DEA-C01 Mock Exam 79 — 25 Questions

Question 1

A data engineer needs to ensure that an Amazon S3 bucket used for sensitive data is encrypted at rest using a customer-managed AWS KMS key. The bucket policy must enforce encryption for all PUT requests. Which policy statement should be added to the bucket policy?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

{"Effect":"Deny","Principal":"*","Action":"s3:PutObject","Resource":"arn:aws:s3:::bucket/*","Condition":{"StringNotEquals":{"s3:x-amz-server-side-encryption":"aws:kms"},"Null":{"s3:x-amz-server-side-encryption-aws-kms-key-id":"true"}}}. It uses a Deny effect with a condition that blocks PUT requests unless the encryption header specifies 'aws:kms' (SSE-KMS) AND the KMS key ID matches the required customer-managed key. The combination of StringNotEquals on the encryption type and Null on the key ID ensures that any request not using the specified KMS key is denied, enforcing both encryption at rest and the use of the customer-managed key.

Answer

{"Effect":"Deny","Principal":"*","Action":"s3:PutObject","Resource":"arn:aws:s3:::bucket/*","Condition":{"Null":{"s3:x-amz-server-side-encryption":"true"}}}

Answer

{"Effect":"Allow","Principal":"*","Action":"s3:PutObject","Resource":"arn:aws:s3:::bucket/*","Condition":{"StringEquals":{"s3:x-amz-server-side-encryption-aws-kms-key-id":"arn:aws:kms:us-east-1:123456789012:key/abc123"}}}

Answer

{"Effect":"Deny","Principal":"*","Action":"s3:PutObject","Resource":"arn:aws:s3:::bucket/*","Condition":{"StringNotEquals":{"s3:x-amz-server-side-encryption-aws-kms-key-id":"arn:aws:kms:us-east-1:123456789012:key/abc123"}}}

Question 2

Refer to the exhibit. An IAM policy is attached to a role used by an AWS Glue job. The job fails with an 'AccessDenied' error when trying to write to 's3://my-bucket/output/'. What is the most likely cause?

Accepted Answer

The resource ARN for S3 should include the bucket itself.. The job fails with 'AccessDenied' when writing to S3. This is most likely because the IAM policy attached to the Glue role does not grant the s3:PutObject permission on the object ARN (e.g., 'arn:aws:s3:::my-bucket/output/*'). Option A points out that the resource ARN should include the bucket itself, which is a common error: if the policy uses the bucket ARN (without the /* suffix) for the PutObject action, it will not allow the write operation. Option C is incorrect because s3:ListBucket is not required for the PutObject action; it is needed for listing contents, not for writing. Option B is irrelevant to the S3 write failure. Option D (s3:GetObject) is for reading, not writing.

Answer

The glue:StartJobRun action is not allowed.

Answer

The policy does not grant s3:ListBucket permission.

Answer

The s3:GetObject action is missing.

Question 3

Refer to the exhibit. A data engineer runs the command above. The DataAdminRole is used by an application to decrypt data. The security team wants to ensure that a SecurityAdminRole can revoke the grant. What must be done to allow the SecurityAdminRole to retire the grant?

Accepted Answer

No action needed; the SecurityAdminRole can retire the grant. The grant's RetiringPrincipal field is already set to SecurityAdminRole, so no additional action is needed. Option A is incorrect because setting the RetiringPrincipal to the root user would not grant SecurityAdminRole the ability to retire. Option B is incorrect because a Revoke grant is not required; retire is handled by the RetiringPrincipal. Option D is incorrect because creating a new grant is unnecessary when the existing grant already has the correct RetiringPrincipal.

Answer

Set the RetiringPrincipal to the root user

Answer

Add a grant with Revoke operation for the SecurityAdminRole

Answer

Create a new grant with SecurityAdminRole as GranteePrincipal

Question 4

A data engineer is setting up an Amazon Kinesis Data Analytics application to process streaming data from a Kinesis data stream named "input-stream". The application uses a reference data source from an S3 bucket. The engineer has attached the IAM policy shown in the exhibit to the application's IAM role. When starting the application, the engineer receives an 'AccessDeniedException' error. Which additional permission is required?

Accepted Answer

s3:GetObject on the S3 bucket containing the reference data. The Kinesis Data Analytics application needs to read reference data from the S3 bucket, which requires the s3:GetObject permission on the bucket and its objects. The error 'AccessDeniedException' indicates the IAM role lacks this specific permission to retrieve the reference data file. Option B correctly adds the missing s3:GetObject action to allow the application to fetch the reference data from S3.

Answer

kinesis:PutRecord on the input stream

Answer

kinesis:CreateStream on the input stream

Answer

kinesis:PutRecords on the input stream

Question 5

A company wants to move data from an Amazon RDS for MySQL database to Amazon Redshift for analytics. The data needs to be refreshed daily. Which AWS service is best suited for this?

