DEA-C01 Mock Exam 73 — 25 Questions

Question 1

A data engineer is migrating an on-premises MongoDB database to Amazon DocumentDB. Which migration strategy minimizes downtime?

Accepted Answer

Use AWS DMS with full load and ongoing replication from MongoDB to DocumentDB.. AWS DMS with full load and ongoing replication (change data capture) minimizes downtime by continuously synchronizing changes from the source MongoDB to the target DocumentDB after the initial full load, allowing a cutover with only a brief pause. This is the only option that supports near-zero downtime migration for live databases.

Answer

Take a snapshot of the MongoDB database and restore it to DocumentDB.

Answer

Use AWS Database Migration Service (AWS DMS) with full load only.

Answer

Export data using mongodump and import using mongorestore.

Question 2

A company uses Amazon Kinesis Data Firehose to deliver data to Amazon S3. The data is transformed using an AWS Lambda function. Recently, the transformation errors have increased due to Lambda timeouts. The data engineer needs to diagnose and resolve the issue without losing data. What should the engineer do?

Accepted Answer

Increase the Lambda function timeout and ensure that failed records are sent to a backup S3 bucket. Increasing the Lambda function timeout directly addresses the root cause of transformation errors (timeouts), and configuring a backup S3 bucket for failed records ensures no data loss. Kinesis Data Firehose can be configured to send failed records to a separate S3 bucket as a dead-letter queue, which preserves the data for later reprocessing while the primary transformation pipeline is fixed.

Answer

Enable Amazon CloudWatch Logs for the Lambda function to capture errors and store failed records in CloudWatch

Answer

Configure the Lambda function to write failed records to an Amazon SQS queue for later reprocessing

Answer

Modify the Lambda function to store failed records in Amazon S3 before processing

Question 3

A company needs to ingest data from a MySQL database into Amazon S3 in near real-time. The database is running on EC2. The data engineer wants to minimize the impact on the source database. Which service should be used?

Accepted Answer

AWS Database Migration Service (DMS) with ongoing replication. AWS DMS with ongoing replication (change data capture) is the correct choice because it can continuously replicate changes from a MySQL source database to Amazon S3 with minimal performance impact. DMS uses a transactional log-based approach (MySQL binlog) to capture changes as they occur, avoiding heavy SELECT queries on the source. This enables near real-time ingestion without adding significant load to the production database.

Answer

AWS Glue ETL job with a JDBC connection

Answer

Amazon RDS for MySQL with read replica

Answer

AWS Schema Conversion Tool (SCT)

Question 4

A company uses Amazon EMR to process large datasets stored in Amazon S3. The cluster uses a transient configuration and stores intermediate data on HDFS. After a job fails due to a spot instance termination, the data engineer needs to rerun the job. What should the engineer do to minimize data loss and cost?

Accepted Answer

Configure the cluster with a mix of spot and on-demand instances and set HDFS replication to 3.. Using a mix of spot and on-demand instances balances cost savings with fault tolerance, while setting HDFS replication to 3 ensures that intermediate data on HDFS survives the loss of a single node (e.g., a terminated spot instance). This allows the job to resume from the last checkpoint or reduce recomputation, minimizing both data loss and cost.

Answer

Use a long-running cluster with all on-demand instances to avoid interruptions.

Answer

Configure the cluster to use EMRFS and store intermediate data in S3.

Answer

Increase the HDFS replication factor to 5 and use only spot instances.

Question 5

A financial services company stores transaction data in Amazon RDS for PostgreSQL. The company requires that all changes to the database be logged for audit purposes, including before and after images of updated rows. Which feature should the data engineer enable?

Accepted Answer

Set up logical replication using pglogical or native publication/subscription. Logical replication, using either pglogical or native PostgreSQL publication/subscription, captures row-level changes (INSERT, UPDATE, DELETE) and can include both the old and new values of updated rows. This meets the audit requirement for before-and-after images, as logical replication decodes the write-ahead log (WAL) to produce a change stream that includes full row snapshots.

Answer

Enable automated backups and export logs to Amazon S3

Answer

Enable Enhanced Monitoring and publish logs to CloudWatch Logs

Answer

Enable Multi-AZ deployment and read replicas

Question 6

Your company runs a critical data processing pipeline that ingests data from multiple sources into an Amazon S3 bucket. An AWS Glue ETL job processes this data and writes the output to an Amazon Redshift cluster. The pipeline is triggered by an S3 event notification that invokes an AWS Lambda function, which starts the Glue job. Recently, you have observed that the Glue job occasionally fails with an AccessDenied error when trying to access the S3 bucket. The IAM role used by the Glue job has the following policy: { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:ListBucket" ], "Resource": [ "arn:aws:s3:::input-bucket", "arn:aws:s3:::input-bucket/*" ] }, { "Effect": "Allow", "Action": [ "redshift:CopyData" ], "Resource": "*" } ] }. The S3 bucket has a bucket policy that allows access only from a specific VPC. The Glue job runs in a VPC with the appropriate VPC endpoints configured. The error occurs intermittently and sometimes retries succeed. What is the most likely cause and correct course of action?

