DEA-C01 Mock Exam 73 — 25 Questions

Question 1

A data engineer needs to implement encryption for data at rest in an Amazon S3 bucket that stores sensitive financial records. The company's security policy requires that the encryption keys be managed by the company and rotated annually. The data engineer wants to use AWS Key Management Service (AWS KMS) to meet these requirements. Which solution should the data engineer implement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use server-side encryption with AWS KMS customer managed keys (SSE-KMS) and configure automatic key rotation for the KMS key.. SSE-KMS with customer managed keys enables the company to control KMS keys and configure automatic annual rotation. This meets the security policy for company-managed keys and rotation, while providing seamless encryption for S3 objects.

Answer

Use client-side encryption with a customer-provided key stored in AWS Secrets Manager, and manually rotate the key annually.

Answer

Use server-side encryption with Amazon S3 managed keys (SSE-S3) and enable automatic key rotation.

Answer

Use server-side encryption with customer-provided keys (SSE-C) and rotate the keys by re-uploading objects with new keys annually.

Question 2

A data engineer needs to load data from an Amazon DynamoDB table into an Amazon S3 bucket for analytics. The table is approximately 500 GB and has a high volume of write traffic. The engineer must minimize the impact on the table's read capacity and avoid consuming provisioned throughput. What is the MOST appropriate method to export the data?

Accepted Answer

Use the DynamoDB export to Amazon S3 feature to export the table to an S3 bucket.. The DynamoDB export to Amazon S3 feature creates a point-in-time export without consuming any read capacity, which is critical for a high-traffic 500 GB table. Other methods such as Glue or DMS perform scans that consume RCUs, and Streams only provides incremental changes. Therefore, the native export is the only option that fully satisfies the requirement.

Answer

Use AWS Database Migration Service (AWS DMS) with a DynamoDB source and an S3 target.

Answer

Use AWS Glue to read the DynamoDB table with the dynamodb connector and write to Amazon S3.

Answer

Enable DynamoDB Streams and use an AWS Lambda function to write changed records to Amazon S3.

Question 3

A data engineer needs to ingest data from an Amazon S3 bucket into an Amazon Redshift cluster. The data is in CSV format and is updated daily. The engineer wants to use a fully managed service that can handle the load without managing infrastructure. Which AWS service should the engineer use?

Accepted Answer

AWS Glue. AWS Glue is a fully managed ETL service that can read CSV files from Amazon S3, apply transformations if needed, and load the data into Amazon Redshift. It handles the underlying infrastructure, scales automatically, and can be scheduled to run daily. This makes it the ideal choice for the scenario.

Answer

AWS Database Migration Service (AWS DMS)

Answer

Amazon Redshift Spectrum

Answer

Amazon Kinesis Data Firehose

Question 4

A data engineer is using AWS Step Functions to orchestrate a complex ETL workflow that includes multiple AWS Glue jobs, Amazon EMR steps, and AWS Lambda functions. The engineer notices that on rare occasions, the entire workflow fails due to a transient error in one of the Lambda functions. The engineer wants to make the workflow more resilient without changing the overall architecture. Which approach is the MOST effective?

Accepted Answer

Add a Retry state in the Step Functions state machine for the Lambda task with exponential backoff and a maximum number of attempts.. Adding a Retry state in Step Functions with exponential backoff and a maximum attempts limit is the most effective way to handle transient errors in Lambda functions. It automatically retries the failed task, increasing the likelihood of success without manual intervention, and is a standard resilience pattern in Step Functions.

Answer

Enable AWS X-Ray tracing for the Lambda function to identify the root cause of the errors.

Answer

Modify the Lambda function code to catch exceptions and return a success status to avoid workflow failure.

Answer

Configure the Lambda function to have a longer timeout and increase its memory size.

Question 5

A data engineer is using AWS Glue DataBrew to clean a dataset stored in Amazon S3. The dataset contains inconsistent date formats in a column named 'transaction_date'. The engineer needs to standardize all dates to ISO 8601 format (YYYY-MM-DD) and then write the cleaned data to a new S3 location. Which transformation should the engineer apply?

Accepted Answer

Use the 'Format date' transformation with a custom date format pattern.. The 'Format date' transformation in AWS Glue DataBrew is designed to parse and reformat date values. By specifying the input format(s) and setting the output format to 'yyyy-MM-dd', the engineer can standardize inconsistent date strings into ISO 8601. This ensures consistency for downstream processing and analytics, and it handles multiple input patterns without manual string manipulation.

Answer

Use the 'Change data type' transformation to convert the column to a date type.

Answer

Use the 'Replace value' transformation to replace all date separators with hyphens.

Answer

Use the 'Split column' transformation to separate day, month, and year into individual columns.

