DEA-C01 Mock Exam 75 — 25 Questions

Question 1

A company stores sensitive data in Amazon S3 and uses AWS KMS customer-managed keys for encryption. The security team wants to monitor and audit all KMS API calls that involve the key, including who used the key and when. They also want to receive alerts if the key is used by an unauthorized principal. Which AWS service should the data engineer use to meet these requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS CloudTrail with KMS key usage logs, and Amazon CloudWatch alarms based on CloudTrail metrics.. AWS CloudTrail logs all KMS API calls, providing a detailed audit trail. To receive alerts on unauthorized usage, you can create CloudWatch metric filters on CloudTrail logs and set up CloudWatch alarms. This combination meets both the auditing and alerting requirements. Other services like AWS Config, GuardDuty, or Security Hub do not provide the same level of detailed API call logging and direct alerting for KMS usage.

Answer

Amazon GuardDuty with KMS protection, and AWS Lambda functions to remediate unauthorized access.

Answer

AWS CloudTrail with KMS key usage logs, and AWS Security Hub for automated alerts on unauthorized access.

Answer

AWS Config with KMS key configuration rules, and Amazon SNS notifications for noncompliance.

Question 2

A data engineer is managing an Amazon Kinesis Data Firehose delivery stream that writes to an Amazon S3 bucket. The engineer notices that some records are being delivered to the S3 bucket with a prefix of 'errors/' instead of the intended 'data/' prefix. The Firehose stream is configured with an AWS Lambda function for data transformation, and the S3 bucket has a lifecycle policy that transitions objects to Glacier after 30 days. Which TWO actions should the engineer take to ensure that only successfully transformed records are delivered to the 'data/' prefix and that failed records are handled appropriately? (Choose two.)

Accepted Answer

Specify an error prefix in the Firehose stream's S3 destination configuration so that failed records are delivered to a separate prefix.. To ensure only successful records go to the 'data/' prefix, the Lambda function must return a 'result' of 'Ok' for successful transformations and 'Dropped' or 'ProcessingFailed' for failures. Additionally, configuring an error prefix in the Firehose S3 destination directs failed records to a separate 'errors/' prefix. Together, these actions segregate successful and failed records correctly.

Answer

Enable the 'S3 backup' setting in the Firehose stream to back up all incoming records to a separate S3 bucket before transformation.

Answer

Increase the Firehose stream's buffer size and buffer interval to reduce the number of failed records.

Answer

Configure the Firehose stream's S3 destination to use a dynamic prefix based on the record's result status, such as 'data/' for success and 'errors/' for failure.

Question 3

A data engineer is using AWS Glue to transform data from an Amazon S3 bucket. The Glue job reads JSON files, applies complex transformations, and writes the output to another S3 bucket in Parquet format. The job runs daily and must complete within a 2-hour window. The engineer notices that the job is taking longer than expected and wants to optimize performance. The source data is partitioned by date, and the job uses a dynamic frame. Which optimization should the engineer implement to improve performance?

Accepted Answer

Use pushdown predicates to filter data at the source based on partition columns.. Pushdown predicates enable AWS Glue to filter data at the source based on partition columns, significantly reducing the amount of data read from S3. Since the data is partitioned by date, specifying a predicate for the desired date range ensures only relevant partitions are processed, leading to faster job completion and lower cost. This is a targeted optimization that addresses the performance bottleneck without unnecessary resource scaling.

Answer

Increase the number of DPUs allocated to the Glue job.

Answer

Enable job bookmarks to track processed data and avoid reprocessing.

Answer

Convert the dynamic frame to a Spark DataFrame and use Spark SQL for transformations.

Question 4

A data engineer is building a governed data lake in AWS Lake Formation. The security team wants to detect sensitive data such as credit card numbers in newly registered S3 tables and automatically apply column-level access restrictions to those columns. Which TWO actions should the engineer take to meet these requirements? (Choose two.)