Accepted Answer

Add a VPC endpoint for S3 and configure the bucket policy to allow access from the Glue job's VPC endpoint.. The Glue job intermittently fails with AccessDenied when accessing the S3 bucket because the bucket policy restricts access to requests originating from a specific VPC endpoint. Although the Glue job runs in a VPC, it does not automatically route S3 traffic through the VPC endpoint; it may use the internet or a different endpoint. The intermittent success occurs when requests happen to come from the allowed endpoint. To resolve this, ensure the Glue job's VPC configuration includes a VPC endpoint for S3, and update the bucket policy to allow access from that endpoint. Option B is incorrect because a NAT gateway would route traffic through the internet, which may be denied by the bucket policy. Option C is incorrect because the Lambda function's IAM role does not affect the Glue job's access. Option D is incorrect because the error is about reading from the input bucket, not writing to the output bucket, and the IAM role already has the necessary S3 permissions.

Answer

Ensure the Glue job's VPC configuration includes a NAT gateway to route traffic to S3.

Answer

Change the Lambda function to use a different IAM role with broader S3 permissions.

Answer

Modify the Glue job's IAM role to include s3:PutObject permission for the output bucket.

Question 7

A data engineer needs to store archival data that is rarely accessed but must be retained for 7 years. The data should be retrievable within 12 hours. Which Amazon S3 storage class is MOST cost-effective?

Accepted Answer

S3 Glacier Deep Archive. S3 Glacier Deep Archive is the most cost-effective storage class for archival data that is rarely accessed and requires a 7-year retention period, with retrieval times up to 12 hours. It offers the lowest storage cost among S3 classes, making it ideal for long-term retention of data that does not need immediate access.

Answer

S3 Intelligent-Tiering

Answer

S3 Glacier Flexible Retrieval

Answer

S3 Standard

Question 8

A data pipeline uses Amazon Kinesis Data Firehose to ingest log data from web servers and deliver it to Amazon S3. The data is then transformed by an AWS Glue job before being loaded into Amazon Redshift. The pipeline must handle a sudden spike in log volume without data loss. Which configuration change is MOST appropriate?

Accepted Answer

Configure Kinesis Data Firehose to back up all data to S3 in case of delivery failures.. Kinesis Data Firehose can be configured to back up all data to Amazon S3 in case of delivery failures, ensuring no data loss during spikes. This feature writes incoming data to a separate S3 bucket as a safety net when the primary destination (e.g., Redshift via Glue) is unavailable or overwhelmed, directly addressing the requirement to handle sudden volume spikes without data loss.

Answer

Increase the AWS Glue job timeout and allocate more DPUs.

Answer

Increase the number of nodes in the Redshift cluster to handle higher load.

Answer

Increase the S3 bucket size limit and enable versioning.

Question 9

A data engineer is troubleshooting a failed AWS Glue ETL job. The job reads from an S3 bucket and writes to an RDS MySQL database. The job fails with an 'Access Denied' error when trying to write to RDS. What is the most likely cause?

Accepted Answer

The IAM role associated with the Glue job does not have the necessary permissions to write to the RDS instance.. The error 'Access Denied' when writing to RDS indicates that the AWS Glue job's IAM role lacks the necessary permissions (e.g., rds-db:connect, or specific database-level GRANTs) to perform write operations on the RDS MySQL instance. AWS Glue uses the attached IAM role to authenticate and authorize actions against AWS services, and without proper IAM policies allowing access to the RDS resource, the write attempt is denied.

Answer

The Glue job is running in a VPC without a route to the internet.

Answer

The S3 bucket policy does not allow the Glue job to read the data.

Answer

The RDS instance is encrypted with a KMS key that the Glue job cannot access.

Question 10

A data engineer needs to store semi-structured JSON files that are accessed infrequently but must be retrievable within minutes. The data should be stored cost-effectively. Which storage solution meets these requirements?

Accepted Answer

Amazon S3 Standard-Infrequent Access (S3 Standard-IA) storage class.. Amazon S3 Standard-Infrequent Access (S3 Standard-IA) is the correct choice because it is designed for data accessed infrequently but requires rapid retrieval (within milliseconds). It offers lower storage costs than S3 Standard while maintaining low-latency access, meeting the requirement of retrievability within minutes cost-effectively.

Answer

Amazon S3 Glacier Flexible Retrieval storage class.