Question 6

A data engineer is using AWS Glue to run a job that reads from an Amazon S3 bucket and writes to another S3 bucket. The job must be scheduled to run every day at 2:00 AM UTC. Which AWS Glue feature should the engineer use to set up this schedule?

Accepted Answer

AWS Glue Triggers with a schedule type of 'Scheduled' and a cron expression.. AWS Glue Triggers of type 'Scheduled' accept cron expressions and run jobs on a defined schedule in UTC. Creating a scheduled trigger with the appropriate cron expression is the direct, native way to run a Glue job daily at 2:00 AM UTC without external orchestration.

Answer

AWS Glue job bookmarks with a time-based configuration.

Answer

AWS Glue DataBrew schedules with a cron expression.

Answer

AWS Glue Workflows with an on-demand trigger started by an Amazon EventBridge rule.

Question 7

A data engineer is designing a data lake on Amazon S3 and needs to ensure that data is encrypted at rest. The company requires that encryption keys be managed by AWS and automatically rotated annually. The engineer also wants to audit key usage. Which S3 encryption option should the engineer choose?

Accepted Answer

Server-side encryption with AWS KMS managed keys (SSE-KMS).. SSE-KMS uses AWS KMS to manage encryption keys, supports automatic annual key rotation, and logs key usage in AWS CloudTrail. This provides both the required encryption and auditability. Other options either do not support AWS-managed rotation or lack auditing capabilities.

Answer

Server-side encryption with Amazon S3 managed keys (SSE-S3).

Answer

Server-side encryption with customer-provided keys (SSE-C).

Answer

Client-side encryption with a custom key management solution.

Question 8

A data engineer is monitoring an AWS Glue job that reads from an Amazon S3 bucket and writes to Amazon Redshift. The job has been running for 2 hours, which is longer than usual. The engineer checks the Glue job's metrics and sees that the number of active executors is high, but the job is not making progress. The engineer suspects a data skew issue. Which action should the engineer take to diagnose and mitigate the skew?

Accepted Answer

Use the Spark UI to inspect the stage details and identify tasks that are taking significantly longer than others.. Data skew in Spark jobs manifests as a few tasks taking much longer than others. The Spark UI is the primary tool to diagnose skew by showing task-level metrics. Once identified, mitigation strategies include salting keys, using broadcast joins, or repartitioning. The correct action here is to use the Spark UI to inspect stage details.

Answer

Increase the number of DPUs for the Glue job to add more executors and reduce the impact of skew.

Answer

Enable AWS Glue job metrics and examine the 'glue.driver.aggregate.bytesRead' metric to identify skewed partitions.

Answer

Modify the Glue job to use the 'groupFiles' option to combine small files and improve parallelism.

Question 9

A data engineer needs to run a PySpark transformation on a 2 TB dataset stored in Amazon S3 and write the output back to S3 in Parquet. The team wants to use AWS Glue but does not want to manage clusters or tune Spark configuration manually. They also want to pay only for the time the job runs. Which AWS Glue component should the engineer use?

Accepted Answer

AWS Glue for Apache Spark job. AWS Glue for Apache Spark provides a serverless, distributed Spark runtime. The engineer submits a PySpark script, Glue handles cluster provisioning and Spark tuning, and billing is based on DPU-hours consumed during the run. This fits the need for custom PySpark on a 2 TB S3 dataset with no cluster management and pay-per-run cost, unlike single-node shell jobs or self-managed EMR clusters.

Answer

AWS Glue DataBrew recipe job

Answer

Amazon EMR on EC2 cluster with a bootstrap action

Answer

AWS Glue Python shell job

Question 10

A company is using an Amazon RDS for PostgreSQL database to store application data. The data engineering team needs to run complex analytical queries that join multiple large tables. These queries are causing performance degradation on the production database. The team wants to offload the analytical workload to a separate system that can handle large-scale data processing. Which AWS service should the team use?

Accepted Answer

Amazon Redshift. Amazon Redshift is purpose-built for analytical workloads, offering columnar storage, massively parallel processing, and advanced query optimization. By moving the analytical queries to Redshift, the team can achieve faster performance without impacting the production RDS database. This separation of transactional and analytical workloads is a common best practice.

Answer

Amazon ElastiCache for Redis

Answer

Amazon RDS for MySQL

Answer

Amazon DynamoDB

Question 11

A data engineer stores raw customer records in an Amazon S3 bucket and runs an AWS Glue job that writes curated Parquet files to a second bucket. The governance team requires that the curated data carry a verifiable record of which job run produced it and that any modification to a curated file be detectable. The engineer must also prove that the curated dataset has not been altered since a nightly baseline. Which combination of AWS features should the engineer use?

