DEA-C01 Mock Exam 77 — 25 Questions

Question 1

A data engineer must give an Amazon Redshift cluster the ability to load data from an Amazon S3 bucket using the COPY command. The security team prohibits embedding long-term AWS credentials in SQL and requires that access be revoked automatically when the cluster is deleted. The S3 bucket is encrypted with SSE-KMS using a customer managed key. Which approach should the data engineer use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Attach an IAM role to the Redshift cluster, grant the role s3:GetObject on the bucket and kms:Decrypt on the customer managed key, and reference the role ARN in the COPY command.. Attaching an IAM role to the Amazon Redshift cluster lets the COPY command assume temporary credentials without any long-term keys in SQL. The role needs s3:GetObject on the bucket and kms:Decrypt on the customer managed key to read SSE-KMS encrypted objects. Because the role is associated with the cluster, deleting the cluster removes that association, so access is revoked automatically as the security team requires.

Answer

Configure the cluster with a database user that has a password stored in AWS Systems Manager Parameter Store and grant that user access to the S3 bucket through a bucket ACL.

Answer

Use the COPY command with the ACCESS_KEY_ID and SECRET_ACCESS_KEY parameters populated from an IAM role's temporary credentials obtained by calling AssumeRole from an external application.

Answer

Create an IAM user with an access key, store the key in AWS Secrets Manager, and pass the secret ARN to the COPY command using the CREDENTIALS clause.

Question 2

A data engineer is configuring an Amazon S3 bucket to store sensitive financial data. The company requires that all data be encrypted at rest using AWS Key Management Service (AWS KMS) customer managed keys, and that the encryption key be automatically rotated every year. The engineer creates a KMS customer managed key and enables automatic rotation. When uploading objects using the AWS CLI, the engineer uses the --sse aws:kms parameter but does not specify a key ID. What is the result of this configuration?

Accepted Answer

The objects are encrypted with the AWS managed key for S3 (aws/s3), not the customer managed key.. To use a specific KMS customer managed key for S3 default encryption or per-object encryption, you must explicitly provide the key ARN or alias. Omitting the key ID causes S3 to fall back to the AWS managed key (aws/s3), which does not meet the requirement of using a customer managed key with annual rotation.

Answer

The objects are encrypted with the customer managed key because it is the only KMS key in the account.

Answer

The objects are encrypted with the customer managed key, and automatic rotation applies because the key is the default KMS key for the account.

Answer

The upload fails because a KMS key ID is required when using --sse aws:kms.

Question 3

A data engineer is using AWS Glue to process data stored in Amazon S3. The engineer needs to ensure that the AWS Glue job can access the S3 bucket securely without hardcoding credentials. Which approach should the engineer use?

Accepted Answer

Create an IAM role with the necessary S3 permissions and attach it to the AWS Glue job.. Attaching an IAM role with the necessary S3 permissions to the AWS Glue job is the secure and recommended way to grant access without hardcoding credentials. IAM roles provide temporary credentials and follow the principle of least privilege. The other options either introduce security risks or unnecessary complexity.

Answer

Embed the AWS access key and secret key directly in the Glue job script.

Answer

Store AWS credentials in AWS Secrets Manager and retrieve them within the Glue job script.

Answer

Use an Amazon S3 bucket policy that allows public read access to the data.

Question 4

A data engineer must mask the last four digits of a credit card column in an Amazon Redshift table so that analysts in a specific role see masked values while a fraud team sees the full values. The engineer wants a solution that applies to all queries without modifying each analyst's SQL. Which approach should the engineer use?

Accepted Answer

Create a dynamic data masking policy with the credit card column, then attach it to the analyst role so masking applies automatically at query time.. Redshift dynamic data masking attaches a masking policy to a role, so any query by that role against the tagged column returns masked values automatically, with no SQL rewriting. Users in roles without the policy see the original data. This provides column-level, role-based protection that satisfies both teams' visibility needs.

Answer

Create a view that applies a masking expression to the credit card column and grant the analyst role access only to the view.

Answer

Encrypt the credit card column with AWS KMS and grant the analyst role decrypt permissions on a different key than the fraud team.