Accepted Answer

Create an EventBridge rule that invokes an AWS Lambda function to apply Lake Formation column-level grants or LF-Tags based on the Macie findings.. Amazon Macie performs sensitive data discovery on S3 objects and emits findings that can flow through EventBridge, providing the detection layer. A Lambda function triggered by those findings can then apply Lake Formation column-level grants or LF-Tags, automating enforcement so sensitive columns are restricted as data is registered and classified.

Answer

Enable AWS CloudTrail data events on the S3 bucket and use them to identify objects containing credit card numbers.

Answer

Configure an AWS Glue crawler with a custom classifier to detect credit card number patterns and tag the columns in the Data Catalog.

Answer

Configure S3 Block Public Access on the bucket and require SSE-KMS encryption for all objects.

Question 5

A company stores sensitive data in Amazon S3 and uses AWS KMS customer-managed keys for encryption. The security team wants to monitor and audit all KMS API calls that involve the key, including who used the key and when. They also want to receive alerts if the key is used by an unauthorized principal. Which AWS service should the data engineer use to meet these requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable Redshift cluster encryption using AWS KMS and select the customer managed key. Configure automatic key rotation for the KMS key with a 365-day rotation period.. To encrypt a Redshift cluster at rest with a customer managed KMS key, you enable encryption on the cluster and select the key. To rotate the key annually, you enable automatic rotation on that KMS key with a 365-day period. These are separate configurations but together satisfy the requirements.

Answer

Use Redshift Spectrum to query data in S3 that is encrypted with SSE-KMS, and enable key rotation on the S3 bucket's default key.

Answer

Enable Redshift cluster encryption using AWS KMS and set the cluster parameter require_ssl to true.

Answer

Enable Redshift cluster encryption using AWS KMS and create a scheduled AWS Lambda function that calls kms:RotateKey on the key annually.

Question 6

A data engineer is using Amazon Redshift to store sales data. The engineer needs to ensure that the data is encrypted at rest and that encryption keys are managed by AWS. The engineer also wants to minimize administrative overhead. Which Redshift encryption option should the engineer use?

Accepted Answer

AWS KMS AWS managed key (aws/redshift). Amazon Redshift supports encryption at rest using AWS KMS. The AWS managed key (aws/redshift) is automatically created and managed by AWS, providing encryption without the need for manual key management. This minimizes administrative overhead while ensuring data is encrypted at rest. Customer managed keys offer more control but require more management, and HSM or client-side encryption add complexity.

Answer

AWS Key Management Service (AWS KMS) customer managed key

Answer

Client-side encryption with a custom key

Answer

Hardware security module (HSM) encryption

Question 7

A data engineer is using AWS Glue Studio to build a job that reads from an Amazon S3 bucket containing nested JSON, flattens arrays using Relationalize, and writes Parquet to another S3 bucket. The job must run only when new objects land in the source bucket. The engineer wants to avoid unnecessary job runs and minimize cost. Which approach should the engineer use?

Accepted Answer

Configure an Amazon EventBridge rule that matches S3 Object Created events on the source prefix and targets the Glue job as the rule's target.. S3 can emit Object Created events that EventBridge matches by bucket and prefix, and EventBridge supports an AWS Glue job as a direct target. This is the canonical event-driven pattern: the job starts only when a new object lands, eliminating idle scheduled runs. Polling and SNS notifications either add latency or require manual steps, and a fixed cron schedule still burns DPUs on empty runs.

Answer

Create an AWS Lambda function that polls the S3 bucket using the ListObjectsV2 API on a one-minute schedule and starts the Glue job when new keys appear.

Answer

Schedule the Glue job with a cron trigger every five minutes and rely on Glue job bookmarks to skip already-processed files.

Answer

Enable S3 Event Notifications to publish to an Amazon SNS topic and subscribe the data engineer's email address to the topic.

Question 8

A data engineer is using AWS Glue DataBrew to prepare a dataset stored in Amazon S3. The dataset contains missing values, inconsistent date formats, and duplicate rows. The engineer needs to clean the data and produce a transformed output for downstream analytics. (Choose two.)

Accepted Answer

Create a recipe step using the Fill missing values transformation to replace nulls with a specified value or strategy.. Cleaning the dataset requires transformation steps that actually modify data. Removing duplicates eliminates redundant rows, and filling missing values addresses nulls. Together these recipe steps resolve two of the stated data quality issues. Date format normalization would need an additional step. Source configuration, profiling, and scheduling support the workflow but do not themselves clean the data.

