DEA-C01 Mock Exam 74 — 25 Questions

Question 1

A data engineer is building an AWS Lambda function that processes records from an Amazon Kinesis data stream. The Lambda function needs to read from the stream and write processed data to an Amazon S3 bucket. The security team requires that all data in transit be encrypted using TLS, and that the Lambda function authenticate to Kinesis and S3 using temporary credentials. Which combination of configurations should the engineer use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Assign an IAM role to the Lambda function with permissions for Kinesis and S3, and use the AWS SDK for Python (Boto3) to read and write data, relying on the SDK's default TLS.. AWS Lambda functions use an IAM role to obtain temporary credentials automatically. The AWS SDKs, such as Boto3, use TLS for all API calls by default, ensuring encryption in transit. This combination satisfies both the authentication and encryption requirements without manual key management. Other options either use long-term credentials, confuse encryption at rest with in transit, or use an inappropriate identity service.

Answer

Store long-term IAM user access keys in Lambda environment variables, and use them to sign requests to Kinesis and S3 over HTTPS.

Answer

Configure the Lambda function to use AWS KMS to encrypt the data before sending it to Kinesis and S3, and use an IAM role for authentication.

Answer

Use Amazon Cognito identity pools to provide temporary credentials to the Lambda function, and enable TLS on the Kinesis and S3 clients.

Question 2

A data engineer manages an Amazon DynamoDB table that stores IoT sensor readings. Each item has a partition key of deviceId and a sort key of timestamp. The table is configured with on-demand capacity mode. The engineer needs to retrieve all readings for a specific device within the last 24 hours, and the query must return results sorted by timestamp in ascending order. Which operation should the engineer use?

Accepted Answer

Call the Query API with the partition key value and a condition on the sort key using the BETWEEN operator.. The Query API is designed for efficient retrieval of items sharing a partition key, with optional sort key conditions. Using BETWEEN on the timestamp sort key retrieves exactly the last 24 hours of readings for a device. Results are automatically sorted by the sort key, meeting the ascending order requirement. Scan, GetItem, and BatchGetItem do not provide this combination of range filtering and sorted output.

Answer

Call the GetItem API with the partition key and sort key values.

Answer

Call the Scan API with a FilterExpression on deviceId and timestamp.

Answer

Call the BatchGetItem API with a list of partition and sort key pairs.

Question 3

A data engineer must load data from an Amazon S3 bucket into an Amazon Redshift cluster as part of a nightly batch pipeline. The source files are already in Parquet format and include columns that map directly to the target table. The engineer wants the fastest, most cost-effective load method that avoids staging the data through an external service. Which command should the engineer use?

Accepted Answer

COPY command referencing the S3 bucket with an IAM role.. The COPY command performs a parallel bulk load directly from Amazon S3 into Redshift, using an IAM role for secure access. Because the Parquet files already match the target table, no intermediate transformation is required, making COPY the fastest and most economical option. Scripted inserts, Glue, and Spectrum add overhead or serve different purposes.

Answer

Redshift Spectrum external table query that selects from S3 into the target table.

Answer

INSERT statements generated from a Python script that reads the Parquet files.

Answer

AWS Glue ETL job that reads from S3 and writes to Redshift using the Spark connector.

Question 4

A data engineer is configuring cross-account access so that an analytics AWS account can read objects from a data-lake S3 bucket in a producer account. The objects are encrypted with SSE-KMS using a customer managed key in the producer account. The engineer has already added a bucket policy granting s3:GetObject to the analytics account's IAM role. Reads still fail with AccessDenied. Which additional change is required?

Accepted Answer

Attach an IAM policy to the analytics role allowing kms:Decrypt and kms:DescribeKey, and update the KMS key policy to allow the analytics account role to use the key.. Reading SSE-KMS objects across accounts needs authorization on both sides: the identity must be allowed kms:Decrypt and the KMS key policy must trust that identity. A bucket policy granting s3:GetObject is necessary but not sufficient, because S3 calls KMS to unwrap the object's data key, and KMS independently evaluates its key policy. Both the identity policy and key policy must permit the analytics role.

