption to automatically encrypt objects when they are written to S3 and decrypt them when accessed, with the encryption keys managed entirely by AWS. This option is correct as it directly addresses data at rest encryption within S3, requiring no client-side effort beyond setting the `x-amz-server-side-encryption` header to `AES256`.

Answer

Client-Side Encryption

Answer

SSL/TLS Encryption

Answer

IAM Policy Encryption

Question 10

A startup is building a mobile application that requires a database to store user profiles and preferences. The database must scale automatically with minimal administration. Which AWS service should they use?

Accepted Answer

Amazon DynamoDB. Amazon DynamoDB is a fully managed NoSQL key-value and document database that delivers single-digit millisecond performance at any scale. It supports automatic scaling of throughput capacity and storage with no downtime, making it ideal for a mobile application that requires minimal administrative overhead. The serverless, pay-per-request billing model aligns perfectly with the startup's need for automatic scaling and low operational burden.

Answer

Amazon Redshift

Answer

Amazon Aurora

Answer

Amazon RDS for PostgreSQL

Question 11

A company has an Amazon Redshift cluster with a mix of frequently accessed hot data and rarely accessed cold data. They want to reduce storage costs without affecting query performance for the hot data. Which strategy is MOST effective?

Accepted Answer

Use RA3 nodes with managed storage to automatically offload cold data to Amazon S3.. RA3 nodes with managed storage automatically separate compute and storage, offloading cold data to Amazon S3 while keeping hot data on local SSD for fast queries. This reduces storage costs without manual intervention or affecting hot data performance.

Answer

Reduce the number of nodes and increase the number of slices.

Answer

Create external tables in Redshift Spectrum to query cold data in S3.

Answer

Use Dense Compute nodes and unload cold data to Amazon S3 manually.

Question 12

A data engineer is using AWS Glue to perform ETL on data stored in an S3 bucket. The source data is in CSV format with a header row, and the target is a set of Parquet files partitioned by date. The engineer notices that the Glue job is reading all files in the source prefix, including temporary files that should be ignored. What is the MOST efficient way to exclude these temporary files?

Accepted Answer

Use an S3 prefix exclusion pattern in the Glue job's source path.. AWS Glue supports S3 path exclusion patterns using glob-style syntax (e.g., `--exclude` or `excludePatterns` in the job parameters). By specifying a pattern like `**/_temporary/**` or `*.tmp`, the Glue job will skip those files during the read phase, avoiding unnecessary data processing and reducing costs. This is the most efficient approach as it requires no additional infrastructure or data movement.

Answer

Change the source format from CSV to Parquet.

Answer

Set up an S3 event notification to trigger a Lambda function that moves temporary files.

Answer

Create a custom classifier in the Glue Data Catalog.

Question 13

A data engineer is designing a data ingestion pipeline to load clickstream data from an Amazon S3 bucket into an Amazon Redshift cluster. The data arrives in 5-minute batches. Which TWO actions should the engineer take to ensure data consistency and avoid duplicates? (Select TWO.)

Accepted Answer

Use the STL_LOAD_ERRORS system table to monitor and resolve load errors.. Options C and E are correct. Using the STL_LOAD_ERRORS system table (option C) allows the engineer to monitor and resolve load errors, ensuring data consistency. Using a staging table with a MERGE operation (option E) helps avoid duplicates by performing an upsert. Option A (defining a SORTKEY) improves query performance but does not affect deduplication. Option B (disabling WLM) would reduce resource management and is not recommended. Option D (loading into a single slice) reduces performance and does not maintain order for consistency.

Answer

Define a SORTKEY on the target table to improve deduplication.

Answer

Disable workload management (WLM) to maximize resources.

Answer

Load data into a single slice to maintain order.

Question 14

Refer to the exhibit. A data engineer runs the AWS CLI command to look up GetObject events. The output shows an event from the DataEngineer role. However, the engineer suspects that some GetObject requests are not being logged. What is the MOST likely reason?

Accepted Answer

The CloudTrail trail is not configured to log data events.. CloudTrail must have Data Events enabled for S3 object-level operations such as GetObject. Option A is wrong because the event is logged, so the trail exists. Option C is wrong because the engineer is looking up events, not configuring logging. Option D is wrong because the lookup is for a specific region, but the bucket might be in a different region, but that would not cause missing logs if events are logged in the bucket's region.

Answer

The IAM role does not have permission to read the CloudTrail logs.

Answer

The trail is not enabled in the us-east-1 region.

Answer

The S3 bucket is in a different region than the CloudTrail trail.

Question 15

The exhibit shows the output of describe-table for a DynamoDB table. The table is used for a reporting job that queries by 'pk' and filters on 'sk' using a range condition. The job is running slowly. What is the most likely cause?

