DEA-C01 Mock Exam 83 — 25 Questions

Question 1

A company is designing a data lake on AWS using S3. The security team requires that all data be encrypted at rest and that encryption keys be rotated annually. Which services can be used to meet these requirements? (Choose TWO.)

Accepted Answer

AWS Key Management Service (AWS KMS). Option A and D are correct. SSE-S3 provides encryption at rest with Amazon-managed keys that are rotated automatically. AWS KMS allows customer-managed keys with manual rotation or automatic yearly rotation. Option B is wrong because CloudHSM provides hardware security modules but is not directly integrated with S3 for automatic key rotation. Option C is wrong because ACM is for TLS certificates. Option E is wrong because Secrets Manager is for secrets, not encryption keys.

Answer

AWS Secrets Manager

Answer

AWS Certificate Manager (ACM)

Answer

AWS CloudHSM

Question 2

A financial services company uses a multi-account AWS Organization with hundreds of accounts. The data engineering team needs to enable cross-account access to an encrypted S3 bucket in the data lake account (account ID 111111111111) for a Glue ETL job running in the analytics account (account ID 222222222222). The S3 bucket uses AWS KMS customer managed key (CMK) for server-side encryption (SSE-KMS). The Glue job fails with an AccessDenied error when trying to read data from the bucket. The IAM roles in both accounts have the necessary S3 permissions and the bucket policy allows access from the analytics account. What is the most likely cause of the failure?

Accepted Answer

The KMS key policy does not grant the analytics account's IAM role permission to use the key for decryption.. The Glue job fails because the KMS key policy does not grant the analytics account's IAM role permission to use the key for decryption. S3 permissions alone are insufficient when SSE-KMS is used; the key policy must explicitly allow the decrypt action for the cross-account principal.

Answer

The S3 bucket is in a different region than the Glue job.

Answer

The Glue job does not have an IAM role assigned.

Answer

The S3 bucket policy does not allow the s3:GetObject action for the analytics account's IAM role.

Question 3

A company uses Amazon Redshift for data warehousing. The security team requires that data be encrypted at rest using a customer-managed key (CMK) in AWS KMS, and that the key be rotated automatically every year. Additionally, the team wants to restrict access to the key to only the Redshift cluster and a security admin IAM role. Which steps should the company take? (Choose THREE.)

Accepted Answer

Add the security admin IAM role as a key user in the KMS key policy.. Options A, C, and E are correct. Option A enables encryption with a CMK. Option C enables automatic yearly rotation. Option E adds the security admin to the key policy. Option B is wrong because enabling encryption on an existing encrypted cluster requires creating a new snapshot and restoring, not just altering. Option D is wrong because disabling rotation prevents automatic rotation.

Answer

Alter the existing Redshift cluster to enable encryption with the CMK.

Answer

Disable automatic key rotation to comply with security policy.

Question 4

A multinational corporation uses AWS Organizations to manage multiple accounts. The data engineering team has a central data lake account that stores all data in S3. The security team requires that all cross-account access to the data lake be logged and that any access from outside the organization be blocked. The team has enabled S3 server access logs and AWS CloudTrail. However, they notice that some requests from an external AWS account are still able to read data from the data lake. The bucket policy currently allows cross-account access to a specific partner account for data exchange. What additional step should the team take to block access from all other external accounts?

Accepted Answer

Add a Deny statement to the bucket policy that denies access to any principal not in the organization or the partner account.. Option C is correct. To block access from all external accounts except the allowed partner, you can add a Deny statement with a condition that checks if the account is not in the organization and not the partner account. Option A is wrong because disabling cross-account access would block the partner. Option B is wrong because the bucket policy already allows the partner. Option D is wrong because S3 Access Points do not inherently block external accounts unless explicitly configured.

Answer

Add a condition to the existing Allow statement to require that the source account be in the organization.

Answer

Remove the cross-account access statement from the bucket policy.

Answer

Use S3 Access Points to restrict access to only the partner account.

Question 5

A data engineering team needs to transform CSV files stored in Amazon S3 into Parquet format using AWS Glue. The files are partitioned by date and are updated hourly. Which AWS Glue feature should be used to automatically detect the schema and partition structure?

Accepted Answer

AWS Glue Crawler. AWS Glue Crawler is the correct choice because it automatically scans data in S3, infers the schema (including data types), and detects the partition structure (e.g., date-based partitions like year/month/day) by examining the folder hierarchy. It then populates the AWS Glue Data Catalog with metadata, enabling ETL jobs to read the data without manual schema definition.

Answer

AWS Glue DataBrew

Answer

AWS Lake Formation

Answer

Amazon Athena

Question 6

A company needs to store log files from multiple applications in a centralized location. The logs are written once and accessed rarely after 30 days. The company must retain logs for 5 years. Which TWO actions meet these requirements cost-effectively?