Answer

Amazon S3 Glacier Deep Archive storage class.

Answer

Amazon S3 Standard storage class.

Question 11

A data engineer is monitoring an Amazon Kinesis Data Analytics for Apache Flink application that processes streaming data. The application is falling behind (increasing 'MillisBehindLatest') and the CPU utilization of the Flink task managers is consistently above 80%. Which THREE actions should the engineer take to improve performance? (Choose THREE.)

Accepted Answer

Increase the number of shards in the Kinesis data stream.. Increasing the number of shards in the Kinesis data stream (Option A) directly increases the ingestion capacity and parallelism source for the Flink application. With more shards, the application can read data from more partitions concurrently, reducing the backlog indicated by 'MillisBehindLatest'. This is a fundamental scaling action for Kinesis-based Flink applications.

Answer

Decrease the checkpoint interval to reduce state size.

Answer

Decrease the number of task managers to reduce CPU contention.

Question 12

A data engineer is designing a data lake on Amazon S3. The data is accessed frequently for the first 30 days, then rarely accessed after 90 days, and must be archived after 1 year. Which S3 lifecycle policy configuration meets these requirements with the lowest cost?

Accepted Answer

Transition to S3 Standard-IA after 30 days, then to S3 Glacier Deep Archive after 365 days.. It transitions data to S3 Standard-IA after 30 days (when frequent access drops), then to S3 Glacier Deep Archive after 365 days for archival, minimizing cost while meeting all access patterns. Standard-IA offers lower storage cost than Standard for infrequent access, and Glacier Deep Archive is the cheapest storage class for long-term archival.

Answer

Transition to S3 One Zone-IA after 30 days, then to S3 Glacier Deep Archive after 365 days.

Answer

Transition to S3 Glacier Flexible Retrieval after 90 days.

Answer

Transition to S3 Glacier Instant Retrieval after 30 days, then expire after 365 days.

Question 13

A company is migrating a large Oracle data warehouse to Amazon Redshift. Which THREE considerations are important for optimizing the Redshift cluster?

Accepted Answer

Defining appropriate sort keys for the tables.. Sort keys in Amazon Redshift determine the physical order of data on disk, which directly impacts the efficiency of range-restricted queries and compression. By defining appropriate sort keys (compound or interleaved), the query optimizer can use zone maps to skip large blocks of data that don't match the filter criteria, significantly reducing the number of blocks scanned and improving query performance.

Answer

Purchasing reserved instances for the cluster.

Answer

Using columnar storage format.

Question 14

A company uses Amazon S3 to store sensitive documents. The security team has mandated that all objects must be encrypted at rest using server-side encryption with AWS KMS (SSE-KMS). Additionally, the company wants to ensure that any attempt to upload an unencrypted object is denied. A data engineer has configured a bucket policy that denies PutObject if the encryption header does not include x-amz-server-side-encryption: aws:kms. However, the engineer notices that some objects are still being stored without encryption. Upon investigation, the engineer suspects that the policy is not being evaluated correctly. What should the engineer do to ensure that all objects are encrypted with SSE-KMS?

Accepted Answer

Enable default encryption on the S3 bucket with SSE-KMS.. Enabling default encryption on the S3 bucket with SSE-KMS ensures that any object uploaded without an explicit encryption header is automatically encrypted with SSE-KMS. This closes the gap where the bucket policy condition fails to catch uploads that omit the `x-amz-server-side-encryption` header entirely, as the policy only denies requests with an incorrect header but does not block requests that lack the header altogether. Default encryption applies server-side encryption at the bucket level, making it impossible to store an unencrypted object.

Answer

Use an IAM policy to require encryption instead of a bucket policy.

Answer

Enable S3 Block Public Access settings.

Answer

Add a condition to the bucket policy that checks for aws:SourceVpce.

Question 15

A company stores sensitive data in Amazon S3. They need to ensure that all objects are encrypted at rest. Which approach meets this requirement with minimal effort?

Accepted Answer

Enable default encryption on the S3 bucket with SSE-S3. Enabling default encryption on an S3 bucket with SSE-S3 (Server-Side Encryption with S3-Managed Keys) automatically encrypts all objects at rest using AES-256, with no additional effort from the user. This ensures that any object uploaded without explicit encryption headers is encrypted by default, meeting the requirement with minimal configuration overhead.

Answer

Use client-side encryption before uploading

Answer

Enable S3 Versioning and MFA Delete

Answer

Use a bucket policy to deny PutObject without encryption

Question 16

Refer to the exhibit. An IAM policy is attached to a user. The user cannot upload objects to the S3 bucket 'example-bucket' using the AWS CLI. What is the most likely cause?

