DEA-C01 Mock Exam 78 — 25 Questions

Question 1

A data engineering team uses AWS Glue to extract, transform, and load (ETL) data from Amazon RDS for MySQL to Amazon S3. The job runs daily and processes incremental data. The team notices that the job is taking longer than expected. Which TWO actions can improve the job performance? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use pushdown predicates to filter data at the source.. B is correct because pushdown predicates allow filtering at the source (RDS MySQL), reducing the amount of data transferred to the Glue job and thus speeding up processing. D is correct because increasing DPUs allocates more resources (CPU, memory) to the Glue job, enabling parallel processing and faster execution. A is wrong because changing to Standard (single node) reduces parallelism, slowing down the job. C is wrong because adding more transformations increases processing time, not improving performance. E is wrong because disabling compression on output data increases I/O and storage costs, not improving performance.

Answer

Change the worker type to Standard (single node).

Answer

Add more transformations to the ETL script to clean data.

Answer

Disable compression on the output data to reduce CPU usage.

Question 2

A company stores sensitive data in an S3 bucket. To meet compliance requirements, they must ensure that all objects are encrypted at rest using server-side encryption with AWS KMS. Which bucket policy statement should be applied to deny uploads that do not use the required encryption?

Accepted Answer

{"Effect":"Deny","Principal":"*","Action":"s3:PutObject","Resource":"arn:aws:s3:::bucketname/*","Condition":{"StringNotEquals":{"s3:x-amz-server-side-encryption":"aws:kms"}}}. It uses the `s3:x-amz-server-side-encryption` condition key with `StringNotEquals` set to `aws:kms`, which denies any `s3:PutObject` request where the encryption header does not specify `aws:kms`. This ensures all uploaded objects are encrypted at rest using server-side encryption with AWS KMS, meeting the compliance requirement.

Answer

{"Effect":"Deny","Principal":"*","Action":"s3:PutObject","Resource":"arn:aws:s3:::bucketname/*","Condition":{"StringNotEquals":{"s3:x-amz-server-side-encryption":"AES256"}}}

Answer

{"Effect":"Deny","Principal":"*","Action":"s3:PutObject","Resource":"arn:aws:s3:::bucketname/*","Condition":{"StringNotEquals":{"s3:x-amz-server-side-encryption-aws-kms-key-id":"arn:aws:kms:us-east-1:123456789012:key/abc123"}}}

Answer

{"Effect":"Deny","Principal":"*","Action":"s3:PutObject","Resource":"arn:aws:s3:::bucketname/*","Condition":{"Null":{"s3:x-amz-server-side-encryption":"true"}}}

Question 3

A company uses AWS Glue to process CSV files from an S3 bucket. The job fails intermittently with a 'SchemaDetectionError' for files that have inconsistent column counts. What is the most efficient way to handle this?

Accepted Answer

Define a fixed schema in the Glue job using 'apply_mapping' to map columns.. Defining a fixed schema using the `schema` parameter in the DynamicFrame reader forces Glue to apply that schema to all CSV files. With `apply_mapping`, you can map the actual columns present to the fixed schema, handling inconsistent column counts by ignoring extra columns and filling missing columns with nulls. This avoids schema detection errors without extra preprocessing.

Answer

Use the 'mergeSchema' option when reading the DynamicFrame.

Answer

Convert all CSV files to Parquet format using a separate preprocessing job.

Answer

Set the job to 'ignore' schema mismatches in the job parameters.

Question 4

A data engineer is designing a data lake on Amazon S3. The data is accessed frequently for the first 30 days, then rarely after that. Which lifecycle policy is MOST cost-effective?

Accepted Answer

Transition to S3 Standard-Infrequent Access (Standard-IA) after 30 days.. Transitioning to S3 Standard-Infrequent Access (Standard-IA) after 30 days is the most cost-effective because it reduces storage costs for data that is rarely accessed while maintaining low latency and high durability. Option B (One Zone-IA) offers lower durability and is not recommended for a data lake. Option C (Glacier Deep Archive) has high retrieval times, which may not be suitable even for rare access. Option D (keeping in Standard for 90 days then deleting) is more expensive for the first 90 days and deletes data that might still be needed.

Answer

Transition to S3 One Zone-IA after 30 days.

Answer

Transition to S3 Glacier Deep Archive after 30 days.

Answer

Keep in S3 Standard for 90 days, then delete.

Question 5

A company needs to ingest data from an on-premises MySQL database into Amazon S3 for analytics. The database is 2 TB in size. The company has a low-bandwidth internet connection (10 Mbps). They need to perform an initial full load and then incremental updates every hour. Which approach should they use?