Accepted Answer

Configure a lifecycle policy to transition objects to S3 Glacier Deep Archive after 30 days. Option A is correct because S3 Glacier Deep Archive is the lowest-cost storage class for data that is accessed rarely, with retrieval times of 12 hours or more, making it ideal for logs that are rarely accessed after 30 days. A lifecycle policy transitions objects from a higher-cost class (e.g., S3 Standard) to S3 Glacier Deep Archive after 30 days, meeting the 5-year retention requirement cost-effectively.

Answer

Configure a lifecycle policy to transition objects to S3 Glacier Flexible Retrieval after 30 days

Answer

Use S3 One Zone-IA for the first 30 days, then delete

Answer

Store all logs in S3 Standard

Question 7

A data engineer applies the bucket policy shown in the exhibit to an S3 bucket. The bucket contains sensitive data that must be encrypted at rest and accessed only over HTTPS. Which of the following statements is true?

Accepted Answer

The policy enforces that all PutObject requests must include the x-amz-server-side-encryption header with value AES256.. Option C is correct because the bucket policy includes a condition that denies PutObject requests unless the `s3:x-amz-server-side-encryption` header is present and set to `AES256`. This enforces server-side encryption with S3-managed keys (SSE-S3) for all uploads, ensuring data at rest is encrypted.

Answer

The policy allows both HTTP and HTTPS access.

Answer

The policy allows anonymous access to list objects in the bucket.

Answer

The policy requires the use of AWS KMS for server-side encryption.

Question 8

A company is using Amazon EMR to process data stored in Amazon S3. The S3 bucket is configured with a bucket policy that denies access unless the request includes a specific tag. The EMR cluster's IAM role has s3:GetObject permission. However, the EMR job fails to read data from S3. What is the most likely cause?

Accepted Answer

The IAM role does not have a condition that matches the required tag.. The bucket policy denies access unless the request includes a specific tag. Even though the EMR cluster's IAM role has s3:GetObject permission, the IAM role does not have a condition key (e.g., aws:RequestTag) that matches the required tag. Therefore, the request is denied by the bucket policy, causing the EMR job to fail.

Answer

The bucket policy is not attached to the EMR role.

Answer

The EMR cluster is not in the same account as the S3 bucket.

Answer

The EMR role does not have s3:GetObject permission.

Question 9

A company runs a real-time analytics platform using Amazon Kinesis Data Streams with a shard count of 10. The data is consumed by an AWS Lambda function that writes to an Amazon DynamoDB table. The DynamoDB table has a partition key of 'user_id' and a sort key of 'timestamp'. The table is provisioned with 5000 RCUs and 5000 WCUs. Recently, the application experienced increased write latency and throttling errors (ProvisionedThroughputExceededException) on the DynamoDB table. The CloudWatch metrics show that ConsumedWriteCapacityUnits averages 4500 with occasional spikes to 6000. The Lambda function’s concurrency is set to 1000. The data engineer suspects the issue is due to hot partitions. Upon investigation, the engineer finds that a small number of users generate a disproportionately large amount of data. Which course of action would best resolve the throttling while minimizing cost?

Accepted Answer

Enable DynamoDB adaptive capacity and implement write sharding by adding a suffix to the partition key for high-volume users. Option A is correct because the root cause is hot partitions caused by a small number of high-volume users. Enabling DynamoDB adaptive capacity allows the table to automatically adjust throughput to accommodate uneven access patterns, but the key fix is write sharding — adding a random or calculated suffix to the partition key for those high-volume users. This distributes writes across multiple physical partitions, eliminating the hot spot without requiring a global increase in provisioned capacity, thus resolving throttling while minimizing cost.

Answer

Increase the provisioned WCUs to 10000 to handle spikes

Answer

Switch the DynamoDB table to on-demand capacity mode

Answer

Reduce the Lambda function concurrency to 100 to limit write requests

Question 10

A company is ingesting real-time clickstream data into Amazon S3 using Amazon Kinesis Data Firehose. The data is semi-structured and the company wants to transform the data into Parquet format and partition it by year, month, day, and hour. Which TWO steps should be taken to achieve this? (Choose TWO.)

Accepted Answer

Enable dynamic partitioning in Kinesis Data Firehose and specify the partition keys as year, month, day, hour extracted from the data.. Option B is correct because Kinesis Data Firehose's dynamic partitioning feature allows you to specify partition keys (year, month, day, hour) extracted from the incoming data, and Firehose will automatically create the corresponding S3 prefix structure (e.g., year=2024/month=01/day=15/hour=10/) during delivery. Option D is correct because to convert semi-structured data to Parquet format, you can attach an AWS Lambda function as a data transformation to Firehose, which converts each record to Parquet before delivery to S3.

