DEA-C01 Mock Exam 72 — 25 Questions

Question 1

A data engineer is designing an ingestion pipeline where AWS Lambda processes records from an Amazon Kinesis Data Stream. During peak traffic, records are being reprocessed and some are lost. The engineer needs to make the consumer resilient to failures and avoid duplicate processing. (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable a dead-letter queue or on-failure destination for the event source mapping.. Bisect-on-error with a bounded retry count isolates and stops poison records from blocking a shard, while an on-failure destination captures records that exhaust retries so they are not lost. Together they make the Kinesis consumer resilient and give operators a recovery path. Concurrency, starting position, and batch size changes do not address the underlying failure-handling gaps.

Answer

Increase the Lambda function's reserved concurrency to match the number of shards.

Answer

Reduce the batch size to one record to eliminate any possibility of duplicates.

Answer

Set the starting position to LATEST so the consumer only reads new records.

Question 2

A data engineer is using AWS Step Functions to orchestrate a series of AWS Glue jobs and Amazon EMR steps as part of a nightly ETL pipeline. The pipeline occasionally fails due to transient issues such as Amazon S3 throttling or temporary network errors. The engineer wants to make the workflow more resilient without duplicating the entire state machine. Which Step Functions feature should be used to automatically retry failed states?

Accepted Answer

Configure Retry and Catch fields on individual states.. Step Functions provides Retry and Catch fields at the state level to handle transient errors. By configuring Retry with a backoff strategy and maximum attempts, the workflow can automatically re-execute a failed state, such as a Glue job start or EMR step, without manual intervention. Catch can then define a fallback if retries are exhausted. This is the standard approach for making orchestration resilient to intermittent service issues.

Answer

Enable X-Ray tracing on the state machine.

Answer

Set the state machine's TimeoutSeconds to a large value.

Answer

Use a Map state to iterate over each Glue job.

Question 3

A data engineer is using AWS Lake Formation to manage permissions on a Data Catalog table backed by Amazon S3. Analysts query the table with Amazon Athena. The security team wants analysts to see only rows where the region column equals 'EU' and to prevent them from viewing the customer_id column entirely. Which combination of Lake Formation features should the engineer implement?

Accepted Answer

Define a Lake Formation data filter with a row filter expression region='EU' and exclude the customer_id column, then grant the analysts SELECT on the table with that filter.. Lake Formation data filters combine row filter expressions with column selection. A row filter of region='EU' restricts visible rows, and excluding customer_id from the filter removes that column from query results. Granting analysts SELECT on the table through the filter applies both restrictions automatically for Athena and other integrated engines without duplicating or transforming the underlying data.

Answer

Use AWS Glue DataBrew to create a project that removes the customer_id column and filters to EU rows, then publish the result as a new table for analysts.

Answer

Attach a tag-based access control policy to the table that grants access only when the analyst's IAM principal carries a tag matching the region value.

Answer

Create an IAM policy that allows Athena access only to the S3 prefix containing EU data and deny access to the customer_id column in the Data Catalog.

Question 4

A data engineer is building an AWS Glue job that reads a table from the AWS Glue Data Catalog. The table contains columns with customer names, email addresses, and account numbers. The security team wants the job to mask the last four digits of account numbers in the output while leaving other columns unchanged. Which approach should the data engineer use?

Accepted Answer

Use a DynamicFrame map transformation with a custom function that replaces the account number value with a masked version.. Masking specific column values during a Glue ETL run is best done with a map transformation that applies a custom function to each record. This keeps the transformation inside the job, gives full control over the masking logic, and leaves other columns unchanged. PII detection, DataBrew recipes, and column-level encryption do not perform value-level masking in this context.

Answer

Use the AWS Glue DataBrew masking recipe and apply it as a transformation step in the Glue job.

Answer

Apply a DynamicFrame map transformation and call the PII detection transform on the account number column.

Answer

Enable column-level encryption on the Data Catalog table definition for the account number column.

