DEA-C01 Mock Exam 77 — 25 Questions

Question 1

Which TWO actions are required to enforce encryption in transit for data being loaded into Amazon Redshift from Amazon S3? (Choose two.)

Accepted Answer

Configure Redshift to require SSL connections. To enforce encryption in transit for data loaded from S3 into Redshift, you need SSL connections on Redshift (option A) to encrypt the connection between the client and Redshift, and S3 VPC endpoints with HTTPS (option E) to encrypt data transfer from S3 to Redshift via the VPC endpoint. Option B is client-side encryption, which encrypts data before it reaches S3 and is not required for transit. Option C enables encryption at rest on the Redshift cluster, not in transit. Option D is about server-side encryption at rest in S3, not transit.

Answer

Use client-side encryption for data in S3

Answer

Enable encryption at rest on Redshift cluster

Answer

Enable S3 server-side encryption

Question 2

A company wants to audit all API calls made to Amazon S3 and Amazon RDS resources. Which TWO AWS services can be used together to achieve this?

Accepted Answer

AWS CloudTrail. Options A and E are correct. AWS CloudTrail records API calls to S3 and RDS, and Amazon CloudWatch Logs can store and monitor those logs. Option B (AWS Config) records resource configuration changes, not API calls, so it is incorrect. Option C (Amazon GuardDuty) is a threat detection service, not for auditing API calls. Option D (Amazon Macie) is for data classification and protection, not for recording API calls.

Answer

AWS Config

Answer

Amazon GuardDuty

Answer

Amazon Macie

Question 3

A company needs to monitor and record all changes to IAM policies in their AWS account. Which AWS service should be used?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records API calls, including IAM policy changes, making it the correct choice for monitoring and recording changes to IAM policies. Option A is wrong because Amazon CloudWatch Logs is primarily for storing and monitoring log files, not for directly recording IAM changes. Option B is wrong because Amazon GuardDuty is a threat detection service, not designed for recording configuration changes. Option D is wrong because AWS IAM Access Analyzer analyzes resource policies for public or cross-account access, not for recording changes.

Answer

Amazon CloudWatch Logs

Answer

Amazon GuardDuty

Answer

AWS IAM Access Analyzer

Question 4

A data engineer needs to ensure that data in an S3 bucket is encrypted at rest. The bucket policy includes a condition that denies PutObject requests if the object is not encrypted. Which S3 encryption feature does this enforce?

Accepted Answer

S3 Bucket Policy. S3 bucket policies can require server-side encryption by denying PutObject without encryption headers. Option C (default encryption) is a bucket-level setting that automatically encrypts objects, but it does not enforce encryption via policy. Option A (object lock) prevents deletion. Option B (MFA delete) requires multi-factor authentication.

Answer

S3 Object Lock

Answer

S3 MFA Delete

Answer

S3 Default Encryption

Question 5

A company wants to centrally manage encryption keys for multiple AWS services and automatically rotate them every year. Which AWS service should be used?

Accepted Answer

AWS Key Management Service (KMS). AWS KMS manages encryption keys and supports automatic key rotation annually. Option A is wrong because CloudHSM provides hardware-based key storage but does not offer automatic key rotation. Option B is wrong because ACM manages SSL/TLS certificates, not encryption keys. Option C is wrong because Secrets Manager is designed to manage secrets like database credentials, not encryption keys.

Answer

AWS CloudHSM

Answer

AWS Certificate Manager (ACM)

Answer

AWS Secrets Manager

Question 6

A data engineer needs to securely store database credentials used by an AWS Glue ETL job. Which THREE steps should the engineer take?

Accepted Answer

Store the credentials in AWS Secrets Manager.. Options B, C, and D are correct. AWS Secrets Manager securely stores credentials with automatic rotation. The Glue job's IAM role must have permission to read the secret (C), and the job uses the Secrets Manager connector to retrieve credentials (D). Option A is incorrect because hardcoding credentials is insecure and violates best practices. Option E is incorrect because while Parameter Store can store secrets, Secrets Manager is the recommended service for managing database credentials due to its built-in rotation and tighter integration with Glue.

Answer

Hardcode the credentials in the Glue job script.