Answer

Set up an Amazon S3 event notification to trigger an AWS Lambda function that partitions the data after delivery.

Answer

Use an AWS Glue Crawler to infer the schema and automatically partition the data in S3.

Answer

Configure Kinesis Data Firehose to convert the data to Parquet format using a schema from the AWS Glue Data Catalog.

Question 11

Refer to the exhibit. A data engineer is troubleshooting a permissions issue. The IAM role 'DataEngineerRole' is used by an AWS Glue job that needs to read data from an S3 bucket encrypted with a customer managed KMS key. The above key policy is attached to the KMS key. The Glue job fails with an AccessDenied error when trying to read the data. What is the MOST likely cause?

Accepted Answer

The key policy condition 'kms:ViaService' restricts KMS actions to only when they are made through S3, but AWS Glue calls KMS directly, not via S3.. The key policy includes a condition `kms:ViaService` that restricts KMS actions to only when they are made through the S3 service. However, AWS Glue does not call KMS via S3; it calls KMS directly to decrypt the S3 object's data key. Because the Glue job's KMS request does not originate from the S3 service, the condition fails, resulting in an AccessDenied error.

Answer

The key policy requires requests to originate from a VPC endpoint, but the Glue job is not using one.

Answer

The key policy denies requests that are not using HTTPS, but the Glue job is using HTTPS.

Answer

The Glue job is running in a different AWS region than the S3 bucket.

Question 12

A company uses DynamoDB with provisioned capacity and experiences throttling on a table during peak hours. The data engineer notices that the table has a partition key with high cardinality and the workload is read-heavy. Which action would best resolve the throttling?

Accepted Answer

Enable DynamoDB Auto Scaling for the table.. DynamoDB Auto Scaling adjusts the provisioned read capacity units (RCUs) based on actual traffic patterns, preventing throttling during peak hours without manual intervention. Since the table has high-cardinality partition keys and is read-heavy, throttling is likely due to insufficient RCUs, which Auto Scaling dynamically increases to match demand.

Answer

Switch the table to on-demand capacity mode.

Answer

Increase the provisioned write capacity units.

Answer

Add a global secondary index (GSI) to distribute reads.

Question 13

Refer to the exhibit. A security analyst is reviewing CloudTrail logs and notices a PutObject event to the 'company-data-lake' bucket. The bucket policy requires all objects to be encrypted with SSE-KMS. What should the analyst conclude?

Accepted Answer

The object was encrypted with SSE-S3, which violates the bucket policy.. The bucket policy requires all objects to be encrypted with SSE-KMS. The CloudTrail log shows a PutObject event, but the encryption context (not shown in the exhibit) would indicate the encryption method used. Since the correct answer states the object was encrypted with SSE-S3, this violates the bucket policy, which mandates SSE-KMS. Therefore, the analyst should conclude that the request succeeded but violated the policy, as SSE-S3 does not meet the requirement.

Answer

The object was uploaded by the bucket owner, bypassing the policy.

Answer

The request succeeded because SSE-S3 is acceptable.

Answer

The object was encrypted with SSE-KMS as required.

Question 14

Refer to the exhibit. A data engineer is running an AWS Glue job that reads from an S3 bucket encrypted with a customer-managed KMS key. The job fails with the error shown. What is the most likely cause?

Accepted Answer

The IAM role used by the Glue job is missing the kms:Decrypt permission.. The error indicates that the AWS Glue job cannot access the S3 bucket because it lacks the necessary KMS permissions. Since the bucket is encrypted with a customer-managed KMS key, the IAM role assigned to the Glue job must include the kms:Decrypt permission to read the encrypted objects. Without this permission, the job fails when attempting to decrypt the data.

Answer

The S3 bucket policy denies the kms:Decrypt action.

Answer

The Glue job does not have permission to call kms:GenerateDataKey.

Answer

The KMS key policy does not grant the Glue service principal access.

Question 15

A data engineer ran the above CLI command to describe an Amazon DynamoDB table named 'Orders'. The table has a key schema with 'OrderID' as the partition key and 'CustomerID' as the sort key. The table currently has no items. The engineer wants to add a new attribute 'OrderDate' and then query all orders for a specific customer within a date range. Which of the following actions is the MOST efficient approach to support this query pattern?