Accepted Answer

AWS Glue. (AWS Glue) is correct because it is a fully managed ETL service that can connect to RDS for MySQL as a source and Amazon Redshift as a target, and it supports scheduling for daily refreshes. Option A (AWS DMS) is designed for database migration and continuous replication, not for scheduled batch loads. Option C (Amazon EMR) is for big data processing using Hadoop/Spark, which is overkill for this simple transfer. Option D (Amazon Athena) is an interactive query service for data in Amazon S3, not for moving data between databases.

Answer

AWS Database Migration Service (DMS)

Answer

Amazon EMR

Answer

Amazon Athena

Question 6

A company is designing a data pipeline that ingests data from an on-premises database to Amazon S3. The data contains personally identifiable information (PII) that must be masked before storage. Which AWS service can be used to mask the data in transit?

Accepted Answer

Amazon Kinesis Data Firehose. Amazon Kinesis Data Firehose can invoke an AWS Lambda function to transform and mask data in transit before delivering to Amazon S3. This makes it suitable for masking PII in a streaming pipeline. AWS Glue is designed for batch ETL jobs, not real-time masking during transit. AWS DMS is for database migration, and AWS Data Pipeline orchestrates workflows without native masking capabilities.

Answer

AWS Database Migration Service (DMS)

Answer

AWS Data Pipeline

Answer

AWS Glue

Question 7

A data engineer is setting up a Redshift cluster and needs to ensure high availability. Which TWO actions should be taken?

Accepted Answer

Configure cross-region snapshot copy.. For high availability in Amazon Redshift, you need to protect against data loss and downtime. Option B (configure cross-region snapshot copy) ensures that snapshots are replicated to another region, providing disaster recovery and high availability in case of a regional outage. Option E (deploy a multi-node cluster with at least two compute nodes) provides node-level redundancy; if one node fails, the workload can be redistributed. Option C (enable automatic replication across Availability Zones) is not a feature of Amazon Redshift; Redshift does not support automatic cross-AZ replication for compute nodes. Option A (concurrency scaling) improves query concurrency, not availability. Option D (single-node cluster) offers no redundancy.

Answer

Enable concurrency scaling.

Answer

Enable automatic replication across Availability Zones.

Answer

Use a single-node cluster to reduce complexity.

Question 8

Which THREE factors should a data engineer consider when choosing between Amazon Redshift and Amazon Athena for querying large datasets in Amazon S3? (Choose three.)

Accepted Answer

Redshift requires provisioning and managing clusters, while Athena is serverless.. Amazon Redshift requires manual provisioning, configuration, and ongoing management of clusters, including node sizing, scaling, and maintenance windows. In contrast, Amazon Athena is a serverless service that automatically handles infrastructure, requiring no cluster management and allowing users to query data directly from Amazon S3 without any setup overhead.

Answer

Both support standard SQL queries.

Answer

Athena can only query data stored in Amazon S3, while Redshift can also query data in S3.

Question 9

Which TWO data stores are considered fully managed, serverless, and suitable for storing JSON documents?

Accepted Answer

Amazon DocumentDB (with MongoDB compatibility). Amazon DocumentDB (with MongoDB compatibility) is a fully managed, serverless document database that natively stores JSON documents. It supports MongoDB workloads, allowing you to store, query, and index JSON data without managing infrastructure, making it ideal for content management and catalog applications.

Answer

Amazon Redshift

Answer

Amazon ElastiCache for Redis

Answer

Amazon RDS for MySQL

Question 10

A company uses Amazon Kinesis Data Streams to ingest clickstream data. The data must be transformed and stored in Amazon S3 for batch analytics. The engineer wants to use AWS Lambda for transformation. Which TWO configurations are required? (Choose two.)

Accepted Answer

Create an event source mapping from the Kinesis stream to the Lambda function.. The correct answers are D and E. D: An event source mapping is required for Lambda to poll records from Kinesis. E: Lambda needs an IAM role with permissions to read from Kinesis and write to S3. Option A is incorrect because Lambda does not write to S3 via Firehose; Firehose is a separate service that could directly write to S3, but in this scenario, Lambda is the transformation actor and writes directly to S3. Option B is incorrect because a Kinesis stream cannot send records directly to S3; it needs a consumer or Firehose. Option C is incorrect because Lambda errors can be sent to SQS but it is not required for this setup; the question asks for required configurations.

Answer

Configure the Lambda function to write to S3 via Kinesis Data Firehose.

Answer

Configure the Kinesis stream to send records directly to S3.

Answer

Set up an SQS queue as a destination for Lambda errors.

Question 11

A data engineer is troubleshooting an Amazon Redshift cluster that has experienced a node failure. The engineer needs to ensure that the cluster is highly available and can withstand a single node failure with minimal downtime. Which TWO actions should the engineer take?