Accepted Answer

Compute an SHA-256 checksum per curated file, store the checksums and Glue job run IDs in a manifest, and use that manifest to verify the files against the nightly baseline.. Provenance and tamper evidence require linking each curated file to the job run that created it and being able to prove the bytes have not changed. A manifest that pairs a Glue job run ID with a per-file SHA-256 checksum delivers both. Comparing the nightly recomputed checksums against the baseline manifest surfaces any alteration, while versioning, CloudTrail, and Object Lock address adjacent concerns but not content integrity.

Answer

Enable AWS CloudTrail data events on the curated bucket and use AWS Glue job bookmarks to record the last processed run in the Data Catalog.

Answer

Enable S3 Versioning on the curated bucket and configure an S3 event notification to write each version ID to an Amazon DynamoDB table keyed by the Glue job run ID.

Answer

Enable S3 Object Lock in governance mode on the curated bucket and attach a retention period equal to the nightly baseline interval.

Question 12

A data engineer is using Amazon Kinesis Data Streams to ingest real-time data. The stream has 4 shards and is receiving 2 MB/s of data. The engineer notices that the WriteProvisionedThroughputExceeded metric is increasing. The engineer wants to resolve this issue with minimal changes. What should the engineer do?

Accepted Answer

Use a more random partition key to distribute data evenly across shards.. The WriteProvisionedThroughputExceeded metric indicates that some shards are exceeding their 1 MB/s write capacity. With 4 shards, total capacity is 4 MB/s, which is sufficient for 2 MB/s if evenly distributed. The issue is likely hot shards due to a non-uniform partition key. Using a more random partition key, such as a UUID, ensures even distribution and resolves the throttling without adding shards.

Answer

Increase the retention period of the stream to 168 hours.

Answer

Enable enhanced fan-out for the stream.

Answer

Increase the number of shards in the stream to 8.

Question 13

A data engineer manages an AWS Lake Formation governed data lake. Analysts query tables through Amazon Athena and must see only rows where the region column equals their assigned region, while column-level restrictions must also hide a national ID column. The engineer grants table SELECT to the analysts' IAM role in Lake Formation. What should the engineer configure next?

Accepted Answer

Create a Lake Formation data filter that includes a row filter expression on region and excludes the national ID column, then grant SELECT with that data filter to the role.. Lake Formation data filters are the mechanism for combining row-level expressions with column inclusion or exclusion in a single SELECT grant. Granting the filter to the analysts' IAM role enforces both restrictions on the governed table, so analysts see only their region rows and never the national ID column, without duplicating tables or views.

Answer

Attach an IAM policy to the analysts' role that denies access to the national ID column and uses a condition on the region tag.

Answer

Create separate Athena views for each region and revoke direct table access, relying on view definitions for the row and column limits.

Answer

Enable Amazon Athena workgroup query result reuse and rely on Athena to mask the national ID column automatically.

Question 14

A data engineer is designing a data lake on Amazon S3 for a financial analytics workload. The raw data arrives as JSON files from an on-premises system. Analysts need to query the data using Amazon Athena with fast performance and minimal cost for queries that filter on a specific transaction date and customer ID. The engineer wants to convert the data to a columnar format that supports predicate pushdown and compression. Which storage format should the engineer choose?

Accepted Answer

Apache Parquet. Apache Parquet is a columnar storage format that allows Athena to read only the columns referenced in a query and to skip row groups using predicate pushdown. This reduces the amount of data scanned, lowering cost and improving performance for filters on transaction date and customer ID. Parquet also compresses efficiently, further reducing storage and scan volume.

Answer

Apache Avro

Answer

JSON

Answer

CSV

Question 15

A data engineer needs to load data from an Amazon DynamoDB table into an Amazon S3 data lake nightly. The table is large and the engineer wants to avoid consuming provisioned read capacity on the live table. Which approach should the engineer use?

Accepted Answer

Use the DynamoDB export to Amazon S3 feature to export a point-in-time snapshot to S3 without consuming read capacity.. DynamoDB export to S3 produces a point-in-time snapshot directly in Amazon S3 without consuming read capacity on the source table, making it ideal for nightly analytics loads that must not impact production traffic. The exported data is written in a format suitable for downstream processing by services such as Athena or Glue.

Answer

Create an Amazon ElastiCache for Redis cluster and replicate the DynamoDB table into it, then export from Redis to Amazon S3.

Answer

Enable DynamoDB Streams on the table and use an AWS Lambda function to write each change to Amazon S3 in near real time.

Answer

Use AWS Glue with a DynamoDB connection and read the table directly with the DynamoDB reader, accepting the consumed read capacity.

Question 16

A data engineer is using AWS Glue to read from an Amazon S3 bucket that contains data in Apache Parquet format, partitioned by year/month/day. The Glue job needs to read only the data for the last 7 days. The engineer wants to minimize the amount of data scanned and improve job performance. Which approach should be used to filter the partitions efficiently?