Accepted Answer

The user is not using HTTPS for API calls. The IAM policy explicitly denies all actions unless the request uses HTTPS (via the `aws:SecureTransport` condition key). Since the AWS CLI by default can use HTTP if not explicitly configured to use HTTPS, the user's upload attempt fails. The `s3:PutObject` action is allowed in the policy, but the condition block overrides that permission when the request is not made over HTTPS.

Answer

The policy does not allow s3:PutObject

Answer

The user is not in the same AWS region

Answer

The resource ARN does not include the bucket itself

Question 17

A data engineer needs to audit all access to an S3 bucket containing sensitive customer data. The engineer must record the requester, timestamp, action, and whether the access was denied. Which AWS solution meets these requirements?

Accepted Answer

Enable S3 server access logs for the bucket, storing them in a different bucket.. S3 server access logs capture detailed records of requests made to a bucket, including the requester, timestamp, action, and response status (e.g., whether the access was denied). These logs are stored in a designated target bucket and are specifically designed for auditing access requests. Option A is incorrect because AWS Config tracks configuration changes, not individual access requests. Option B is incorrect because VPC Flow Logs capture IP traffic metadata, not application-level S3 operations. Option C is incorrect because while AWS CloudTrail can log object-level events when Data Events are enabled, S3 server access logs are purpose-built for this auditing requirement and provide granular details out of the box without additional setup or cost beyond logging.

Answer

Use AWS Config to record S3 bucket-level configuration changes.

Answer

Enable VPC Flow Logs for the VPC where the bucket resides.

Answer

Enable AWS CloudTrail Data Events for the S3 bucket.

Question 18

A data engineer is designing a data pipeline that processes streaming data. The pipeline must be able to handle duplicate records and ensure exactly-once processing semantics. Which THREE AWS services or features should the engineer consider? (Choose three.)

Accepted Answer

Amazon EMR with Apache Flink for exactly-once semantics.. The three correct options are A, C, and E. Option A (Amazon EMR with Apache Flink) supports exactly-once processing semantics through checkpointing and fault tolerance. Option C (Amazon Kinesis Data Streams with sequence numbers) enables deduplication to achieve exactly-once processing. Option E (Amazon Kinesis Data Analytics for Apache Flink with idempotent sinks) ensures exactly-once delivery by recognizing and ignoring duplicates. Options B and D are incorrect: Amazon Kinesis Data Firehose provides at-least-once delivery, and Amazon DynamoDB Streams also provides at-least-once delivery, not exactly-once semantics.

Answer

Amazon Kinesis Data Firehose with automatic retries.

Answer

Amazon DynamoDB Streams for change data capture.

Question 19

A company runs an e-commerce platform on AWS. The product catalog is stored in Amazon DynamoDB with a table that has a partition key of 'product_id' and a sort key of 'category'. The application frequently queries products by category and by product_id. Recently, the operations team noticed that read latency has increased significantly for queries that filter by category. The DynamoDB table has auto scaling enabled. The data engineer examines the CloudWatch metrics and sees that the ReadThrottleEvents metric is non-zero for the table, but the consumed read capacity is well below the provisioned limit. The table has a global secondary index (GSI) on the 'category' attribute. Which action is most likely to resolve the latency issue?

Accepted Answer

Redesign the GSI partition key to include a random suffix to distribute load across multiple partitions.. The issue is that the GSI on 'category' is experiencing hot partitions because 'category' has low cardinality, causing uneven data distribution. The non-zero ReadThrottleEvents on the GSI (not the main table) indicate throttling on the GSI's provisioned capacity, even though the main table's consumed read capacity is below its limit. Adding a random suffix to the GSI partition key distributes reads across multiple physical partitions, reducing hot spots and latency.

Answer

Switch the table to DynamoDB on-demand capacity mode.

Answer

Enable DynamoDB Accelerator (DAX) to cache read queries.

Answer

Increase the provisioned read capacity on the main table.

Question 20

A data engineer needs to ensure that a Redshift cluster can recover from a failure with minimal data loss. The cluster is used for reporting and can tolerate a few minutes of downtime. Which feature should the engineer enable?

Accepted Answer

Enable automated snapshots with a retention period of 1 day.. Automated snapshots in Amazon Redshift are taken at regular intervals (default every 8 hours or 5 GB of data changes) and retained for a specified period. Enabling automated snapshots with a retention period of 1 day ensures that, in the event of a failure, the cluster can be restored to the most recent snapshot, minimizing data loss to at most the snapshot interval. This aligns with the requirement for minimal data loss and tolerance for a few minutes of downtime, as restoring from a snapshot takes time but preserves recent data.

Answer

Configure cross-region snapshot copy.

Answer

Take manual snapshots every hour.

Answer

Enable Multi-AZ deployment.