Answer

Schedule a DataBrew recipe job to run on a cron expression so the cleaning steps execute periodically.

Answer

Use the DataBrew profile job to generate statistics about missing values and duplicates in the dataset.

Answer

Configure a DataBrew dataset to use the S3 bucket as a source and set the file type to CSV with header detection enabled.

Question 9

A data engineering team is building an AWS Glue ETL job that reads from an Amazon S3 bucket and writes to another. The security team mandates that both read and write operations use a customer-managed AWS KMS key so they can audit key usage. Which configuration should the data engineer apply to the Glue job to meet this requirement?

Accepted Answer

Create an AWS Glue Security configuration that enables S3 encryption with the customer-managed KMS key for both reads and writes, and attach it to the job.. The correct approach is to use an AWS Glue Security configuration that specifies the customer-managed KMS key for S3 encryption. This configuration is applied at the job level and ensures that Glue uses the key for both reading and writing data. It provides a centralized way to enforce encryption and enables auditing of key usage. Other methods like bucket policies or default encryption do not guarantee that the Glue job will use the specified key for all operations.

Answer

Enable default encryption on the S3 bucket with the customer-managed KMS key and rely on Glue to use that default for all operations.

Answer

Modify the S3 bucket policy to deny any requests that do not include the aws:SecureTransport condition and require the KMS key in the request headers.

Answer

Add a job parameter --encryption-type sse-kms and specify the KMS key ARN in the job script, then set the Security configuration to use the same key.

Question 10

A data engineer maintains an Amazon DynamoDB table that stores IoT telemetry. The table uses a partition key of deviceId and a sort key of timestamp, with on-demand capacity. A few very active devices generate millions of writes per hour while thousands of other devices write sporadically. The engineer observes throttling on writes for the active devices and wants to reduce it with the least application change. Which action should the engineer take?

Accepted Answer

Add a random suffix to the partition key to spread writes across partitions. Throttling from a few high-volume partition keys is a hot-partition problem, not a capacity problem. DynamoDB partitions have a fixed write ceiling regardless of table-level capacity mode. Write sharding by adding a suffix to the partition key spreads a single device's writes across many partitions, each with independent throughput. Provisioned capacity, streams, and GSIs do not raise the per-partition write limit, so they fail to address the observed throttling.

Answer

Enable DynamoDB Streams and process writes asynchronously

Answer

Switch the table to provisioned capacity with a high write capacity unit setting

Answer

Create a global secondary index on timestamp and write through the index

Question 11

A data engineer is configuring an AWS Glue ETL job that reads from an Amazon S3 bucket containing sensitive customer records. The job must remove all columns flagged as PII before writing to a target S3 location. The PII columns are not known in advance and vary by file. Which approach should the engineer use to ensure the PII is removed dynamically?

Accepted Answer

Use a custom PySpark script within the Glue job that scans column names and data samples against a regex pattern for PII, then drops matching columns.. The requirement is to dynamically remove PII columns that vary by file. AWS Glue does not have a native PII detection transform, and the Data Catalog does not store PII classifications unless manually added. A custom PySpark script within the Glue job can inspect schema and data, apply regex patterns, and drop matching columns. This provides the necessary flexibility and scalability.

Answer

Use AWS Glue's `DetectPII` transform to automatically identify and redact PII columns based on built-in patterns.

Answer

Use the AWS Glue DynamicFrame's `drop_fields` method with a list of PII column names derived from the Glue Data Catalog metadata.

Answer

Use AWS Glue DataBrew to create a recipe that identifies PII columns using pattern matching and apply it as a transformation step in the Glue job.

Question 12

A data engineer is using AWS Glue to transform data from Amazon S3 and load it into Amazon Redshift. The job must run incrementally and process only new data since the last run. The source data is partitioned by date in S3, and new partitions are added daily. Which AWS Glue feature should the engineer enable to track previously processed data?