Accepted Answer

Use AWS Database Migration Service (DMS) to perform the full load and ongoing replication.. AWS Database Migration Service (DMS) supports full load and ongoing replication, and can be used with limited bandwidth. Option A is wrong because Kinesis Data Firehose is for streaming data, not database replication. Option C is wrong because Glue ETL is not optimized for continuous replication. Option D is wrong because Snowball Edge is for offline transfer, not ongoing replication.

Answer

Use Kinesis Data Firehose to stream data from MySQL to S3.

Answer

Use AWS Glue ETL jobs to extract data and load into S3.

Answer

Use AWS Snowball Edge to transfer the initial full load, then use AWS DataSync for incremental updates.

Question 6

A financial services company uses AWS KMS to encrypt data in Amazon S3. The compliance team requires that all encryption keys be rotated automatically every 365 days. The data engineer needs to implement this requirement without manual intervention. Which solution meets the requirement with the LEAST operational overhead?

Accepted Answer

Use the AWS managed key for Amazon S3 (aws/s3) for server-side encryption.. The AWS managed key for Amazon S3 (aws/s3) is automatically rotated by AWS every 365 days (or less) with no configuration or maintenance required. This satisfies the compliance requirement with zero operational overhead, as the rotation is handled entirely by the AWS KMS service without any manual intervention or custom automation.

Answer

Create a customer managed key (CMK) in KMS with automatic rotation enabled every 365 days. Use this CMK to encrypt S3 objects.

Answer

Create a customer managed key with imported key material and configure a Lambda function to rotate the key every 365 days.

Answer

Use S3 server-side encryption with S3 managed keys (SSE-S3).

Question 7

Which TWO AWS services can be used to transform data in transit during ingestion? (Choose 2.)

Accepted Answer

Amazon Kinesis Data Firehose with Lambda transformation. Amazon Kinesis Data Firehose can invoke an AWS Lambda function to transform streaming data in real time before delivering it to a destination, making it suitable for transforming data in transit during ingestion. AWS Glue ETL can be used for both batch and streaming transformations; specifically, AWS Glue supports streaming ETL jobs that can transform data in transit as it is ingested from sources like Amazon MSK or Kinesis Data Streams. Therefore, both services can transform data during ingestion, albeit with different use cases and latency characteristics.

Answer

Amazon S3 Transfer Acceleration

Answer

Amazon Athena

Answer

AWS Data Pipeline

Question 8

A data engineer needs to set up a new Amazon RDS for PostgreSQL database for a production workload. The database must be highly available and resilient to a single Availability Zone failure. Which configuration should the engineer choose?

Accepted Answer

Multi-AZ deployment with one standby in a different AZ. A Multi-AZ deployment for Amazon RDS PostgreSQL automatically provisions and maintains a synchronous standby replica in a different Availability Zone. This configuration provides automatic failover in the event of an AZ failure, ensuring high availability and resilience without manual intervention. The synchronous replication ensures zero data loss during failover, which is critical for production workloads.

Answer

Single-AZ with automated backups

Answer

Multi-AZ with two readable standbys

Answer

Single-AZ with a read replica

Question 9

Refer to the exhibit. A data engineer is attaching this IAM policy to an IAM role used by an AWS Glue job. The job reads from a Kinesis Data Streams stream and writes transformed data to an S3 bucket. When the job runs, it fails with an AccessDenied error for the Kinesis stream. What is the MOST likely cause?

Accepted Answer

The IAM policy is missing the 'kinesis:DescribeStream' action.. When an AWS Glue job reads from Kinesis Data Streams, it requires the `kinesis:DescribeStream` action to retrieve stream metadata such as shard IDs and the stream's current state. Without this permission, the Glue job cannot discover the stream's shards and fails with an AccessDenied error, even if other Kinesis actions like `GetRecords` are allowed. The error occurs because the IAM policy attached to the Glue role is missing this prerequisite action.

Answer

The stream ARN in the policy is incorrect.

Answer

The Glue job does not have permissions to call 'kinesis:PutRecord'.

Answer

The S3 bucket policy blocks the PutObject action from the Glue role.

Question 10

A data engineering team is building a real-time analytics pipeline using Amazon Kinesis Data Streams, AWS Lambda, and Amazon DynamoDB. The Lambda function consumes records from the stream and writes aggregated data to a DynamoDB table. The application requires that each record be processed exactly once to avoid duplicates. The Lambda function is idempotent, but occasionally duplicate records are written due to retries from Kinesis. The team needs to ensure exactly-once semantics for DynamoDB writes. Which solution should they implement?