Answer

Use row-level security to restrict the analyst role to rows where the credit card column is not null.

Question 5

A data engineer is building an AWS Glue Studio visual ETL job that reads JSON files from Amazon S3, applies a transformation, and writes to Amazon Redshift. During a test run, the job fails with an error indicating that the dynamic frame could not be written because the target table schema does not match the incoming data. The engineer needs to ensure the job automatically reconciles schema differences such as missing columns and data type mismatches during the write. Which action should the engineer take?

Accepted Answer

Change the write node's 'Handling of schema differences' to 'Reconcile schema' so missing columns are added and type mismatches are cast.. The Redshift write node in AWS Glue Studio provides a 'Handling of schema differences' setting. Selecting 'Reconcile schema' lets the writer add missing columns and cast compatible types so the dynamic frame matches the target table. This is the supported mechanism for automatically aligning incoming data with an existing Redshift schema, and it resolves the described failure without manual DDL changes.

Answer

Set the job bookmarks option to 'Enable' so Glue tracks schema changes between runs and applies them to the target.

Answer

Enable the 'Auto schema reconciliation' option in the Glue job's Redshift connection parameters.

Answer

Increase the number of DPUs allocated to the Glue job so the write can complete with a larger executor pool.

Question 6

A data engineer needs to ensure that an AWS Glue job has access to an Amazon RDS database in a private subnet. The Glue job will run in a VPC and requires a security group and subnet configuration. Which combination of steps should the engineer take?

Accepted Answer

Configure the Glue job with a VPC connection, specify a subnet and security group, and ensure the security group allows outbound traffic to the RDS database's security group.. For an AWS Glue job to access an Amazon RDS database in a private subnet, the job must be configured with a VPC connection that specifies the subnet and security group. The security group must allow outbound traffic to the RDS database's security group on the database port. This ensures network connectivity while maintaining security.

Answer

Use AWS Glue Studio to create a connection to RDS, which automatically configures the necessary VPC settings and security groups.

Answer

Attach an IAM role to the Glue job with permissions to access RDS, and configure the RDS database to be publicly accessible.

Answer

Create a VPC endpoint for AWS Glue, configure the Glue job with a VPC connection, and attach a security group that allows outbound traffic to the RDS database.

Question 7

A data engineer is deploying an Amazon Redshift cluster that must be accessible only from within a private VPC and must not have a public IP address. The cluster will be queried by an Amazon EMR cluster in the same VPC and by on-premises BI tools over a VPN connection. Which configuration should the engineer choose?

Accepted Answer

Launch the Redshift cluster with the publicly accessible setting disabled and attach it to a private subnet group.. To ensure a Redshift cluster has no public IP and is reachable only privately, the engineer must disable the publicly accessible setting and use a private subnet group. This prevents internet exposure while allowing access from within the VPC and over VPN. The other options either enable public access or do not explicitly disable it, failing the requirement.

Answer

Launch the Redshift cluster in a private subnet group and configure an AWS Site-to-Site VPN connection to the VPC.

Answer

Launch the Redshift cluster with the publicly accessible setting enabled and attach it to a public subnet group.

Answer

Launch the Redshift cluster with the publicly accessible setting disabled and attach it to a public subnet group.

Question 8

A data engineer runs an AWS Glue Studio job that reads JSON from Amazon S3 and writes to a partitioned Parquet table. The job currently runs for six hours. Profiling shows that a small number of partitions contain millions of rows while most contain a few hundred. Which change will MOST improve runtime?

Accepted Answer

Apply a salting technique to the skewed keys before the write, or repartition on a composite key.. Data skew, not compute capacity, is causing the long runtime because a few partitions hold most of the rows. Salting hot keys or repartitioning on a composite key spreads those rows across many tasks so no single task becomes a straggler. Increasing DPUs, changing worker type, or enabling bookmarks does not change how rows are distributed within a run.

Answer

Increase the number of DPUs allocated to the Glue job from 10 to 100.

Answer

Enable job bookmarks and re-run the job to skip already-processed files.

