DEA-C01 Mock Exam 72 — 25 Questions

Question 1

A data engineer runs an AWS Glue ETL job that reads from a large Amazon S3 source (several terabytes of CSV files) and writes transformed data to an S3 bucket in Parquet format. The job fails with the error shown in the exhibit. The job uses the Standard worker type with 10 workers (G.1X). The engineer needs to resolve the failure with minimal cost increase. What should the engineer do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Change the worker type to G.2X with 10 workers.. The error indicates that the Glue job is running out of memory during the shuffle phase, which is common when processing large datasets with transformations that require data redistribution. Changing the worker type to G.2X doubles the memory per worker (from 16 GB to 32 GB) without increasing the number of workers, providing the necessary memory headroom for the shuffle operation at a minimal cost increase compared to scaling out with more workers.

Answer

Increase the number of workers to 20 while keeping G.1X worker type.

Answer

Change the worker type to G.4X with 10 workers.

Answer

Set the 'coalesce' parameter to reduce the number of output files.

Question 2

A company is designing a data lake on Amazon S3 for analytics. The data includes sensitive personally identifiable information (PII). Which TWO actions should the company take to protect the data? (Choose TWO.)

Accepted Answer

Enable S3 Block Public Access.. S3 Block Public Access (Option A) prevents any public access to S3 buckets and objects, which is critical for protecting PII from unintended exposure. Default encryption with SSE-KMS (Option E) ensures that all data written to S3 is encrypted at rest using AWS KMS-managed keys, providing both encryption and centralized key management for sensitive data.

Answer

Enable Requester Pays.

Answer

Enable S3 Transfer Acceleration.

Answer

Enable cross-region replication.

Question 3

A data engineer ran the command shown in the exhibit on the bucket 'my-data-lake'. The engineer then tries to delete an object version but receives an 'AccessDenied' error. The engineer has full S3 permissions via IAM. What is the most likely reason for the error?

Accepted Answer

MFA Delete is enabled, requiring multi-factor authentication. The command shown in the exhibit (likely `aws s3api put-bucket-versioning --bucket my-data-lake --versioning-configuration Status=Enabled,MFADelete=Enabled`) enables both versioning and MFA Delete on the bucket. When MFA Delete is enabled, any operation that permanently deletes an object version or changes the versioning state requires the request to include a multi-factor authentication token. Even though the engineer has full S3 permissions via IAM, the missing MFA token causes the 'AccessDenied' error. This is a bucket-level setting that overrides IAM permissions for these specific operations.

Answer

Versioning is suspended on the bucket

Answer

The bucket policy denies s3:DeleteObjectVersion

Answer

An S3 Object Lock retention policy is in effect

Question 4

A company uses Amazon Redshift for data warehousing. The security team requires that all data stored in Redshift be encrypted at rest. The current cluster is unencrypted. Which approach should the data engineer take to meet this requirement with minimal downtime?

Accepted Answer

Take a snapshot of the existing cluster and restore it to a new encrypted cluster.. Redshift allows restoring a snapshot to a new encrypted cluster. The engineer can take a snapshot of the existing cluster, restore it to a new cluster with encryption enabled, and then redirect traffic to the new cluster. Option A is wrong because encryption cannot be enabled on an existing cluster. Option B is wrong because COPY command does not encrypt the cluster. Option C is wrong because unloading and reloading data would cause significant downtime.

Answer

Modify the cluster to enable encryption.

Answer

Unload data to S3 and reload into a new encrypted cluster.

Answer

Use the COPY command to load data into a new encrypted table.

Question 5

A company uses AWS Glue to transform data in Amazon S3. The transformation logic is written in Python and references several libraries that are not included in the default Glue environment. Which approach should the data engineer use to make these libraries available?

Accepted Answer

Upload the libraries as a .zip file to an S3 bucket and reference them in the Glue job's Python library path.. AWS Glue allows you to provide custom Python libraries by uploading them as a .zip file to an S3 bucket and referencing the S3 path in the 'Python library path' field of the job. This method is supported for both Glue ETL and Python shell jobs, making custom libraries available at runtime. Option A is incorrect because Glue does not execute arbitrary shell commands like 'pip install' during job initialization; the job script runs in a controlled environment. Option B is incorrect because AWS Lambda layers are specific to Lambda functions and cannot be attached to Glue jobs. Option D is incorrect because the --additional-python-modules parameter, while valid in Glue 3.0 and later, only supports installing packages from PyPI, not custom libraries not published on PyPI.

Answer

Include a requirements.txt file in the Glue job script and run pip install during job initialization.

Answer

Package the libraries in an AWS Lambda layer and attach it to the Glue job.

Answer

Use the --additional-python-modules parameter in the Glue job.