Question 5

A data engineer is managing an Amazon DynamoDB table that stores user session data. The table has a partition key of user_id and a sort key of session_start_time. The workload includes frequent queries that retrieve all sessions for a user within a specific time range. The engineer notices that some queries are slow and wants to optimize the table design. Which action should the engineer take to improve query performance?

Accepted Answer

Ensure that queries use the partition key and sort key condition to retrieve data efficiently, and consider enabling adaptive capacity.. The correct action is to ensure queries use the partition key and sort key condition to retrieve data efficiently, and to consider enabling adaptive capacity. The table's key schema is already optimized for the query pattern, so leveraging it properly is key. Other options introduce unnecessary complexity, do not address the query pattern, or simply scale capacity without fixing efficiency.

Answer

Increase the provisioned read capacity units (RCUs) for the table to handle the query load.

Answer

Create a global secondary index (GSI) with session_start_time as the partition key and user_id as the sort key.

Answer

Enable DynamoDB Streams to capture changes and use AWS Lambda to maintain a separate queryable table.

Question 6

A data engineer manages an AWS Glue ETL job that reads CSV files from Amazon S3 and writes Parquet to another S3 prefix. The job recently started failing with the error 'AnalysisException: Unable to infer schema for CSV.' The engineer confirms the S3 path contains files and the IAM role has s3:GetObject permissions. The job's script uses glueContext.create_dynamic_frame.from_catalog with a database and table name. What is the MOST likely cause?

Accepted Answer

The AWS Glue Data Catalog table's SerDe parameters are misconfigured, so the crawler did not correctly identify the CSV delimiter or header.. When an AWS Glue job uses create_dynamic_frame.from_catalog, it depends entirely on the AWS Glue Data Catalog table definition to determine the schema. If the table's SerDe parameters are incorrect—such as a wrong delimiter, missing header, or incorrect classification—the job cannot infer the schema and throws the AnalysisException. Verifying and repairing the catalog table resolves the failure.

Answer

The AWS Glue job's bookmarks are enabled, causing it to skip files that were already processed and leaving no data to infer schema from.

Answer

The IAM role lacks s3:ListBucket permission on the source bucket, so the job cannot list the CSV files.

Answer

The CSV files are compressed with gzip, and AWS Glue cannot infer schema from compressed files.

Question 7

A data engineer manages an AWS Glue Data Catalog used by Amazon Athena analysts. The security team wants column-level restrictions so that analysts querying a specific table cannot view the values in a cardholder_name column, while still being able to query all other columns. The analysts connect through Athena using an IAM role. Which approach meets this requirement with the LEAST operational overhead?

Accepted Answer

Create an AWS Lake Formation data filter that excludes the cardholder_name column, then grant the analysts' IAM role SELECT on the table with that data filter applied.. Column-level access control in the Glue Data Catalog is provided by Lake Formation data filters, which can include or exclude specific columns and are attached to grants. Granting the analysts' role SELECT with a filter that excludes cardholder_name lets all other columns remain queryable through Athena while the restricted column is inaccessible. IAM policies, views, and CloudTrail do not enforce column-level prevention centrally.

Answer

Enable AWS CloudTrail data events on the table and alert when cardholder_name is queried.

Answer

Create a separate Athena view that omits cardholder_name and grant the analysts access only to that view.

Answer

Define an IAM policy that denies the glue:GetTable action for the cardholder_name column and attach it to the analysts' role.

Question 8

A data engineer is using AWS Step Functions to orchestrate a series of AWS Glue jobs that process data in Amazon S3. The engineer needs to ensure that if a Glue job fails, the entire workflow stops and an Amazon SNS notification is sent. Which Step Functions state type should be used to handle the error and send the notification?

Accepted Answer

A Task state with a Catch field that transitions to a state that publishes to an Amazon SNS topic.. In AWS Step Functions, the Catch field on a Task state allows you to define a fallback state when an error occurs. By transitioning to a state that publishes to an Amazon SNS topic, the workflow can stop and send a notification. This is the correct pattern for error handling and alerting in Step Functions.

Answer

A Choice state that evaluates the output of the Glue job and branches based on success or failure.