Answer

Add s3:GetObjectVersion to the analytics role's IAM policy and include the s3:ExistingObjectTag condition in the bucket policy.

Answer

Enable S3 Block Public Access on the data-lake bucket and re-run the cross-account read.

Answer

Change the bucket's default encryption to SSE-S3 so that cross-account readers no longer need KMS permissions.

Question 5

A data engineer is designing a data lake on Amazon S3 and needs to store data in a format that supports schema evolution and efficient columnar storage. The data will be queried using Amazon Athena and Amazon Redshift Spectrum. The engineer wants to minimize storage costs and improve query performance. Which storage format should the engineer choose?

Accepted Answer

Apache Parquet. Apache Parquet is a columnar format that offers high compression and efficient encoding, reducing storage costs and enabling fast query performance through column pruning and predicate pushdown. It supports schema evolution and is well-integrated with Athena and Redshift Spectrum, making it the best choice.

Answer

Apache Avro

Answer

CSV

Answer

JSON

Question 6

A financial services company stores transactional records in Amazon DynamoDB. Auditors require that any item be recoverable to its exact state from any point within the last 30 days, including after an accidental delete or overwrite caused by a faulty deployment. The table uses on-demand capacity and must remain highly available during recovery. Which feature should the data engineer enable?

Accepted Answer

DynamoDB point-in-time recovery (PITR). DynamoDB point-in-time recovery maintains a continuous backup with per-second granularity and supports restore to any moment within the preceding 35 days, which exceeds the 30-day audit window. Because it captures every write and delete, a faulty deployment that corrupts or removes items can be undone by restoring to a timestamp just before the incident. The restore produces a new table, so the production table stays available throughout.

Answer

DynamoDB global tables with multi-Region replication

Answer

DynamoDB on-demand backups

Answer

DynamoDB Streams with an AWS Lambda consumer writing to Amazon S3

Question 7

A data engineer must give an AWS Lambda function temporary credentials to read objects from a specific Amazon S3 prefix. The function runs in a VPC and accesses S3 through a gateway VPC endpoint. The security team forbids long-lived access keys on the function. What should the data engineer configure?

Accepted Answer

Attach an IAM role to the Lambda function with an S3 read policy scoped to the prefix, and add an S3 bucket policy restricting access to the gateway VPC endpoint.. Lambda execution roles supply temporary credentials automatically, eliminating static keys while allowing a policy scoped to the required prefix. Combining that with a bucket policy that permits access only through the gateway VPC endpoint keeps the data path private and prevents access from outside the approved network route.

Answer

Store an IAM user's access key ID and secret access key in Lambda environment variables and rotate them monthly.

Answer

Use the Lambda function's reserved concurrency setting to limit access, and allow S3 access through the VPC endpoint policy only.

Answer

Create an IAM user and store the credentials in AWS Secrets Manager, then call the secret at runtime from Lambda.

Question 8

A data engineer is using AWS Lake Formation to manage fine-grained access control on an Amazon S3 data lake. The engineer has registered the S3 bucket as a Lake Formation data location and created a table in the AWS Glue Data Catalog. The engineer needs to grant a data analyst permission to query only specific columns (customer_id, order_date) in the sales table using Amazon Athena, while hiding other columns (credit_card_number, address). The analyst uses an IAM role that has no direct S3 permissions. Which action should the engineer take?

Accepted Answer

Grant the analyst's IAM role SELECT permission on the sales table in Lake Formation, and then use Lake Formation column-level security to include only the customer_id and order_date columns.. Lake Formation column-level security is designed to grant SELECT on specific columns while hiding others. By granting SELECT on the table and then specifying included columns, the analyst can query only those columns. Because the analyst's IAM role lacks direct S3 permissions, all data access goes through Lake Formation, which enforces the column restrictions and provides temporary credentials. This meets the requirement without granting broad S3 access.