Accepted Answer

Enable automated snapshots with cross-region copy.. Options A and E are considered correct for ensuring high availability in Amazon Redshift. Option A: Automated snapshots with cross-region copy enable recovery from a node failure by restoring data from a snapshot in another region, which reduces downtime but does not guarantee zero downtime. Option E: A multi-node cluster with RA3 node types separates compute and storage, allowing faster node replacement and minimizing downtime, though it does not eliminate it entirely. The exam expects these as the best actions among the given choices to improve availability and withstand a single node failure.

Answer

Enable concurrency scaling to handle increased read traffic.

Answer

Deploy the cluster as a single-node cluster for simplicity.

Answer

Place the cluster in a public subnet with an internet gateway.

Question 12

A retail company uses AWS Glue to process daily sales data from multiple CSV files stored in Amazon S3. The Glue job runs a PySpark script that reads the files, performs joins, and writes the output as Parquet. Recently, the job has been failing with 'Out of Memory' errors. The data volume has grown from 10 GB to 50 GB per day. The Glue job uses 10 DPUs and the standard worker type. The data engineer needs to fix the job without rewriting the script. What should the data engineer do?

Accepted Answer

Change the worker type to G.2X to get more memory per worker.. Out of Memory errors in AWS Glue are typically caused by insufficient per-executor memory during operations like joins. Changing the worker type to G.2X doubles the memory per DPU (from 16 GB to 32 GB), directly addressing the OOM issue without rewriting the script. Option D is wrong because increasing the number of DPUs adds more executors but does not increase the memory per executor; it only increases parallelism, which may not resolve OOM if a single executor runs out of memory. Option A (splitting input files) does not reduce the memory footprint of joins. Option C (decreasing DPUs) reduces resources and worsens the problem.

Answer

Split the input CSV files into smaller partitions.

Answer

Decrease the number of DPUs to reduce memory contention.

Answer

Increase the number of DPUs for the Glue job to 20.

Question 13

Refer to the exhibit. A data engineer runs the above AWS CLI command to view the table metadata in the AWS Glue Data Catalog. The data is stored as CSV in S3 with partitions by year and month. When querying the table using Amazon Athena, no data is returned. What is the most likely cause?

Accepted Answer

The partitions have not been added to the Glue Data Catalog.. The AWS CLI command shown only retrieves table metadata, not partition metadata. In AWS Glue, partitions must be explicitly added to the Data Catalog via `MSCK REPAIR TABLE`, `ALTER TABLE ADD PARTITION`, or a Glue crawler. Without partition metadata, Athena cannot locate the data files under the partitioned S3 paths (e.g., `s3://bucket/year=2024/month=01/`), resulting in zero rows returned even though the table schema is defined.

Answer

The SerDe is not compatible with CSV files.

Answer

The S3 location points to a file instead of a folder.

Answer

The column data types are incorrect for the CSV data.

Question 14

A data engineer has set up an Amazon S3 lifecycle policy to transition objects to Glacier Instant Retrieval after 30 days. After 60 days, objects should transition to Deep Archive. However, objects are not transitioning to Deep Archive. What is the most likely cause?

Accepted Answer

Objects are smaller than 128 KB.. Amazon S3 lifecycle policies have a minimum object size requirement for transitions to certain storage classes. Objects must be at least 128 KB to transition to S3 Glacier Instant Retrieval. Since the policy first transitions objects to Glacier Instant Retrieval after 30 days, objects smaller than 128 KB cannot undergo that transition, and subsequent transitions to Deep Archive will also fail. The 30-day minimum interval requirement is met (30 days between transitions), so option D is not the cause. Versioning (A) does not prevent transitions, and Deep Archive (B) is supported in all commercial AWS regions. Therefore, the most likely cause is that objects are smaller than 128 KB.

Answer

The bucket has versioning enabled.

Answer

Deep Archive is not supported in the bucket's region.

Answer

The transition to Deep Archive requires a minimum of 30 days after the previous transition.

Question 15

A data engineer needs to store streaming data from IoT devices for real-time analytics. The data has a fixed schema and requires low-latency queries. Which AWS service should be used?

Accepted Answer

Amazon Timestream. Amazon Timestream is a time-series database purpose-built for IoT and operational applications that generate large volumes of time-stamped data. It automatically manages data retention and storage tiers (memory and magnetic) to provide fast query performance for recent data and cost-effective storage for historical data, making it ideal for real-time analytics on streaming IoT data with a fixed schema.

Answer

Amazon DynamoDB

Answer

Amazon Redshift

Answer

Amazon S3

Question 16

A company uses AWS Glue to catalog data in Amazon S3. The security team requires that all sensitive data be identified and encrypted at rest using customer-managed KMS keys. Which combination of steps should a data engineer take to meet these requirements?