Answer

A Parallel state that runs the Glue job and an SNS notification task simultaneously.

Answer

A Task state with a Retry field that retries the Glue job up to three times.

Question 9

A data engineer manages an AWS Glue ETL job that processes sensitive customer records stored in Amazon S3. The security team mandates that all data at rest in the S3 bucket be encrypted with AWS KMS keys, and that the Glue job have the minimum permissions necessary to read and write data. The engineer creates a KMS key and configures the S3 bucket to use SSE-KMS with that key. Which additional step is required to allow the Glue job to access the encrypted data?

Accepted Answer

Attach an IAM policy to the Glue job's execution role that allows kms:Decrypt and kms:GenerateDataKey on the KMS key.. For an AWS Glue job to read and write SSE-KMS encrypted S3 objects, its execution role must have IAM permissions for kms:Decrypt and kms:GenerateDataKey on the specific KMS key. S3 bucket policies do not control KMS key access, and switching encryption types would violate requirements. VPC endpoints address network connectivity, not authorization.

Answer

Modify the S3 bucket policy to grant the Glue service principal kms:Decrypt and kms:GenerateDataKey permissions.

Answer

Enable default encryption on the S3 bucket using SSE-S3 instead of SSE-KMS to avoid KMS permission complexity.

Answer

Create a VPC endpoint for KMS and attach it to the Glue job's subnet to allow KMS traffic.

Question 10

A data engineer is using AWS Glue to transform data from Amazon S3 and load it into Amazon Redshift. The job runs daily and processes 500 GB of data. The engineer notices that the job takes several hours and wants to optimize performance. The data is stored in Parquet format and partitioned by date. Which optimization should the engineer implement to improve the job's performance?

Accepted Answer

Use predicate pushdown to filter data at the source and partition pruning to read only necessary partitions.. Predicate pushdown and partition pruning are key optimizations for AWS Glue jobs reading partitioned Parquet data. They minimize the amount of data scanned by pushing filters to the source and skipping irrelevant partitions. This reduces I/O and compute time, directly addressing the performance issue without unnecessary cost increases.

Answer

Convert the Parquet data to CSV to improve read performance.

Answer

Increase the number of DPUs for the Glue job to scale horizontally.

Answer

Enable job bookmarks to track processed data and avoid reprocessing.

Question 11

A data engineer is building an AWS Glue ETL job that must read from an Amazon S3 bucket in the same account and write to an Amazon Redshift cluster in a private VPC. The job must not traverse the public internet and must use least-privilege credentials. (Choose two.)

Accepted Answer

Grant the Glue job an IAM role with an S3 bucket policy that allows access only to the required prefixes.. Private connectivity to Redshift requires the Glue job to run inside the VPC through a VPC connection with correct subnet routing and security group rules. Least privilege is then enforced by a scoped IAM role and bucket policy, so the two together satisfy both the no-public-internet and least-privilege requirements.

Answer

Store the Redshift user password in the job script as a plaintext variable so the connection can authenticate.

Answer

Set the Glue job's connection type to JDBC and rely on the default Glue service role for all S3 and Redshift permissions.

Answer

Create an internet gateway and a NAT gateway in the VPC so the Glue job can reach Redshift endpoints.

Question 12

A data engineer manages an Amazon Redshift provisioned cluster that serves a nightly ELT workload. The cluster's largest fact table is loaded with new rows each night, and queries frequently filter on a date column and join to a customer dimension. The engineer wants to improve query performance and reduce the time spent vacuuming. Which TWO actions should the engineer take? (Choose two.)

Accepted Answer

Set the customer join column as the distribution key so matching rows of the fact and dimension tables co-locate on the same slice.. Performance and vacuum efficiency in Redshift are driven primarily by table design. Sorting on the frequently filtered date column enables zone-map pruning and makes VACUUM's work easier, while distributing the fact table and customer dimension on the join column enables collocated joins that avoid network-heavy shuffles. Together they reduce scanned blocks and join cost without adding hardware.