Question 6

Your company runs a data pipeline that ingests data from AWS Database Migration Service (DMS) into Amazon S3 in Parquet format. An AWS Glue ETL job then transforms the data and loads it into an Amazon Redshift cluster. The Glue job uses a JDBC connection to Redshift. Recently, the Glue job started failing with a 'communication failure' error when writing to Redshift. The Redshift cluster is in a VPC with public accessibility disabled. The Glue job runs in a VPC with a subnet that has a route to a NAT gateway. The security group for Redshift allows inbound traffic from the Glue job's security group. The Glue job's IAM role has the necessary permissions. What is the most likely cause?

Accepted Answer

The Glue job and Redshift cluster are in different VPCs that are not peered or connected via VPC Transit Gateway.. Even though the security group allows inbound traffic, the Glue job's VPC may not have a route to the Redshift cluster's VPC if they are in different VPCs. Option A is wrong because IAM permissions are not the issue. Option B is wrong because the Redshift cluster is in a VPC and not publicly accessible. Option D is wrong because the NAT gateway is for outbound internet, not for connecting to Redshift within the same VPC.

Answer

The Glue job's IAM role does not have the redshift:DescribeClusters permission.

Answer

The Redshift cluster's public accessibility is disabled, but the Glue job is trying to connect over the internet.

Answer

The NAT gateway is not configured to allow traffic to the Redshift cluster's subnet.

Question 7

A company needs to ingest data from Amazon S3 into Amazon Redshift for analytics. The data arrives in CSV format with headers and may contain duplicate rows. Which Redshift command should be used to load the data while handling duplicates?

Accepted Answer

Use a staging table with COPY and then MERGE into the target table. The correct approach to handle duplicates when loading data from S3 into Redshift is to use a staging table with the COPY command, followed by a MERGE (or UPSERT) operation to insert distinct rows into the target table. Option A is incorrect because `REMOVEDUPLICATES` is not a valid COPY option. Option B is incorrect because INSERT INTO ... SELECT DISTINCT via Spectrum does not use Redshift's native ingestion and may be slower. Option D is incorrect because CREATE TABLE AS SELECT DISTINCT does not integrate with existing tables and is not a standard loading pattern.

Answer

COPY command with the `REMOVEDUPLICATES` option

Answer

INSERT INTO ... SELECT DISTINCT from S3 via Spectrum

Answer

CREATE TABLE AS SELECT DISTINCT from the S3 bucket

Question 8

A company uses Amazon DynamoDB to store session data. The security team requires that all data be encrypted at rest using a customer-managed KMS key. The data engineer has enabled encryption with a KMS key, but discovers that old data remains encrypted with the previous AWS-managed key. How can the engineer re-encrypt all existing data with the new key?

Accepted Answer

Export the table to S3 using DynamoDB Export to S3, then import using DynamoDB Import from S3 with the new encryption key specified. Exporting the table to S3 and then importing it with a new KMS key re-encrypts all data at rest using the new key. Option A is wrong because disabling and re-enabling encryption does not re-encrypt existing data; DynamoDB does not support in-place re-encryption of existing items. Option B is wrong because AWS Backup restores the table with the original encryption; it does not allow specifying a new key for existing data. Option C is wrong because changing the encryption key only applies to new writes; there is no 'Apply to existing data' option in the DynamoDB console.

Answer

Disable and re-enable encryption with the new KMS key

Answer

Use AWS Backup to back up the table and restore it with the new encryption key

Answer

Use the DynamoDB console to change the encryption key and select 'Apply to existing data'

Question 9

Refer to the exhibit. A data engineer applies this bucket policy to an S3 bucket. A user within the 10.0.0.0/24 IP range attempts to upload an object to the bucket using an HTTP (non-HTTPS) request. What is the outcome?

Accepted Answer

The upload fails because the request is not using HTTPS.. The bucket policy includes a condition `aws:SecureTransport` set to `false`, which explicitly denies any request that does not use HTTPS. Since the user is making an HTTP (non-HTTPS) request, the Deny statement overrides any Allow statement, causing the upload to fail. The correct answer is D.

Answer

The upload succeeds because the Allow statement grants permission.

Answer

The upload succeeds because the user's IP is allowed.

Answer

The upload fails because the user's IP is not in the allowed range for PutObject.

Question 10

A data engineer at a financial services company manages an AWS Glue ETL pipeline that processes transaction data from Amazon S3 to Amazon Redshift for reporting. The pipeline runs every hour and uses a Glue job that reads Parquet files, performs transformations in Spark, and writes to Redshift using the JDBC connector. Recently, the job has been failing intermittently with the error: 'java.sql.BatchUpdateException: ERROR: null value in column "transaction_id" violates not-null constraint'. The data engineer has verified that the source Parquet files do contain non-null values for transaction_id. The job uses a DynamicFrame and applies a mapping to rename columns. The engineer also noticed that the failure occurs only during peak hours when there is high concurrency on Redshift. Which course of action should the engineer take to resolve this issue?