Accepted Answer

Configure AWS Glue to use Detect Sensitive Data and write encrypted output to S3 with SSE-KMS.. AWS Glue provides a 'Detect Sensitive Data' transform (such as FindMatches or custom classifiers) that can be used in a Glue ETL job to identify sensitive data within the catalog. The same ETL job can then write the processed data to Amazon S3 with server-side encryption using customer-managed KMS keys (SSE-KMS), meeting both identification and encryption-at-rest requirements. Option A is incorrect because S3 Access Logs and Athena queries do not directly identify sensitive data patterns reliably, nor do they enforce encryption. Option B is incorrect because Amazon Macie can scan for sensitive data, but it does not automatically apply S3 default encryption; moreover, default encryption uses S3-managed keys, not customer-managed KMS keys. Option C is incorrect because enabling S3 default encryption and using IAM policies addresses encryption and access control but lacks the sensitive data identification step required by the security team.

Answer

Enable S3 Access Logs and use Athena to query the logs for sensitive data patterns.

Answer

Use Amazon Macie to scan the S3 bucket and automatically apply S3 default encryption.

Answer

Enable S3 default encryption for the bucket and use IAM policies to restrict access.

Question 17

A company uses AWS Glue DataBrew to clean and transform data. A data engineer notices that a DataBrew recipe step that should remove duplicates is not working as expected. The dataset has millions of rows. What is the MOST likely reason?

Accepted Answer

The dataset is not sorted by the columns used for deduplication. DataBrew's 'Remove duplicate rows' step identifies duplicates by comparing each row to the previous row in the dataset. If the data is not sorted by the key columns, duplicate rows may not be adjacent and thus will not be removed, causing the step to appear ineffective. Option A: The number of files does not directly affect deduplication logic. Option B: Null values may be treated as distinct, but the most likely issue is lack of sorting. Option D: DataBrew projects can use sampling for preview, but recipes are applied to the full dataset when run, so sampling does not prevent deduplication.

Answer

The data source is an S3 bucket with a large number of files

Answer

The dataset contains null values in the key columns

Answer

The DataBrew project is using a sampling of the data

Question 18

A company is ingesting log files from multiple EC2 instances into Amazon S3 using the CloudWatch agent. The logs are delivered to a CloudWatch Logs group, and a subscription filter sends them to a Lambda function for transformation, then to Firehose. The Firehose stream is configured with a buffer interval of 60 seconds and buffer size of 5 MB. The logs are critical and must be available in S3 within 5 minutes. What is the most cost-effective way to reduce the delivery latency?

Accepted Answer

Decrease the buffer interval to 10 seconds. Decreasing the Firehose buffer interval to 10 seconds directly reduces the maximum time data waits in the buffer before being delivered to S3, ensuring logs reach S3 within the required 5-minute window. Since the current 60-second buffer interval is the primary contributor to latency, lowering it to 10 seconds minimizes delivery delay without incurring additional costs, as Firehose charges are based on data volume, not buffer frequency.

Answer

Replace Firehose with Amazon Kinesis Data Streams

Answer

Increase the buffer size to 10 MB

Answer

Increase the buffer interval to 120 seconds

Question 19

A company uses Amazon DynamoDB to store session data for a web application. The application experiences throttling during peak hours. The data engineer needs to reduce throttling. Which THREE actions should the engineer take?

Accepted Answer

Use DynamoDB Accelerator (DAX) to cache read requests.. DynamoDB Accelerator (DAX) is an in-memory cache that reduces read latency and offloads read requests from the DynamoDB table, directly decreasing the number of read capacity units consumed. By caching frequently accessed session data, DAX mitigates throttling during peak hours without requiring changes to the table's provisioned capacity.

Answer

Increase the provisioned read capacity units.

Answer

Enable auto scaling on the table.

Question 20

A company uses Amazon S3 to store sensitive data. The security team wants to ensure that all objects uploaded to a specific S3 bucket are automatically encrypted at rest using server-side encryption with AWS KMS managed keys (SSE-KMS). Which bucket policy statement should be added to enforce this requirement?

Accepted Answer

Deny put requests where 's3:x-amz-server-side-encryption' is not 'aws:kms'. It denies any S3 PUT request that does not include the `x-amz-server-side-encryption` header set to `aws:kms`, thereby enforcing SSE-KMS encryption for all objects uploaded to the bucket. This bucket policy condition ensures that only requests specifying AWS KMS-managed keys are allowed, meeting the security team's requirement for automatic encryption at rest with SSE-KMS.

Answer

Deny put requests where 's3:x-amz-server-side-encryption' is 'aws:kms'

Answer

Deny put requests where 's3:x-amz-server-side-encryption' is not 'AES256'

Answer

Deny put requests where 's3:x-amz-server-side-encryption' is not set