Accepted Answer

Job bookmarks. Job bookmarks are the AWS Glue feature designed to track previously processed data. When enabled, Glue maintains state for each job, so subsequent runs process only new data, such as new S3 partitions or files. This is the standard way to implement incremental ETL in Glue without reprocessing historical data.

Answer

Data Catalog partition index

Answer

Glue DataBrew profile

Answer

Glue FindMatches

Question 13

A data engineer is using Amazon Kinesis Data Firehose to deliver streaming data to an Amazon S3 bucket. The engineer notices that some records are being delivered to S3 with a delay of several minutes, and sometimes records are missing. The Firehose stream is configured with a buffer size of 5 MB and a buffer interval of 300 seconds. The engineer wants to reduce latency and ensure all records are delivered. Which action should the engineer take?

Accepted Answer

Reduce the buffer interval to 60 seconds and enable Amazon CloudWatch Logs for error logging.. The buffer interval determines how long Firehose waits before delivering data. A 300-second interval means records can be delayed up to 5 minutes. Reducing it to 60 seconds lowers latency. Missing records often indicate delivery errors, which can be diagnosed by enabling CloudWatch Logs for the Firehose stream. Firehose logs errors related to S3 delivery, Lambda processing, and format conversion, helping identify and fix issues.

Answer

Increase the buffer size to 128 MB to allow more data to be batched.

Answer

Enable Amazon S3 versioning on the destination bucket.

Answer

Configure the Firehose stream to use AWS Lambda for data transformation.

Question 14

A data engineer is designing a data lake on Amazon S3 using AWS Lake Formation. The engineer needs to grant fine-grained access to specific columns and rows of a table to different analysts. Which two actions should the engineer take to meet these requirements? (Choose two.)

Accepted Answer

Define a Lake Formation data filter that specifies column and row expressions.. To enforce column- and row-level security with Lake Formation, the engineer must first register the S3 location so Lake Formation can manage the data. Then, data filters can be created to define which columns and rows are accessible. These two steps together enable fine-grained permissions, while other options do not provide the required access controls.

Answer

Use AWS Glue crawlers to update the Data Catalog with new partitions.

Answer

Enable S3 Block Public Access on the bucket.

Answer

Create an IAM policy that allows s3:GetObject on the entire bucket.

Question 15

A data engineer is using Amazon Redshift and needs to improve the performance of complex queries that join large tables. The engineer has already set the distribution style to KEY on the join columns. What additional step should the engineer take to optimize the join performance?

Accepted Answer

Set the sort key on the columns used in the join and in the WHERE clause.. Sort keys on join and filter columns allow Redshift to perform merge joins and skip unnecessary data blocks, reducing I/O and data movement. This optimizes join performance without adding resources. The other options either scale resources or change distribution in ways that are not optimal for large tables.

Answer

Change the distribution style to ALL for all large tables.

Answer

Enable concurrency scaling to handle concurrent queries.

Answer

Increase the number of nodes in the Redshift cluster to add more compute resources.

Question 16

A data engineer must load a 50 GB uncompressed CSV file from Amazon S3 into an Amazon Redshift cluster using the COPY command. The load is taking a long time and the engineer wants to improve performance. Which action should the engineer take?

Accepted Answer

Compress the file with gzip and split it into multiple smaller files, then run the COPY command with the GZIP option.. Redshift COPY performance depends on parallelizing reads across slices and minimizing bytes transferred. Compressing the CSV with gzip reduces transfer volume, and splitting it into multiple files lets each slice load a portion concurrently. The GZIP parameter handles decompression during ingest. A single large uncompressed file limits parallelism regardless of cluster size.

Answer

Convert the CSV file to JSON and load it with the COPY command using the JSON 'auto' option.

Answer

Use the COPY command with the PARALLEL OFF option to force Redshift to distribute the load across all slices.

Answer

Increase the cluster's node count and rerun the COPY command on the same single uncompressed file.

Question 17

A data engineer manages an AWS Glue job that processes JSON files from Amazon S3 and writes to Amazon Redshift. The job fails with the error "Unable to find a suitable JDBC driver". The engineer has verified that the Glue connection to Redshift is configured correctly and the IAM role has the necessary permissions. What is the most likely cause of this error?