Accepted Answer

Review the Glue job's mapping transformation to ensure transaction_id is correctly mapped and not dropped.. The error indicates that transaction_id is being nullified or dropped during the Glue job's mapping transformation. Even though source files have non-null values, the mapping could be incorrectly mapping or omitting the column, causing nulls to be written to Redshift. The failure during peak hours is coincidental; the root cause is the mapping logic. Option A is incorrect because filtering nulls would not fix the mapping error and could discard valid data. Option B is incorrect because increasing Redshift WLM concurrency scaling does not address the null constraint violation. Option D is incorrect because more Glue workers do not fix the transformation issue; the problem is data quality, not capacity.

Answer

Add a filter in Glue to remove rows with null transaction_id.

Answer

Increase the Redshift WLM concurrency scaling to handle more queries.

Answer

Increase the number of Glue workers to handle peak-hour load.

Question 11

A company is using an Amazon RDS for MySQL database for its e-commerce platform. During a recent flash sale, the database experienced high read traffic, causing slow query performance. The company needs a solution that offloads read traffic with minimal application changes. Which action should be taken?

Accepted Answer

Create an Amazon RDS read replica in the same region.. Creating an Amazon RDS read replica in the same region offloads read traffic from the primary DB instance by directing read queries to a read-only copy. This requires minimal application changes—only modifying the database connection string to point read queries to the replica endpoint. RDS read replicas use MySQL's native asynchronous replication, making them ideal for scaling read-heavy workloads like flash sales.

Answer

Enable DynamoDB Accelerator (DAX) on the RDS instance.

Answer

Migrate the database to Amazon Aurora and enable Aurora Global Database.

Answer

Implement Amazon ElastiCache for Redis to cache database queries.

Question 12

A company uses AWS Glue to perform ETL on data stored in Amazon S3. The Glue job reads CSV files, converts them to Parquet, and partitions by date. The job runs daily and processes about 500 GB of data. The team wants to optimize costs and performance. Which three actions should the team take? (Select THREE.)

Accepted Answer

Use column pruning to read only necessary columns in the Glue script.. Column pruning in AWS Glue scripts reduces the amount of data read from Amazon S3 by specifying only the columns needed for the ETL transformation. This minimizes I/O and network overhead, directly lowering costs and improving job performance, especially when processing large CSV files.

Answer

Increase the Spark shuffle partitions to 500.

Answer

Write the output as JSON instead of Parquet to avoid compression overhead.

Question 13

Refer to the exhibit. An S3 bucket policy is shown. A data engineer using the DataEngineerRole tries to upload an object to s3://example-bucket/data/report.csv with SSE-S3 encryption. The upload fails. What is the most likely cause?

Accepted Answer

The condition requires SSE-S3 encryption header, but the upload did not include it.. The bucket policy includes a condition that the request must include the `x-amz-server-side-encryption` header with value `AES256` (SSE-S3). The upload did not include this header, so the policy condition was not met, resulting in a failed upload. Option A is incorrect because the resource ARN matches the object path. Option B is incorrect because the role has the `s3:PutObject` permission. Option D is incorrect because the principal (DataEngineerRole) is allowed by the policy.

Answer

The resource ARN does not match the object.

Answer

The role does not have s3:PutObject permission.

Answer

The principal is not authorized.

Question 14

A data engineer needs to ensure that sensitive data stored in Amazon S3 is encrypted at rest. Which TWO options meet this requirement? (Choose TWO.)

Accepted Answer

Server-Side Encryption with AWS KMS-Managed Keys (SSE-KMS). Server-Side Encryption with AWS KMS-Managed Keys (SSE-KMS) allows you to enforce encryption at rest for S3 objects using a customer-managed or AWS-managed KMS key. This option meets the requirement because the encryption is applied server-side by S3 before the data is written to disk, and the data is decrypted automatically when accessed with appropriate permissions. SSE-KMS also provides an audit trail via AWS CloudTrail for every key usage.

Answer

Using a VPC to restrict network access

Answer

Enabling MFA Delete on the S3 bucket

Answer

Client-Side Encryption with SSL/TLS

Question 15

A company is using AWS Glue to process data stored in Amazon S3. The Glue job runs successfully but takes longer than expected. Which TWO actions can reduce the job runtime?

Accepted Answer

Increase the number of DPUs allocated to the job. Increasing DPUs (Data Processing Units) allocates more compute resources to the Glue job, allowing it to process data faster, thus reducing runtime. Option E is correct: Partitioning the input data in S3 allows Glue to use partition pruning, reading only the necessary partitions instead of scanning the entire dataset, which reduces I/O and processing time. Option A is incorrect: Disabling job bookmarking does not reduce runtime; it only affects how Glue tracks processed data and might cause reprocessing. Option C is incorrect: Reducing the number of workers would decrease parallelism, likely increasing runtime. Option D is incorrect: Changing from Spark to Python Shell would likely increase runtime because Python Shell is single-threaded and not designed for large-scale data processing compared to Spark.