Answer

Enable automatic compression on all columns and disable the sort key to reduce storage footprint.

Answer

Convert the fact table to a view over the raw staging table to avoid storing duplicate data.

Answer

Increase the cluster's number of nodes without changing the table design or sort keys.

Question 13

A data engineer is using AWS Glue to run a nightly ETL job that reads from an Amazon DynamoDB table and writes to Amazon S3 in Parquet format. The DynamoDB table is large and has a high read capacity. The engineer wants to minimize the impact on the DynamoDB table's performance and reduce the ETL job's runtime. Which approach should the engineer take?

Accepted Answer

Export the DynamoDB table to Amazon S3 using DynamoDB's native export feature, then use AWS Glue to read from S3 and write to Parquet.. To minimize impact on DynamoDB performance and reduce ETL runtime, exporting the table to S3 is ideal because it does not consume read capacity. AWS Glue can then process the exported data from S3, which is faster and does not affect the source table. Other methods like parallel scans or increasing workers still consume capacity and can impact performance.

Answer

Use AWS Glue with DynamoDB connector and enable DynamoDB Accelerator (DAX) for the table.

Answer

Use AWS Glue with DynamoDB connector and increase the job's number of workers to read the table faster.

Answer

Use AWS Glue with DynamoDB connector and configure the job to use parallel scans with a segment ratio.

Question 14

A data engineer is using AWS Step Functions to orchestrate an ETL workflow that includes an AWS Glue job, an Amazon EMR step, and an Amazon Redshift stored procedure. The workflow sometimes fails due to transient errors, and the engineer wants to implement a retry strategy that avoids duplicate data processing. Which TWO actions should the engineer take? (Choose two.)

Accepted Answer

Implement idempotency in the ETL tasks so that retries do not produce duplicate data.. To handle transient errors without duplicating data, the engineer should add Retry policies to Task states and ensure ETL tasks are idempotent. Retry policies automatically re-execute failed tasks, while idempotency guarantees that repeated executions do not create duplicate records. Together, they provide robust error handling and data integrity.

Answer

Configure the Step Functions execution to run in Express mode for faster retries.

Answer

Use a Catch block to redirect to a cleanup state that deletes partially written data before retrying the entire workflow.

Answer

Increase the timeout of the entire state machine to allow more time for tasks to complete.

Question 15

A data engineer needs to store a large volume of time-series data from IoT sensors. The data will be queried by timestamp and sensor ID, and the engineer wants to use a managed AWS database that can handle high write throughput and provide fast queries on recent data. The engineer also wants to automatically expire old data after 90 days to reduce storage costs. Which AWS service should the engineer use?

Accepted Answer

Amazon Timestream. Amazon Timestream is a fully managed time-series database that handles high write throughput, provides fast queries on recent data, and supports automatic data retention policies. It is designed specifically for time-series data like IoT sensor readings, with built-in functions for time-based queries. Other options either lack native time-series optimization or require manual management of retention and querying.

Answer

Amazon DynamoDB with TTL

Answer

Amazon RDS for PostgreSQL with table partitioning

Answer

Amazon S3 with lifecycle policies

Question 16

A data engineer needs to run an AWS Glue ETL job that reads from an Amazon S3 bucket in another AWS account. The bucket owner has granted cross-account access, and the Glue job runs with an IAM role in the engineer's account. The job fails with an access denied error when reading the source objects. Which change is required to allow the Glue job to read the cross-account S3 data?

Accepted Answer

Add an S3 bucket policy in the source account that grants the Glue job's IAM role s3:GetObject and s3:ListBucket on the bucket.. S3 authorization evaluates both identity-based policies in the caller's account and resource-based policies on the bucket. Because the Glue job's role lives in a different account than the bucket, the bucket owner must attach a bucket policy granting s3:GetObject and s3:ListBucket to that role. Catalog sharing and service-role policies do not extend to cross-account object reads.

Answer

Recreate the Glue job in the source account so it uses a role owned by the bucket owner.

Answer

Attach the AWSGlueServiceRole managed policy to the Glue job's IAM role in the engineer's account.