Accepted Answer

The Glue job's script is missing the required JDBC driver dependency, and the job's dependent jars path is not set.. AWS Glue jobs require the appropriate JDBC driver to connect to Amazon Redshift. The driver is not included in the Glue environment by default, so the engineer must provide it via the dependent jars path. The error indicates the driver class is missing, which is resolved by adding the driver JAR. Network and IAM issues would produce different errors.

Answer

The Redshift cluster is in a private subnet, and the Glue job cannot reach it due to a missing NAT gateway.

Answer

The Glue job's IAM role lacks permissions to access the Redshift cluster's metadata.

Answer

The Redshift cluster's security group does not allow inbound traffic from the Glue job's ENI.

Question 18

A data engineer is configuring AWS Glue to crawl a dataset stored in Amazon S3 and populate the AWS Glue Data Catalog. The security team requires that all data in transit between AWS Glue and Amazon S3 be encrypted using TLS. The engineer has already configured the Glue crawler to use a connection with the appropriate VPC settings. What additional step must the engineer take to enforce encryption in transit?

Accepted Answer

Attach a bucket policy to the S3 bucket that denies requests where aws:SecureTransport is false.. To enforce encryption in transit between AWS Glue and Amazon S3, the engineer must attach a bucket policy that denies requests when aws:SecureTransport is false. This ensures all requests, including those from Glue, use TLS. AWS Glue already uses HTTPS by default, but the bucket policy provides a hard enforcement. Glue security configurations and connection options do not control TLS for S3, and SSE-KMS is for encryption at rest.

Answer

Configure the Glue crawler to use an S3 endpoint with SSL enabled in the connection options.

Answer

Set the Glue crawler's security configuration to require SSL for S3 connections.

Answer

Enable server-side encryption with AWS KMS (SSE-KMS) on the S3 bucket, which automatically enforces TLS for all requests.

Question 19

A data engineer is using AWS Glue DataBrew to clean a dataset stored in Amazon S3. The recipe must replace all null values in a specific column with the string 'UNKNOWN' and then convert the column to uppercase. The engineer wants to apply these steps in a repeatable recipe. Which combination of DataBrew transforms should be used?

Accepted Answer

Use the 'Fill missing values' transform with a custom value, then the 'Upper case' transform on the column.. DataBrew provides a dedicated 'Fill missing values' transform for substituting nulls with a constant, and an 'Upper case' transform for case normalization. Together they form a repeatable recipe that preserves rows and produces the required output. Removing nulls or using regex replacement does not achieve the same result.

Answer

Use the 'Remove nulls' transform, then the 'Upper case' transform.

Answer

Use the 'Replace value' transform with a regex for null, then the 'Upper case' transform.

Answer

Use the 'Custom formula' transform with an IFNULL expression, then the 'Upper case' transform.

Question 20

A data engineer manages an AWS Glue ETL job that reads from an Amazon S3 bucket and writes to another bucket. The security team mandates that all data at rest in both buckets be encrypted with customer-managed AWS KMS keys, and that each service use a distinct key. The Glue job's IAM role currently has s3:GetObject and s3:PutObject permissions but jobs fail with an access denied error when writing output. What is the MOST likely cause?

Accepted Answer

The IAM role lacks kms:GenerateDataKey and kms:Decrypt permissions on the customer-managed KMS key used by the output bucket.. Writing to an S3 bucket encrypted with SSE-KMS using a customer-managed key requires both the S3 PutObject permission and KMS permissions on that key, specifically kms:GenerateDataKey for uploads and kms:Decrypt for downloads. The Glue execution role only has S3 permissions, so the KMS authorization check fails and S3 returns access denied. Granting the role the needed KMS actions on the output key fixes the job.

Answer

The output bucket uses SSE-S3 by default, which overrides the SSE-KMS setting and prevents the customer-managed key from being used.

Answer

The KMS key policy does not allow the AWS Glue service principal to use the key for cryptographic operations.

Answer

The S3 bucket policy on the output bucket does not include a statement allowing the Glue job role to perform s3:PutObject.