Answer

Create an IAM policy that allows s3:GetObject on the sales table's S3 prefix, and attach it to the analyst's role. Then use Athena to restrict columns via a view.

Answer

Use AWS Glue DataBrew to create a dataset that includes only the allowed columns, and grant the analyst access to that dataset.

Answer

Grant the analyst's IAM role DESCRIBE and SELECT on the sales table in Lake Formation, and then create an Athena view that selects only the allowed columns.

Question 9

A data engineer manages an Amazon S3 data lake with a bucket that has S3 Versioning enabled. A downstream analytics job accidentally overwrites thousands of current objects with corrupted data. The engineer must restore the previous good versions quickly and prevent the corrupted versions from being served. Which action should the engineer take?

Accepted Answer

Restore the previous good versions by copying them to overwrite the corrupted current versions. S3 Versioning retains the prior object version on every overwrite, so the good data still exists as a noncurrent version. Copying that version back to the same key creates a new current version with the correct content, immediately restoring what consumers read while preserving history. Deleting versions, removing delete markers, or enabling Object Lock do not perform this rollback and may cause data loss or fail to address overwrites.

Answer

Delete the corrupted object versions so the previous versions become current

Answer

Remove the delete markers and re-upload the original files from a local backup

Answer

Enable S3 Object Lock in governance mode on the bucket to roll back the changes

Question 10

A data engineer needs to run a daily AWS Glue ETL job that transforms data in Amazon S3. The job must start at 2:00 AM UTC every day. The engineer wants to minimize operational overhead and ensure the job runs reliably. Which approach should the engineer use?

Accepted Answer

Create an AWS Glue trigger of type 'Schedule' with a cron expression '0 2 * * ? *' and attach it to the job.. AWS Glue provides built-in schedule triggers that use cron expressions to start jobs at specified times. Creating a trigger with the cron expression '0 2 * * ? *' and attaching it to the job is the simplest, most reliable method. It requires no additional services, reducing operational overhead and potential failure points, while ensuring the job runs daily at 2:00 AM UTC.

Answer

Configure an AWS Lambda function with a CloudWatch Events rule to start the Glue job daily at 2:00 AM UTC.

Answer

Use Amazon EventBridge to create a rule with a cron expression '0 2 * * ? *' that targets the AWS Glue job.

Answer

Use AWS Step Functions with a Wait state to delay execution until 2:00 AM UTC and then start the Glue job.

Question 11

A company stores customer transaction data in an Amazon DynamoDB table. The table has a partition key of CustomerID and a sort key of TransactionDate. The data engineering team needs to retrieve all transactions for a specific customer within a date range, and the queries must be efficient. Which DynamoDB operation should the team use?

Accepted Answer

Query the table with a KeyConditionExpression on CustomerID and a condition on TransactionDate.. The Query operation is designed to retrieve items sharing the same partition key value, with optional conditions on the sort key. By specifying CustomerID and a condition on TransactionDate, the team can efficiently fetch the desired transactions. Other operations either scan the entire table or retrieve single items, which are less efficient for this use case.

Answer

Scan the table with a FilterExpression on CustomerID and TransactionDate.

Answer

Use a BatchGetItem request with multiple CustomerID and TransactionDate pairs.

Answer

Use a GetItem request with the CustomerID and TransactionDate as the primary key.

Question 12

A data engineer is configuring an Amazon Redshift cluster for a reporting workload. The team needs to load data from Amazon S3 into a Redshift table and wants the fastest possible load while keeping the data compressed. Which approach should the engineer use?

Accepted Answer

Use the COPY command to load data from S3 into the Redshift table, specifying the appropriate compression and format options.. Amazon Redshift COPY is purpose-built for bulk ingestion from Amazon S3. It distributes the read across all compute slices in parallel, supports compressed and columnar formats, and applies options that validate and transform data during load. Alternatives such as row inserts, JDBC batching, or Spectrum materialization add layers that reduce throughput, so COPY remains the fastest supported method.