Answer

Use AWS Systems Manager Parameter Store with a SecureString parameter.

Question 7

A company uses Amazon EMR to process data stored in S3 with server-side encryption using AWS KMS. The EMR cluster fails with a "403 Access Denied" error when reading data from S3. The IAM role for the EMR cluster has s3:GetObject and kms:Decrypt permissions. What is the most likely issue?

Accepted Answer

The EC2 instance profile does not have kms:Decrypt permission. Although the IAM role assigned to the EMR cluster has s3:GetObject and kms:Decrypt permissions, the EC2 instances themselves run under an instance profile (an IAM role for EC2). For S3 objects encrypted with SSE-KMS, the EC2 instance performing the read must have kms:Decrypt permission. If the instance profile lacks this permission, the request is denied with a 403 error. Option B is less likely because a bucket policy denying access would be explicit and typically not the first thing to check. Option C (EMRFS consistent view) does not affect S3 access permissions. Option D (incorrect KMS key ID) would cause a different error (e.g., 400 Bad Request or access denied for specific keys), but the primary cause is the missing kms:Decrypt on the instance profile.

Answer

The S3 bucket policy denies access to the EMR cluster's IAM role

Answer

The EMRFS consistent view is not enabled

Answer

The EMR cluster is using an incorrect KMS key ID

Question 8

A data engineer applies the following IAM policy to an IAM user:

```json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::example-bucket/*",
      "Condition": {
        "StringEquals": {
          "s3:x-amz-server-side-encryption": "AES256"
        }
      }
    }
  ]
}
```

The user attempts to download an object from the bucket 'example-bucket' that is encrypted with SSE-S3 (AES256). Will the request succeed?

Accepted Answer

No, because the policy requires the encryption to be specified in the request.. The IAM policy includes a condition that requires the request to include the `x-amz-server-side-encryption` header with value `AES256`. Even though the object is encrypted with SSE-S3, the policy condition evaluates the request headers, not the object's encryption state. Since the user does not specify the encryption header in the download request, the condition fails, and the request is denied.

Answer

Yes, but only if the user also has s3:ListBucket permission.

Answer

Yes, because the object is encrypted with SSE-S3 which uses AES256.

Answer

No, because the policy does not allow the s3:GetObject action for encrypted objects.

Question 9

A company uses Amazon Redshift for its data warehouse and needs to enforce column-level security on sensitive columns. Which TWO approaches can achieve this?

Accepted Answer

Create views that expose only non-sensitive columns and grant access to the views.. Options B and D are correct. Amazon Redshift natively supports column-level security, allowing you to grant or revoke permissions on specific columns (option D). Additionally, you can create views that include only non-sensitive columns and grant access to those views (option B), effectively achieving column-level access control. Option A (S3 bucket policy) does not control access within Redshift. Option C (Redshift Spectrum) pertains to external tables and is not a column-level security feature. Option E (row-level security) controls rows, not columns.

Answer

Apply an S3 bucket policy to the underlying data files.

Answer

Use Redshift Spectrum to query external tables and restrict columns via the external schema.

Answer

Use Redshift row-level security policies to restrict column access.

Question 10

A data engineer deploys the CloudFormation template shown in the exhibit. After 60 days, what will be the storage class of objects in the bucket?

Accepted Answer

The objects will be in GLACIER storage class.. The CloudFormation template includes a lifecycle rule with a transition action to the GLACIER storage class after 60 days from object creation. Since the rule is properly configured and no expiration action is defined, objects will be moved from STANDARD to GLACIER at day 60. This is standard S3 lifecycle behavior, and objects are not deleted unless a separate expiration rule is set.

Answer

The objects will be deleted.

Answer

The objects will remain in STANDARD storage class because the rule is not triggered.

Answer

The objects will be immediately transitioned to GLACIER upon creation.

Question 11

A company is using AWS Database Migration Service (DMS) to migrate a 2 TB MySQL database to Amazon Aurora MySQL. The migration is taking longer than expected. The source database is in a different AWS region. Which change would MOST likely improve the migration speed?