Accepted Answer

Use DynamoDB TransactWriteItems with a condition check on a unique transaction ID.. DynamoDB TransactWriteItems with a condition check on a unique transaction ID ensures that the write only succeeds if the transaction ID does not already exist in the table. This provides exactly-once semantics by preventing duplicate writes even when Kinesis retries deliver the same record multiple times. The condition check acts as a distributed lock at the item level, guaranteeing idempotency without relying on downstream deduplication.

Answer

Enable DynamoDB Streams and use a second Lambda to deduplicate.

Answer

Use the Kinesis Client Library (KCL) to checkpoint after processing and ignore duplicates.

Answer

Ensure the Lambda function is idempotent by using upsert operations.

Question 11

Match each AWS data analytics service to its primary function.

Accepted Answer

Amazon Athena: Query data in Amazon S3 using standard SQL. The correct matches are: Amazon Athena for serverless SQL querying on S3, Amazon Redshift for data warehousing, Amazon EMR for big data processing, and Amazon Kinesis for real-time streaming. Common confusions include swapping the roles of Athena and Redshift.

Answer

Amazon Athena: Fully managed data warehouse

Answer

Amazon Redshift: Query data in S3 using SQL

Question 12

A company uses AWS KMS to encrypt data in Amazon S3. The security team requires that all encryption keys be rotated automatically every year. Which key type should the company use?

Accepted Answer

Use a customer managed key with automatic rotation enabled. AWS KMS allows customer managed keys to have automatic rotation enabled, which rotates the key material annually. This satisfies the security team's requirement for automatic yearly rotation while keeping customer control over the key. Option D (manual rotation) does not meet the automatic rotation requirement. AWS managed keys (C) also rotate automatically but are not customer managed, and SSE-S3 (B) is not a KMS key type.

Answer

Use the default S3 managed encryption key (SSE-S3)

Answer

Use an AWS managed key (aws/s3)

Answer

Use a customer managed key with manual rotation

Question 13

A data engineer is reviewing an IAM policy that controls access to an S3 bucket. The policy is attached to a user group. The policy includes a condition that explicitly requires server-side encryption with SSE-S3 for all GetObject requests. The engineer notices that users are unable to download objects from the bucket. What is the likely cause?

Accepted Answer

The objects are encrypted using SSE-KMS, not SSE-S3.. The IAM policy includes a condition that allows downloads only if the object is encrypted with SSE-S3. However, the objects in the bucket are encrypted using SSE-KMS, which does not satisfy the condition. As a result, the s3:GetObject request is denied. This is a common scenario where a specific encryption condition in the policy blocks access when the actual encryption method differs. The other options are less likely: attaching the policy to a user group is valid and does not cause download issues; an incorrect bucket ARN would affect all operations, not just downloads; and missing s3:GetObject would be a straightforward policy error that would be easily identified.

Answer

The policy is attached to a user group instead of an IAM role.

Answer

The policy does not specify the correct bucket ARN.

Answer

The policy does not allow the s3:GetObject action.

Question 14

A data engineer needs to transfer 10 TB of data from an on-premises data center to Amazon S3. The network bandwidth is limited to 100 Mbps, and the data transfer must be completed within 5 days. What is the most cost-effective solution?

Accepted Answer

Use AWS Snowball Edge to physically ship the data.. With 10 TB of data and a 100 Mbps link, the theoretical transfer time over the internet is approximately 10 days (10 TB * 8 / 100 Mbps = 800,000 seconds ≈ 9.26 days), which exceeds the 5-day requirement. AWS Snowball Edge is the most cost-effective solution because it bypasses the network bottleneck entirely by physically shipping the data, and it is designed for large-scale data transfers where network constraints make online transfer impractical.

Answer

Use S3 Transfer Acceleration to speed up the transfer over the internet.

Answer

Use AWS DataSync over the internet to transfer the data.

Answer

Set up an AWS Direct Connect connection to increase bandwidth.

Question 15

A company uses AWS Glue to process data from Amazon S3. The Glue job fails with a 'SchemaDetectionException'. The data engineer wants to ensure the schema is correctly inferred. Which TWO actions should the engineer take? (Choose two.)

Accepted Answer

Use the Glue Data Catalog as the source for schema definition.. The correct answers are A and E. Option A uses the Glue Data Catalog as the source for schema definition, providing a consistent schema and avoiding schema detection failures. Option E sets the 'groupFiles' option to 'inPartition', which helps Glue combine small files within a partition for schema inference, reducing 'SchemaDetectionException' errors. Option B is incorrect because adding a column with a default value does not affect schema detection. Option C is incorrect because increasing DPUs only improves processing speed, not schema inference. Option D is incorrect because converting to Parquet may change the schema but does not directly address schema detection issues.