Answer

Switch the job's worker type from G.1X to G.2X to get more memory per executor.

Question 9

A data engineer is configuring an AWS Glue ETL job that reads from an Amazon S3 bucket and writes to another S3 bucket. The security team requires that data be encrypted at rest using a customer-managed AWS KMS key, and that the Glue job be able to decrypt the source data and encrypt the target data. The engineer has already created a KMS key and attached a key policy that allows the Glue service role to use the key for encrypt and decrypt operations. However, when the job runs, it fails with an access denied error related to KMS. What is the most likely cause of the failure?

Accepted Answer

The Glue job's IAM role lacks permissions for kms:Decrypt and kms:GenerateDataKey.. For a Glue job to use a customer-managed KMS key, both the key policy and the IAM role's identity-based policy must grant the necessary permissions. The key policy alone is insufficient; the IAM role must explicitly allow kms:Decrypt and kms:GenerateDataKey. This dual authorization ensures least privilege. The error indicates the IAM role lacks these permissions, so adding them resolves the issue.

Answer

The KMS key is in a different AWS Region than the S3 buckets, causing cross-Region latency and timeouts.

Answer

The Glue job is using an outdated version of the AWS SDK that does not support KMS encryption.

Answer

The S3 bucket policy does not allow the Glue job's IAM role to perform s3:GetObject and s3:PutObject.

Question 10

A data engineer is configuring an Amazon S3 bucket that stores sensitive customer records for analytics. The security team requires that all data be encrypted at rest with keys that are rotated automatically every year and that access be auditable per key. The engineer must minimize operational overhead. Which encryption configuration should be used?

Accepted Answer

SSE-KMS with a customer managed key with automatic rotation enabled. The requirement combines automatic annual key rotation, per-key auditability, and minimal operational overhead. A KMS customer managed key with automatic rotation enabled provides all three: S3 encrypts objects server-side, CloudTrail records key usage, and rotation occurs yearly without manual intervention. AWS managed keys rotate on a different schedule and offer less policy control, while SSE-S3 and SSE-C lack the needed audit or rotation behavior.

Answer

SSE-S3 with bucket key enabled

Answer

SSE-C with customer-provided keys stored in AWS Secrets Manager

Answer

SSE-KMS with an AWS managed key (aws/s3)

Question 11

A data engineer is designing an ingestion pipeline that uses AWS Glue to read from an Amazon RDS for PostgreSQL database. The job must read only rows changed since the previous run and must not scan the entire table each night. The source table has a last_updated timestamp column that is updated on every write. (Choose two.)

Accepted Answer

Configure the Glue JDBC connection with a pushdown predicate that filters on last_updated greater than a stored high-water mark.. Incremental JDBC ingestion in Glue relies on a pushdown predicate that filters on a high-water mark column like last_updated, combined with job bookmarks that persist state between runs. The predicate pushes work to RDS and reduces transfer, while bookmarks ensure the job resumes from the previous position without reprocessing. Transformations and worker-tuning options do not affect which rows are read.

Answer

Set the Glue job's '--enable-auto-scaling' argument so the job adds workers as the source table grows.

Answer

Create the DynamicFrame with the 'additional_options' parameter set to {'hashfield': 'id'} to enable hash-based change detection.

Answer

Use the Glue ResolveChoice transformation with the 'cast:double' option on the timestamp column.

Question 12

A media company stores millions of thumbnail images in an Amazon S3 bucket. Analysts run ad hoc queries against the image metadata, which is kept as JSON objects in the same bucket. Query latency is unpredictable and costs are rising because Athena scans large volumes of JSON for every query. The team wants faster queries and lower scan cost while keeping the data in S3 and queryable with SQL. Which change should the data engineer make?

Accepted Answer

Use AWS Glue to crawl the metadata, convert it to Apache Parquet partitioned by date, and register the table in the Data Catalog for Athena queries.. The root cause is that Athena must read entire JSON objects and every partition for each query. Converting metadata to columnar Parquet and partitioning by date lets the engine read only needed columns and folders, cutting scanned bytes and latency. Catalog registration keeps the data in S3 and preserves SQL access, which matches all stated constraints.