Accepted Answer

Increase the number of parallel tables being migrated.. Increasing the number of parallel tables allows DMS to migrate multiple tables simultaneously, leveraging available bandwidth and reducing overall migration time. This is particularly effective for large databases (2 TB) where serial migration would be slow. Option B is incorrect because Multi-AZ provides high availability, not performance improvement; it adds overhead and does not reduce network latency. Option A reduces resources, making migration slower. Option D disables binary logging, which is needed for ongoing replication and can cause data loss or require a full re-sync.

Answer

Use a smaller DMS replication instance to reduce costs.

Answer

Use a Multi-AZ deployment for the DMS replication instance in the target region.

Answer

Disable binary logging on the source MySQL database.

Question 12

A company uses AWS Glue to run ETL jobs daily. The data is stored in S3 as Parquet files partitioned by date. Recently, jobs have failed with the error 'No such file or directory' for certain partitions. What is the MOST likely cause?

Accepted Answer

A partition folder was deleted or not created by the upstream process.. The error 'No such file or directory' indicates that the Glue ETL job is attempting to read a specific S3 partition path that does not exist. Since the data is partitioned by date and the job runs daily, the most likely cause is that the upstream process failed to create or accidentally deleted the partition folder for that date. Glue's dynamic frame or Spark DataFrame will throw this error when it tries to list or read files from a missing prefix.

Answer

The schema has changed and Glue cannot parse the data.

Answer

The files are compressed with an unsupported codec.

Answer

The IAM role does not have s3:GetObject permission.

Question 13

A data engineer needs to set up a disaster recovery solution for an Amazon RDS for MySQL database. The database must be available in another AWS Region with minimal data loss. What is the simplest approach?

Accepted Answer

Create a cross-Region read replica of the database.. Cross-Region read replica. Amazon RDS for MySQL supports cross-Region read replicas, which provide asynchronous replication to another Region. In a disaster, you can promote the read replica to a standalone primary database, minimizing data loss (typically seconds). Option A is wrong because Multi-AZ is within a single Region and does not provide cross-Region protection. Option B is wrong because AWS DMS is a separate service that requires ongoing management and cost; it is not the simplest approach. Option C is wrong because manual snapshots copied daily have a Recovery Point Objective (RPO) of up to 24 hours, resulting in significant data loss.

Answer

Enable Multi-AZ deployment in the same Region.

Answer

Set up AWS Database Migration Service (DMS) for continuous replication.

Answer

Take a manual snapshot and copy it to the other Region daily.

Question 14

A data engineer reviews this IAM policy attached to an S3 bucket. What is the effect of this policy?

Accepted Answer

Allows PutObject only when the object is encrypted with SSE-KMS.. The IAM policy uses a Deny effect with a StringNotEquals condition on s3:x-amz-server-side-encryption for aws:kms. This means that if the encryption header is anything other than aws:kms (i.e., not SSE-KMS), the request is denied. The net effect is that PutObject is allowed only when the object IS encrypted with SSE-KMS.

Answer

Denies PutObject when encryption is not SSE-KMS.

Answer

Denies all PutObject requests.

Answer

Allows PutObject only when the object is NOT encrypted with SSE-KMS.

Question 15

A data engineer is designing a data lake on Amazon S3 with AWS Lake Formation. The data lake contains personally identifiable information (PII). The company has a policy that only users who have completed data privacy training can access the PII data. The training status is stored in an external identity provider (IdP) as an attribute. The data engineer needs to enforce this policy using Lake Formation. Which THREE steps should the data engineer take? (Choose THREE.)

Accepted Answer

Create an LF-tag called 'trainingCompleted' with values 'true' and 'false'. Grant 'SELECT' permission on the LF-tag 'trainingCompleted=true' to the federated users.. LF-tags allow Lake Formation to manage access based on metadata attributes. By creating an LF-tag 'trainingCompleted' with values 'true' and 'false', and granting SELECT permission on the tag value 'true' to federated users, the data engineer can enforce that only users with the training attribute can access the tagged resources. This approach decouples access control from IAM roles and leverages tag-based authorization, which is the recommended method for attribute-based access control (ABAC) in Lake Formation.

Answer

Create a column-level filter on the PII columns that limits access based on the user's training attribute.

Answer

Create an IAM role for each user and attach a policy that allows 'lakeformation:GetDataAccess' only if the user has the training attribute.