Accepted Answer

Create a Global Secondary Index (GSI) with 'CustomerID' as partition key and 'OrderDate' as sort key.. Option D is correct because a Global Secondary Index (GSI) allows querying on a different partition key ('CustomerID') and sort key ('OrderDate') without altering the base table's key schema. This supports efficient range queries on 'OrderDate' for a specific customer, as GSIs provide a separate index with its own provisioned throughput and can be created on existing tables with items. The base table's primary key remains unchanged, and the GSI enables the desired query pattern with low latency.

Answer

Modify the table's primary key to include 'OrderDate' as an additional sort key.

Answer

Use a Scan operation with a filter expression on 'CustomerID' and 'OrderDate' to retrieve the data.

Answer

Create a Local Secondary Index (LSI) with 'CustomerID' as partition key and 'OrderDate' as sort key.

Question 16

A company stores sensitive data in Amazon S3. The security team requires encryption at rest and that the encryption keys are managed by the company using AWS KMS. The data is frequently accessed by multiple AWS services. Which THREE steps should be taken to meet these requirements?

Accepted Answer

Configure the KMS key policy to allow the necessary AWS services to use the key for decryption. Option B is correct because the security team requires that encryption keys be managed by the company using AWS KMS, and that multiple AWS services can access the data. To allow those services to decrypt objects encrypted with a customer-managed KMS key, the KMS key policy must explicitly grant the necessary AWS services (e.g., AWS Lambda, Amazon Athena) permission to use the key for decryption (kms:Decrypt). Without this policy, even if the bucket is configured for SSE-KMS, the services will fail to read the encrypted objects.

Answer

Use client-side encryption with the KMS key before uploading to S3

Answer

Enable default encryption on the S3 bucket using SSE-S3

Question 17

Which TWO data stores are considered fully managed, serverless, and suitable for storing JSON documents?

Accepted Answer

Amazon DocumentDB (with MongoDB compatibility). Amazon DocumentDB (with MongoDB compatibility) is a fully managed, serverless document database that natively stores JSON documents. It supports MongoDB workloads, allowing you to store, query, and index JSON data without managing infrastructure, making it ideal for content management and catalog applications.

Answer

Amazon Redshift

Answer

Amazon ElastiCache for Redis

Answer

Amazon RDS for MySQL

Question 18

Refer to the exhibit. A data engineer needs to connect to the Redshift cluster from an EC2 instance in the same VPC. The engineer can ping the EC2 instance but cannot connect to Redshift using the endpoint address and port 5439. What is the most likely cause?

Accepted Answer

The security group for the Redshift cluster does not allow inbound traffic on port 5439 from the EC2 instance.. The most likely cause is that the security group associated with the Redshift cluster does not have an inbound rule allowing TCP traffic on port 5439 from the security group or IP address of the EC2 instance. Since the engineer can ping the EC2 instance (ICMP works), but cannot connect to Redshift on port 5439, this points to a firewall or security group rule blocking the specific port, not a network reachability issue.

Answer

The Redshift cluster is in a different VPC.

Answer

The Redshift cluster is not in an available state.

Answer

The Redshift cluster is publicly accessible and requires an internet gateway.

Question 19

Refer to the exhibit. A DynamoDB table 'Orders' has a GSI 'CustomerDateIndex'. A developer tries to query the GSI for all orders of a customer between two dates. The query fails. What is the most likely reason?

Accepted Answer

The query uses a date format that is not lexicographically sortable as a string. Option C is correct because DynamoDB's Query operation requires the sort key to be lexicographically sortable when using comparison operators like BETWEEN. If the 'order_date' attribute is stored as a non-lexicographically sortable string format (e.g., 'MM-DD-YYYY' instead of 'YYYY-MM-DD'), the BETWEEN condition will fail to return correct results or may throw an error. The GSI's sort key must be in a format that supports string comparison for range queries to work properly.

Answer

The GSI does not include 'order_id' in the key schema

Answer

The 'customer_id' attribute is not a partition key in the GSI

Answer

The 'order_date' attribute is not a sort key in the GSI

Question 20

A company stores sensitive customer data in Amazon S3. The security team requires that all objects be encrypted at rest using server-side encryption with customer-provided keys (SSE-C). Which bucket policy condition will enforce this requirement?

Accepted Answer

s3:x-amz-server-side-encryption-customer-key. Option C is correct because the condition key `s3:x-amz-server-side-encryption-customer-key` is specifically used to enforce that objects uploaded to S3 must use server-side encryption with customer-provided keys (SSE-C). This condition key checks for the presence of the `x-amz-server-side-encryption-customer-key` header in the request, which is required for SSE-C encryption. Without this header, the request is denied, ensuring all objects are encrypted at rest using customer-provided keys.

Answer

s3:x-amz-server-side-encryption-aws-kms-key-id

Answer

s3:x-amz-server-side-encryption

Answer

s3:x-amz-server-side-encryption-customer-algorithm