Answer

Enable S3 Intelligent-Tiering on the bucket to automatically move infrequently accessed metadata objects to cheaper storage.

Answer

Move the metadata into an Amazon DynamoDB table and have analysts query it with PartiQL.

Answer

Increase the Athena workgroup data usage control limit so queries can scan more data without failing.

Question 13

A company needs to ingest streaming data from thousands of IoT devices into Amazon S3 for long-term storage and analytics. The data arrives continuously at a rate of 5 MB per second and must be stored in a compressed format to reduce storage costs. The solution should be highly available and require minimal management. Which AWS service should the company use?

Accepted Answer

Amazon Kinesis Data Firehose with a delivery stream to Amazon S3, enabling compression.. Amazon Kinesis Data Firehose is designed for streaming data ingestion to destinations like S3. It automatically handles scaling, buffering, compression, and encryption. With compression enabled, data is stored in GZIP format, reducing storage costs. It requires no infrastructure management, making it the simplest and most cost-effective solution for continuous IoT data ingestion to S3.

Answer

Amazon Kinesis Data Streams with an AWS Lambda consumer that writes to Amazon S3.

Answer

Amazon Managed Streaming for Apache Kafka (Amazon MSK) with a Kafka Connect S3 sink connector.

Answer

AWS Glue streaming ETL job that reads from Amazon Kinesis Data Streams and writes to Amazon S3.

Question 14

A data engineer is using AWS Step Functions to orchestrate a series of AWS Glue jobs. One of the Glue jobs occasionally fails due to transient network issues. The engineer wants the Step Function to retry the failed Glue job up to 3 times with exponential backoff before failing the entire workflow. Which Step Functions state configuration should be used?

Accepted Answer

Add a Retry field in the Task state with ErrorEquals matching the Glue job's error, MaxAttempts: 3, and BackoffRate: 2.0.. The Retry field in Step Functions Task states is specifically designed to handle transient errors by retrying the task with configurable attempts and backoff. Setting MaxAttempts to 3 and BackoffRate to 2.0 achieves up to three retries with exponential backoff. This is the standard, declarative approach and avoids custom orchestration logic. It also allows matching on specific error types, ensuring retries only occur for relevant failures.

Answer

Configure a Catch field in the Task state to transition to a Wait state, then loop back to the Glue job Task.

Answer

Set the Glue job's MaximumRetries parameter to 3 in the job definition.

Answer

Use a Map state to iterate over the Glue job three times with a Wait state in between.

Question 15

A data engineer is using AWS Step Functions to orchestrate a series of AWS Glue jobs. The state machine includes a task that runs an AWS Glue job and then waits for its completion. The engineer notices that the Step Functions execution times out after 15 minutes, even though the Glue job takes about 30 minutes to complete. The Step Functions state machine has a timeout of 1 hour. What is the most likely cause of the timeout?

Accepted Answer

The Step Functions task has a TimeoutSeconds value set to 900, overriding the state machine timeout.. The most likely cause is that the Step Functions task has a TimeoutSeconds parameter set to 900 seconds (15 minutes). This parameter overrides the state machine's timeout for that specific task. To allow the Glue job to run for its full duration, the engineer should increase the task timeout to a value greater than the expected job runtime, or remove it to rely on the state machine's timeout.

Answer

The AWS Glue job is running in a VPC without a NAT gateway, causing network timeouts.

Answer

The Step Functions task is using the optimized integration for AWS Glue, which has a maximum timeout of 15 minutes.

Answer

The AWS Glue job is not sending a heartbeat to Step Functions, so the task times out.

Question 16

A data engineer manages an AWS Glue job that reads from an Amazon S3 bucket containing PII. The security team requires that the data be encrypted at rest using a customer-managed AWS KMS key, and that the engineer be able to audit key usage. The engineer has already created a KMS key. Which combination of steps should the engineer take to meet these requirements?