Accepted Answer

The provisioned read capacity is too low.. The describe-table output shows the table has a primary key composed of 'pk' (partition key) and 'sk' (sort key), which is ideal for the query pattern described (query by 'pk' and filter on 'sk' with a range condition). The job is running slowly, and the most likely cause is insufficient provisioned read capacity, as the reporting job may be consuming more read capacity units than provisioned, leading to throttling and slower performance.

Answer

The table lacks a global secondary index (GSI).

Answer

The table uses provisioned throughput instead of on-demand.

Answer

The table needs a local secondary index (LSI) on 'sk'.

Question 16

A company uses Amazon Kinesis Data Firehose to deliver log data to Amazon S3. The data is transformed by a Lambda function that adds a timestamp field. Recently, the Firehose delivery stream has been failing with 'Lambda invocation failed' errors. The Lambda function's CloudWatch Logs show that the function is timing out. What is the MOST likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Decrease the buffer interval to 15 seconds.. The observed delay of up to 5 minutes during peak hours indicates that the buffer size threshold (5 MB) is rarely reached because each record is only ~2 KB, so the delivery stream relies on the buffer interval (60 seconds) to trigger delivery. By decreasing the buffer interval to 15 seconds, Kinesis Data Firehose will push data to S3 more frequently, directly reducing the maximum latency from 60 seconds to 15 seconds per batch, which eliminates the compounding delays caused by queuing during high-throughput periods.

Answer

Increase the buffer size to 10 MB to allow more records per delivery.

Answer

Enable compression (GZIP) on the delivery stream.

Answer

Enable data transformation with AWS Lambda to convert JSON to Parquet.

Question 17

A company has an Amazon DynamoDB table with on-demand capacity mode. The table stores session data for a web application. Recently, the application experienced throttling errors during a traffic spike. The team wants to prevent future throttling while optimizing costs. What should they do?

Accepted Answer

Implement a DynamoDB Accelerator (DAX) cluster. A DynamoDB Accelerator (DAX) cluster provides an in-memory cache that absorbs read-heavy traffic spikes, reducing the number of read requests that reach the underlying DynamoDB table. Since the throttling errors occurred during a traffic spike and the table uses on-demand capacity, which already scales automatically for writes and reads, the bottleneck is likely read-heavy traffic overwhelming the table's throughput. DAX offloads reads from the table, preventing throttling without requiring any changes to capacity mode, and it is cost-effective because it reduces read capacity unit consumption.

Answer

Enable DynamoDB auto scaling on the table

Answer

Switch to provisioned capacity with auto scaling

Answer

Increase the read and write capacity of the table

Question 18

Order the steps to query data in Amazon Redshift Spectrum from an external table in Athena.

Accepted Answer

Create external schema in Redshift, then create external table, then grant permissions, then run the query, then verify results.. Start by creating the external schema in Redshift, then the external table, grant permissions, run the query, and verify results.

Answer

Run the query, then verify results, then create external table, then grant permissions, then create external schema.

Answer

Create external table, then create external schema, then grant permissions, then run the query, then verify results.

Answer

Create external schema, then create external table, then run the query, then grant permissions, then verify results.

Question 19

A company stores sensitive financial data in an Amazon Redshift cluster. The data engineer must ensure that all queries are logged for audit purposes and that the logs are stored in Amazon S3 with server-side encryption. Which THREE steps should the data engineer take to meet these requirements?

Accepted Answer

Configure audit logs to be stored in an Amazon S3 bucket.. Amazon Redshift audit logs can be configured to be stored directly in an Amazon S3 bucket, which is a native feature for exporting connection logs, user logs, and query logs. This satisfies the requirement to log all queries for audit purposes without relying on external services.

Answer

Enable encryption on the Redshift cluster.

Answer

Enable AWS CloudTrail to log Redshift queries.

Question 20

Refer to the exhibit. A data engineer deploys this CloudFormation template to create an AWS Glue job. The job fails on the first run with an error: 'AccessDeniedException: User: arn:aws:sts::123456789012:assumed-role/GlueServiceRole/... is not authorized to perform: s3:GetObject on resource: s3://my-bucket/scripts/etl.py'. What is the most likely cause?

Accepted Answer

The IAM role associated with the Glue job does not have an S3 GetObject permission for the script location.. The error message indicates that the IAM role 'GlueServiceRole' assumed by the AWS Glue job does not have the s3:GetObject permission for the script object at s3://my-bucket/scripts/etl.py. AWS Glue requires the execution role to have read access to the script location specified in the 'ScriptLocation' parameter. Without this permission, the job fails immediately on startup because it cannot download and execute the ETL script.

Answer

The ExecutionProperty MaxConcurrentRuns is set to 1, preventing the job from running.

Answer

The MaxRetries is set to 0, so the job does not retry on failure.

Answer

The script location is incorrectly specified; it should be an S3 URI with bucket and key.