Answer

Run individual INSERT statements for each row from an AWS Lambda function that reads the S3 objects.

Answer

Create an AWS Glue job that writes to Redshift using JDBC in small batches and commits after each batch.

Answer

Use Redshift Spectrum to create an external table over the S3 data and run CREATE TABLE AS SELECT to materialize it.

Question 13

A data engineer is designing an AWS Glue ETL job that reads from an Amazon S3 bucket containing nested JSON files. The job must flatten the nested structures and write the output to Amazon Redshift. The engineer needs to ensure the job can handle schema evolution and efficiently process only new data on subsequent runs. (Choose two.)

Accepted Answer

Use the AWS Glue Relationalize transform to flatten nested JSON structures.. Enabling job bookmarks ensures that only new data is processed on subsequent runs, which is essential for incremental ETL. The Relationalize transform flattens nested JSON into relational tables, making the data compatible with Amazon Redshift. Together, these two features address the requirements for incremental processing and flattening nested structures.

Answer

Configure the job to use the 'ApplyMapping' transform to rename nested fields.

Answer

Use the 'ResolveChoice' transform to handle data type conflicts in nested fields.

Answer

Set the job's maximum concurrency to 1 to prevent schema conflicts.

Question 14

A data engineer is using AWS Step Functions to orchestrate a series of AWS Glue jobs. The engineer notices that when a Glue job fails, the Step Functions execution also fails, but the engineer wants to retry the failed job up to three times with exponential backoff before failing the entire workflow. The engineer needs to implement this with minimal changes to the state machine. What should the engineer do?

Accepted Answer

Add a Retry field with MaxAttempts: 3 and BackoffRate: 2.0 to the state that invokes the Glue job.. AWS Step Functions provides native retry capabilities via the Retry field in the state definition. Specifying MaxAttempts and BackoffRate on the state that calls the Glue job enables automatic retries with exponential backoff. This is the simplest and most direct method to meet the requirement without altering the Glue job or adding external components.

Answer

Configure the Glue job to automatically retry on failure by setting the MaxRetries parameter in the job's default arguments.

Answer

Create an Amazon CloudWatch alarm that triggers an AWS Lambda function to restart the Glue job on failure.

Answer

Modify the state machine to use a Map state that iterates over the Glue job three times.

Question 15

A data engineer is configuring an AWS Glue ETL job to read data from an Amazon S3 bucket that contains nested JSON files. The job must flatten the nested structure and write the output to Amazon Redshift. The engineer wants to optimize the job for performance and cost. Which two actions should the engineer take? (Choose two.)

Accepted Answer

Enable job bookmarks to track processed data and avoid reprocessing.. The Relationalize transform is purpose-built to flatten nested JSON, simplifying the ETL code and improving performance. Enabling job bookmarks ensures that only new or changed data is processed on subsequent runs, reducing cost and runtime. Together, these actions optimize the job for both performance and cost. The other options either do not address flattening, are not cost-effective, or misunderstand service capabilities.

Answer

Increase the number of DPUs to the maximum allowed to ensure faster execution.

Answer

Convert the JSON files to Parquet using an AWS Glue crawler before running the ETL job.

Answer

Use the AWS Glue ResolveChoice transform to handle data type conflicts.

Question 16

A data engineer runs an AWS Glue job that reads Parquet files from Amazon S3 partitioned by year/month/day and writes to another S3 prefix. The job currently processes all historical partitions on every run, causing long runtimes and high cost. The engineer wants subsequent runs to process only new data. Which configuration should the engineer apply?

Accepted Answer

Enable AWS Glue job bookmarks and ensure the job's source and target paths are stable across runs.. Job bookmarks maintain persistent state across runs, allowing Glue to skip files and partitions that were already processed in prior executions. This is the native mechanism for incremental processing in Glue ETL, directly reducing scanned data, runtime, and cost without changing the transformation logic or adding external state tracking.