Accepted Answer

Configure the S3 bucket to use SSE-KMS with the customer-managed key, and enable AWS CloudTrail logging for KMS API calls.. SSE-KMS with a customer-managed key provides control over the encryption key and enables auditing via CloudTrail, which logs all KMS API calls. This meets both the encryption at rest and auditability requirements. Other options either use AWS-managed keys or do not provide the necessary audit detail.

Answer

Use SSE-S3 for the S3 bucket and enable S3 server access logging to track key usage.

Answer

Enable default encryption on the S3 bucket with SSE-KMS using the AWS managed key aws/s3, and enable AWS CloudTrail data events for S3.

Answer

Configure the Glue job to use client-side encryption with a customer-managed KMS key, and enable AWS CloudTrail management events.

Question 17

A data engineer is configuring an AWS Glue ETL job that reads from an Amazon S3 bucket containing nested JSON and writes to a partitioned Parquet table. The engineer wants to reduce job cost and improve read performance. (Choose two.)

Accepted Answer

Enable job bookmarks to avoid reprocessing previously processed files.. Job bookmarks cut cost by skipping already-processed S3 objects, which is important for incremental pipelines. Partitioning the output Parquet table by low-cardinality filter columns enables partition pruning, reducing I/O and improving read performance for downstream queries. Crawlers, worker scaling, and pre-conversion do not directly deliver both cost reduction and read performance for this job configuration.

Answer

Convert the source JSON to Parquet before the Glue job runs.

Answer

Increase the number of workers to the maximum allowed for the job.

Answer

Use the Glue crawler to infer the schema and store it in the Data Catalog.

Question 18

A data engineer needs to run a transformation on streaming data using SQL-like queries without managing servers, and the output must be written to Amazon S3 in near real time. The source is an Amazon Kinesis Data Stream. Which AWS service is the MOST appropriate to perform the transformation?

Accepted Answer

Amazon Managed Service for Apache Flink with a SQL application.. Amazon Managed Service for Apache Flink provides a managed environment for running SQL-based stream processing applications against Kinesis Data Streams and can deliver results to Amazon S3 in near real time. Because AWS operates the underlying infrastructure, the engineer avoids cluster management while still getting continuous, low-latency transformation, which is precisely what the scenario requires.

Answer

AWS Glue with a Python shell job triggered hourly by Amazon EventBridge.

Answer

AWS Lambda with a function triggered by Kinesis records and writing directly to S3.

Answer

Amazon EMR running Apache Spark Structured Streaming on a persistent cluster.

Question 19

A data engineer manages an Amazon DynamoDB table for order events. Reads and writes are evenly spread across a partition key with very high cardinality, but during flash sales the table throttles with ProvisionedThroughputExceededException even though consumed capacity is below the provisioned total. Which cause is MOST likely?

Accepted Answer

A single partition key value is receiving a disproportionate share of traffic, creating a hot partition that exceeds its per-partition throughput limit.. DynamoDB throughput is provisioned at the table level but enforced at the partition level, and each partition can serve only about 1,000 write units per second. When traffic concentrates on one partition key value, that partition throttles while the table still shows unused capacity. Even distribution across a high-cardinality key normally prevents this, so the flash-sale burst must be funneling requests to a single key value.

Answer

The table's on-demand capacity mode must be enabled to remove per-partition limits.

Answer

The table's items are too large, and each write consumes more than one write capacity unit.

Answer

The table has too many global secondary indexes, which each consume write capacity.

Question 20

A company wants to ingest streaming data from Apache Kafka into Amazon S3 for long-term storage and analytics. The data is in JSON format and must be delivered to S3 with minimal effort and no custom code. Which AWS service should the data engineer use?

Accepted Answer

Amazon Kinesis Data Firehose with a Kafka source.. Kinesis Data Firehose is a fully managed service that can read from Apache Kafka and deliver to Amazon S3 without requiring custom code. It handles scaling, buffering, and format conversion. Other options like Kinesis Data Streams, Glue, or Managed Flink require writing and maintaining code, which does not meet the no-code requirement.

Answer

AWS Glue streaming ETL job.

Answer

Amazon Kinesis Data Streams with an AWS Lambda consumer.

Answer

Amazon Managed Service for Apache Flink.