Accepted Answer

Use a pushdown predicate in the Glue job's 'create_dynamic_frame.from_catalog' call to filter on partition columns.. Using a pushdown predicate in the 'create_dynamic_frame.from_catalog' call allows AWS Glue to filter partitions at the source, so only the relevant S3 partitions for the last 7 days are read. This minimizes data scanned and improves job performance by avoiding loading unnecessary data.

Answer

Create a separate Glue Data Catalog table for each day's data and read from the last 7 tables.

Answer

Read the entire dataset into a DynamicFrame and then apply a filter transformation on the partition columns.

Answer

Use the 'glueContext.read_from_options' with a 'filter' parameter to specify the partition range.

Question 17

A data engineer must load a 250 GB uncompressed CSV dataset from Amazon S3 into Amazon Redshift. The data must be loaded daily, and the engineer wants to minimize load time and avoid saturating the cluster's leader node. Which approach meets these requirements?

Accepted Answer

Use the COPY command with a manifest file that references multiple files in Amazon S3.. The COPY command is the most efficient way to load large datasets from Amazon S3 into Amazon Redshift. By using a manifest file that lists multiple S3 objects, the load is parallelized across all slices, reducing load time and preventing the leader node from becoming a bottleneck. This is the standard best practice for bulk data ingestion into Redshift.

Answer

Use the COPY command with a single large file and the COMPUPDATE OFF option.

Answer

Use Amazon Redshift Spectrum to query the CSV files directly from Amazon S3 without loading them.

Answer

Use AWS Database Migration Service (AWS DMS) with a full load task to copy the CSV data into Amazon Redshift.

Question 18

A data engineer is using AWS Glue job bookmarks to process incremental data from Amazon S3. The job reads from a partitioned S3 path and writes to Amazon Redshift. After a recent run, the engineer notices that some new partitions were not processed. The job bookmark state shows that the job has already processed up to a certain timestamp. What is the most likely reason for the missing partitions?

Accepted Answer

The new partitions were created with a timestamp earlier than the last processed timestamp.. Glue job bookmarks use timestamps or partition values to determine what data has already been processed. If new partitions have timestamps older than the last processed timestamp, they are considered already processed and skipped. This often happens with late-arriving data. The engineer should either adjust the bookmark to use partition-based tracking or handle late data separately.

Answer

The Glue job bookmark was not enabled for the S3 data source.

Answer

The Redshift cluster's copy command does not support partitioned data.

Answer

The Glue job's IAM role lacks permissions to read the new partitions.

Question 19

A data engineer is building an AWS Glue ETL job that reads from an Amazon S3 bucket and writes to another. The security team requires that all data be encrypted at rest and that the job use a customer-managed KMS key for encryption. The engineer configures the job with `--encryption-type sse-kms` and a KMS key ID. However, the job fails with an access denied error when writing to S3. The IAM role used by the Glue job has permissions to read and write the S3 buckets but has no KMS permissions. Which additional IAM permissions are required for the Glue job role to successfully write encrypted data?

Accepted Answer

kms:Encrypt and kms:GenerateDataKey on the KMS key. To write data to Amazon S3 with SSE-KMS, the Glue job role must have permissions to use the KMS key for encryption. Specifically, kms:Encrypt and kms:GenerateDataKey are required to create and encrypt the data key used for server-side encryption. Without these, the S3 PutObject operation fails with access denied. The other options either relate to reading (Decrypt) or administrative tasks (CreateGrant, ReEncrypt) that do not satisfy the encryption requirement for writing.

Answer

kms:Decrypt and kms:DescribeKey on the KMS key

Answer

kms:ReEncryptFrom and kms:ReEncryptTo on the KMS key

Answer

kms:CreateGrant and kms:ListKeys on the KMS key

Question 20

A data engineer is using Amazon Managed Workflows for Apache Airflow (MWAA) to orchestrate a data pipeline. The pipeline includes a task that runs an AWS Glue job. The engineer notices that the Glue job occasionally fails due to transient issues, and the Airflow task fails immediately without retrying. The engineer wants to configure the Airflow task to retry the Glue job up to 2 times with a 5-minute delay between retries. Which configuration in the Airflow DAG should the engineer use?

Accepted Answer

Set retries=2 and retry_delay=timedelta(minutes=5) in the default_args dictionary.. In Amazon MWAA, retry behavior for tasks is controlled by Airflow's built-in retry parameters. Setting retries and retry_delay in default_args applies to all tasks, including those running Glue jobs. This ensures that transient failures are retried with the specified delay, improving pipeline resilience.

Answer

Set max_retries=2 and retry_interval=300 in the Glue job's default arguments.

Answer

Use the retry_exponential_backoff=True parameter in the DAG definition.

Answer

Configure the Airflow task to use the GlueJobOperator with retry_limit=2 and retry_delay=300.