Answer

Disable job bookmarking

Answer

Reduce the number of workers

Answer

Change the job type from Spark to Python shell

Question 16

A company is running a data warehouse on Amazon Redshift. The data engineering team notices that query performance has degraded over time. They suspect that data distribution is causing excessive data movement between nodes. The table is joined frequently on the customer_id column. Which column should be chosen as the distribution key to optimize join performance?

Accepted Answer

customer_id. (customer_id) because Redshift distributes data across nodes based on the distribution key. When two tables are joined on customer_id, using it as the distribution key ensures that matching rows from both tables are co-located on the same node, eliminating the need for data redistribution (broadcast or shuffle) during the join. This minimizes network traffic and reduces query latency, directly addressing the performance degradation caused by excessive data movement.

Answer

AUTO distribution

Answer

order_date

Answer

EVEN distribution

Question 17

An e-commerce company uses AWS Glue to run ETL jobs that transform clickstream data from Amazon S3. The job reads Parquet files, performs aggregations, and writes the results to Amazon Redshift. The job runs successfully but takes longer than expected. The data volume is increasing. Which design change would MOST improve the job's performance?

Accepted Answer

Increase the number of Glue worker nodes (DPUs) for the job.. Increasing the number of Glue worker nodes (DPUs) directly scales the distributed processing capacity of the ETL job, allowing it to process larger volumes of Parquet data in parallel. This is the most straightforward way to reduce execution time when data volume is growing, as AWS Glue automatically partitions the workload across the additional workers.

Answer

Write the aggregated results to a single large file instead of multiple partitions.

Answer

Convert the Parquet files to CSV to simplify the schema.

Answer

Replace the Redshift target with Amazon Redshift Spectrum.

Question 18

Which TWO actions should a data engineer take to encrypt data at rest in an Amazon S3 bucket? (Select TWO.)

Accepted Answer

Configure the bucket to use SSE-KMS.. SSE-KMS (Server-Side Encryption with AWS Key Management Service) encrypts data at rest in S3 by using a KMS key to manage encryption keys. This provides envelope encryption, where a CMK generates a data key that encrypts the object, and the data key is then encrypted by the CMK. Option D is correct because enabling default encryption on an S3 bucket using SSE-S3 (AES-256) ensures that all objects uploaded without explicit encryption headers are automatically encrypted at rest by S3's managed key.

Answer

Enable S3 Transfer Acceleration on the bucket.

Answer

Use client-side encryption before uploading objects to S3.

Answer

Attach a bucket policy that denies unencrypted PUT requests.

Question 19

A company is ingesting streaming data from social media feeds using Amazon Kinesis Data Streams. The data is consumed by multiple applications: one for real-time sentiment analysis and another for archival to S3. The data must be processed in order for each social media post. Which TWO approaches meet the requirements? (Choose TWO.)

Accepted Answer

Use a single shard in the Kinesis Data Streams and have all consumers read from that shard. Using a single shard ensures that all records are processed in the exact order they are ingested, as Kinesis Data Streams guarantees ordering within a shard. Since both consumers (real-time sentiment analysis and archival to S3) read from the same shard, they will each receive records in the same sequence, meeting the requirement for ordered processing of each social media post.

Answer

Use Amazon Kinesis Data Firehose to buffer and deliver to S3

Answer

Use Amazon SQS FIFO queues between the stream and consumers

Answer

Use multiple shards and assign each consumer to a specific shard

Question 20

A data engineer is designing a data ingestion pipeline for clickstream data from a mobile app. The data volume varies, with occasional spikes up to 10 MB/s. The pipeline must persist the raw data in Amazon S3 and make it available for near-real-time analytics via Amazon Athena. Which combination of services minimizes cost and operational overhead?

Accepted Answer

Amazon Kinesis Data Firehose with direct delivery to Amazon S3, then Amazon Athena. Amazon Kinesis Data Firehose is the most cost-effective and low-overhead solution for ingesting variable-volume clickstream data (up to 10 MB/s) into Amazon S3 because it is a fully managed service that automatically scales, buffers, and compresses data before delivery. It integrates directly with S3 without requiring custom code or infrastructure management, and the data is immediately queryable by Amazon Athena with no additional transformation steps.

Answer

Amazon Kinesis Data Streams with Amazon Kinesis Data Analytics, then Amazon S3

Answer

Amazon SQS with an Auto Scaling group of EC2 instances writing to Amazon S3

Answer

Amazon Kinesis Data Streams with AWS Lambda for transformation, then Amazon S3