Answer

Add a column with a default value to the data.

Answer

Increase the number of Glue DPUs to speed up processing.

Answer

Convert all input files to Parquet format.

Question 16

A company uses AWS Lake Formation to manage data lake permissions. A data analyst is unable to query a table in the data lake using Amazon Athena. The table is registered in Lake Formation, and the analyst has SELECT permission granted via Lake Formation. What is the most likely reason for the failure?

Accepted Answer

The IAM role used by Athena does not have necessary Lake Formation permissions. Lake Formation integrates with Athena, and the IAM role assumed by Athena must have necessary Lake Formation permissions (e.g., SELECT on the table) to query the data. Option A is incorrect because encryption in transit is about data protection during transmission, not access control; it does not prevent querying. Option C is incorrect because when using Lake Formation, S3 bucket policies are not the primary mechanism for granting access; Lake Formation manages permissions, and the bucket policy typically allows the Lake Formation service role, not the analyst's role. Option D is incorrect because the table is registered in Lake Formation, which requires it to be in the AWS Glue Data Catalog; so this is not the issue.

Answer

Athena is configured to use encryption in transit

Answer

The S3 bucket policy does not grant access to the analyst's IAM role

Answer

The table is not registered in the AWS Glue Data Catalog

Question 17

A company is using Amazon Athena to query data stored in S3. Queries are failing with 'HIVE_INVALID_PARTITION' errors. What is the most likely cause?

Accepted Answer

A partition folder in S3 has been deleted or moved, but the table metadata still references it.. The 'HIVE_INVALID_PARTITION' error in Amazon Athena occurs when the table's partition metadata in the AWS Glue Data Catalog (or Hive metastore) references a partition folder that no longer exists in the S3 bucket. Athena relies on the metadata to locate data files; if a partition folder is deleted or moved without updating the metadata, queries fail because Athena cannot find the expected data location.

Answer

The S3 bucket is configured with a bucket policy that denies access to the Athena service.

Answer

The data is compressed with gzip, but the table definition expects uncompressed data.

Answer

The data files are in CSV format but the table definition expects Parquet.

Question 18

A data engineer is troubleshooting an AWS Glue job that writes data to an S3 bucket. The IAM role attached to the Glue job has the policy shown in the exhibit. The job fails when writing to the 'secrets/' prefix but succeeds when writing to other prefixes. What is the reason for the failure?

Accepted Answer

The Deny statement explicitly denies PutObject to the secrets/ prefix.. The Deny statement explicitly denies s3:PutObject to the secrets/ prefix, which overrides any Allow statements. Option A is incorrect because the job can write to other prefixes, so it does have permission to the bucket. Option B is incorrect because the resource ARN includes the bucket and all objects (*), so it is sufficient. Option C is incorrect because in IAM, a Deny statement always overrides an Allow, regardless of order.

Answer

The job does not have permission to write to the bucket at all.

Answer

The resource ARN in the Allow statement does not include the bucket itself.

Answer

The Deny statement is not effective because it is placed after the Allow.

Question 19

A company wants to ingest data from multiple SaaS applications into Amazon S3 using a fully managed service that supports schema discovery and transformation. Which AWS service should they use?

Accepted Answer

Amazon AppFlow. Amazon AppFlow is a fully managed integration service that supports SaaS sources, schema discovery, and data transformation. Option A (Amazon Kinesis Data Firehose) is for streaming data but not for SaaS ingestion directly. Option C (AWS Glue) is an ETL service but not for SaaS ingestion directly. Option D (AWS Data Pipeline) is not fully managed for SaaS.

Answer

Amazon Kinesis Data Firehose

Answer

AWS Glue

Answer

AWS Data Pipeline

Question 20

A company uses S3 as a data lake. They want to ingest on-premises relational database data daily with full-load snapshots. The data volume is 500 GB per day. The database is accessible over the internet. Which service should they use for this ingestion?

Accepted Answer

AWS Database Migration Service (DMS). AWS Database Migration Service (DMS) can perform full-load migrations from on-premises databases to S3, making it ideal for daily snapshots of 500 GB. Option A is wrong because Kinesis Data Firehose is designed for streaming data, not for periodic database snapshots. Option B is wrong because while AWS Glue ETL can read from JDBC, it is not optimized for large full-load snapshots and lacks built-in replication capabilities. Option D is wrong because AWS Transfer Family is for file transfers over SFTP, FTPS, or FTP, not for direct database connections.

Answer

Kinesis Data Firehose

Answer

AWS Glue ETL job reading from JDBC

Answer

AWS Transfer Family