Question 16

A company is streaming clickstream data from a website into Amazon Kinesis Data Streams. The data is then consumed by a Lambda function that transforms the records and writes them to an S3 bucket in Parquet format. Recently, the Lambda function has been timing out and the S3 bucket is not receiving all expected records. The Kinesis stream has a shard count of 10 and the Lambda function's reserved concurrency is set to the default. Which change would MOST likely resolve the issue?

Accepted Answer

Decrease the batch window from the default 300 seconds to 60 seconds.. The Lambda function is timing out because it cannot process the default batch of 100 records within the function timeout. Decreasing the batch window from 300 seconds to 60 seconds causes Lambda to invoke more frequently with smaller batches, reducing the number of records per invocation. This lowers the processing time per invocation, helping the function complete before the timeout. Increasing the batch size (Option D) would worsen the issue by adding more records per invocation. Increasing reserved concurrency (Option C) does not reduce per-invocation processing time. Using a delivery stream (Option B) changes the architecture unnecessarily and may not preserve the transformation logic.

Answer

Configure the Kinesis stream to directly write to S3 using a delivery stream.

Answer

Increase the Lambda function's reserved concurrency.

Answer

Increase the batch size from the default 100 to 500 records per invocation.

Question 17

A company is building a data lake on Amazon S3 and needs to ingest data from various on-premises sources. Which TWO AWS services can be used to transfer data securely over the internet?

Accepted Answer

AWS DataSync. AWS DataSync is designed to securely transfer large amounts of data from on-premises storage to AWS over the internet. It uses TLS encryption for data in transit and can automate and accelerate transfers by leveraging parallel multi-threading and incremental updates. This makes it a correct choice for securely ingesting data into an S3-based data lake.

Answer

AWS Snowcone

Answer

Amazon Kinesis Data Firehose

Answer

AWS Direct Connect

Question 18

A data engineer needs to ingest data from a relational database (MySQL) into Amazon S3 for analytics. The database is 500 GB and the job must run daily with incremental updates. Which AWS service is BEST suited for this task?

Accepted Answer

AWS Database Migration Service (DMS) with a replication task.. AWS DMS with a replication task is the best choice because it is specifically designed for continuous, incremental data replication from relational databases like MySQL to Amazon S3. DMS supports ongoing replication (change data capture) to capture incremental changes without custom scripting, and it can handle the initial 500 GB load efficiently. Other services either lack native incremental support or require additional configuration for this use case.

Answer

Amazon EMR with Apache Sqoop.

Answer

Amazon Kinesis Data Firehose with a database source.

Answer

AWS Glue ETL job with a JDBC connection.

Question 19

A data engineer uses the AWS CLI to list KMS keys and describe one. The output shows two keys. The described key has KeyState 'Enabled' and Origin 'AWS_KMS'. Which statement is true about this key?

Accepted Answer

The key is a KMS managed key that is enabled and ready for use. The key has KeyState 'Enabled' and Origin 'AWS_KMS', which means it is an AWS KMS managed key that is enabled and ready for use. Option B is incorrect because Origin 'AWS_KMS' indicates the key material is generated by AWS, not imported. Option C is incorrect because a key scheduled for deletion would have KeyState 'PendingDeletion'. Option D is incorrect because KeyState 'Enabled' means the key is not disabled.

Answer

The key material was imported from an external source

Answer

The key is scheduled for deletion

Answer

The key is disabled and cannot be used

Question 20

A data engineer is configuring an S3 bucket for a data lake. The engineer runs the command shown in the exhibit. What does the output indicate about the bucket?

Accepted Answer

Versioning is enabled on the bucket.. 'Status: Enabled' indicates that versioning is enabled on the bucket. Option B is incorrect because when versioning is enabled, all versions of objects are retained, not just the latest, unless lifecycle rules are configured to remove older versions. Option C is incorrect because the status is 'Enabled', not 'Suspended'. Option D is incorrect because 'MFA Delete' is a separate setting; the output shows 'MFADelete: Disabled', meaning MFA Delete is not enabled.

Answer

The bucket retains only the latest version of each object.

Answer

Versioning is suspended on the bucket.

Answer

MFA Delete is enabled for the bucket.