Answer

Enable AWS Glue Data Catalog cross-account sharing by creating a resource link to the source account's catalog.

Question 17

A data engineer is building a streaming ingestion pipeline using Amazon Kinesis Data Streams. The producer application writes records with an explicit partition key derived from the device ID, and there are approximately 2,000 active devices. The engineer needs to ensure that records for the same device are processed in order by a downstream consumer. Which configuration should the engineer verify to guarantee per-device ordering?

Accepted Answer

Confirm that the partition key is stable per device so records map to the same shard.. Kinesis Data Streams guarantees ordering only within an individual shard. Because the partition key is hashed to select a shard, any record sharing the same partition key is consistently routed to the same shard. Keeping the device identifier as the partition key ensures all records for a device are serialized in one shard, delivering the required per-device ordering without sacrificing horizontal scale across the fleet.

Answer

Increase the stream's retention period to 365 days to preserve ordering.

Answer

Ensure all records use the same partition key so they land in a single shard.

Answer

Enable enhanced fan-out on the stream so each consumer gets a dedicated read throughput.

Question 18

A data engineer is using Amazon Redshift and needs to load data from Amazon S3 into a Redshift table. The data is in Parquet format and is partitioned by date in S3. The engineer wants to load only the data for the last 7 days to reduce load time and cost. Which Redshift command should the engineer use?

Accepted Answer

COPY command with a manifest file that lists only the files for the last 7 days.. The COPY command with a manifest file allows precise selection of files to load, enabling the engineer to load only the Parquet files for the last 7 days. This minimizes data transfer and load time. Other options either do not exist (PARTITION clause in COPY) or are for unloading data (UNLOAD) or are less efficient for bulk loading (INSERT from Spectrum).

Answer

UNLOAD command with the PARTITION BY clause.

Answer

INSERT INTO ... SELECT FROM spectrum ... WHERE date >= ...

Answer

COPY command with the PARTITION clause.

Question 19

A data engineer manages an AWS Glue ETL job that processes JSON files from an S3 bucket and writes Parquet to another bucket. The job uses a Glue DynamicFrame with a specified schema. During execution, the job fails with the error: 'AnalysisException: cannot resolve column 'transaction_id' given input columns: [txn_id, amount, timestamp]'. The source data has a column named 'txn_id', but the Glue job's script references 'transaction_id'. The job's catalog table for the source points to the correct S3 location and has the correct schema. What is the most likely cause of this error?

Accepted Answer

The Glue job's script uses a hardcoded schema that does not match the actual data columns.. The error occurs because the Glue script references a column that does not exist in the source data. Even though the Glue Data Catalog is correct, the script may have been written with a hardcoded schema or mapping that expects 'transaction_id' instead of 'txn_id'. To resolve, the engineer should update the script to use the correct column name or apply a mapping to rename 'txn_id' to 'transaction_id'.

Answer

The Glue job's IAM role lacks permission to read the S3 bucket, resulting in an empty DynamicFrame.

Answer

The Glue Data Catalog table for the source has an incorrect schema definition.

Answer

The S3 bucket contains files with inconsistent schemas, causing Glue to infer a different column name.

Question 20

A data engineer is using AWS Glue to transform data from Amazon S3 and load it into Amazon Redshift. The engineer needs to ensure that the job handles data quality issues such as duplicate records and missing values before loading. The job must also minimize the amount of data shuffled across the network. Which two actions should the engineer take? (Choose two.)

Accepted Answer

Use the FillMissingValues transform to replace missing values with a default.. DropDuplicates removes duplicate records, and FillMissingValues replaces missing values with defaults, directly addressing the data quality requirements. Both are built-in AWS Glue transforms that can be applied without custom code. The other options do not handle duplicates or missing values, and repartitioning to a single partition would increase network shuffle, contrary to the requirement.

Answer

Repartition the DynamicFrame to a single partition before writing to Redshift.

Answer

Use the ResolveChoice transform to handle data type conflicts.

Answer

Enable job bookmarks to track processed data and avoid reprocessing.