Answer

Configure an S3 Lifecycle rule to transition old partitions to S3 Glacier Instant Retrieval so the Glue job reads them faster.

Answer

Increase the number of AWS Glue DPUs allocated to the job so it can process all partitions faster.

Answer

Set the Glue job's MaxConcurrentRuns parameter to 1 to prevent overlapping executions from reprocessing data.

Question 17

A data engineer manages an Amazon S3 data lake with millions of small JSON files. To improve query performance with Amazon Athena, the engineer wants to compact these files into larger Parquet files. The engineer must also minimize ongoing storage costs. Which solution should the engineer implement?

Accepted Answer

Use AWS Glue ETL jobs to read the JSON files, transform them to Parquet, and write the output to a new S3 prefix. Then, configure an S3 Lifecycle rule to expire the original JSON objects after a retention period.. Converting JSON to Parquet with AWS Glue ETL compacts files and enables columnar storage, which improves Athena query performance. Writing to a new prefix and using an S3 Lifecycle rule to expire original JSON files after a retention period reduces storage costs while preserving data integrity. This combination addresses both performance and cost requirements.

Answer

Create an AWS Lambda function that triggers on each S3 PUT event to merge JSON files into larger files.

Answer

Use Amazon Kinesis Data Firehose to stream the JSON files into Parquet format in real time.

Answer

Enable S3 Transfer Acceleration on the bucket to speed up read operations for Athena queries.

Question 18

A media company stores millions of small JSON files in an Amazon S3 bucket and queries them with Amazon Athena. Analysts report that queries scan far more data than expected, and costs are rising. The data engineer confirms that the files are uncompressed, use no partitioning, and are stored as newline-delimited JSON. Which change will MOST reduce the data scanned per query?

Accepted Answer

Convert the files to Apache Parquet, compress with Snappy, and partition the S3 prefix by event date.. Converting to a columnar format, compressing with a splittable codec, and partitioning by a common filter column collectively minimize bytes read. Parquet enables column pruning, Snappy reduces stored size, and date partitioning enables partition pruning so only relevant prefixes are read. This combination produces the largest reduction in data scanned and therefore in Athena query cost.

Answer

Add more small files to increase parallelism across Athena workers.

Answer

Enable S3 Transfer Acceleration on the bucket.

Answer

Increase the Athena workgroup's data usage control limit.

Question 19

A company ingests application logs into Amazon S3 through Amazon Kinesis Data Firehose. The logs arrive as newline-delimited JSON, and analysts query them with Amazon Athena. Query performance is poor because the JSON files are small and uncompressed. The engineer must improve Athena query performance while keeping the raw JSON available for a downstream legacy system. Which change should the engineer make?

Accepted Answer

Add a Firehose record format conversion to Apache Parquet and keep the raw JSON in a separate S3 prefix using a second delivery stream.. Athena performance improves when it scans less data, and converting the stream to Parquet with a record format conversion makes the stored objects columnar and compressed. A second delivery stream that leaves the raw JSON in place satisfies the legacy consumer, so the engineer gets both performance and compatibility.

Answer

Enable S3 Transfer Acceleration on the target bucket to speed up Athena scans.

Answer

Configure the Athena table with a SerDe for JSON and add a WHERE clause on the timestamp column in every query.

Answer

Increase the Firehose buffer size and interval so larger objects are delivered to S3.

Question 20

A company stores sensitive financial data in Amazon S3 and requires that all data be encrypted at rest using customer-managed keys. A data engineer configures the S3 bucket to use SSE-KMS with a customer-managed KMS key. The security team now wants to audit all API calls that use the KMS key to decrypt data. Which AWS service should the engineer use to capture and review these KMS API calls?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the service that records API activity in your AWS account, including KMS operations. By enabling CloudTrail, you can audit who used the KMS key and when. AWS Config, CloudWatch Logs, and Trusted Advisor do not provide the same level of API call logging for KMS.

Answer

AWS Config

Answer

AWS Trusted Advisor

Answer

Amazon CloudWatch Logs