DEA-C01 Mock Exam 88 — 25 Questions

Question 1

Refer to the exhibit. A data engineer runs a CLI command to decrypt a file and receives an access denied error. The IAM user 'DataEngineer' has the following policy attached:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "kms:Decrypt",
      "Resource": "*"
    }
  ]
}

What is the most likely cause of the error?

Accepted Answer

The key policy does not grant the IAM user permission to decrypt.. Even though the IAM policy grants kms:Decrypt on all resources, the key policy is a separate access control mechanism. The error indicates that the key policy does not include the IAM user as a principal allowed to decrypt. Therefore, option B is correct. Option A is incorrect because missing the --encryption-context parameter would cause a different error, not an access denied. Option C is incorrect because AWS managed keys can be used for decryption if the key policy grants permission; the key type is not the issue. Option D is incorrect because the IAM policy does allow kms:Decrypt on all keys; the problem is the key policy, not the IAM policy.

Answer

The CLI command is missing the --encryption-context parameter.

Answer

The key is an AWS managed key and cannot be used for decryption.

Answer

The IAM policy does not allow kms:Decrypt on the specific key.

Question 2

A company uses Amazon Redshift for its data warehouse. The data engineering team notices that queries against a large fact table are slow. The table is distributed using DISTSTYLE EVEN and has multiple sort keys. After analyzing the query plans, they find that most queries filter on a specific column, 'customer_id'. Which change would most likely improve query performance for these filter operations?

Accepted Answer

Change to DISTSTYLE KEY on the 'customer_id' column.. Changing to DISTSTYLE KEY on 'customer_id' ensures that rows with the same customer_id are co-located on the same node slice. This allows the Redshift query engine to perform filter operations on a single slice rather than scanning all slices, dramatically reducing data movement and improving query performance for queries that filter on that column.

Answer

Add a secondary sort key on 'customer_id'.

Answer

Change to DISTSTYLE EVEN with a different sort key.

Answer

Change to DISTSTYLE ALL for the fact table.

Question 3

A data engineer notices that an Amazon Redshift cluster’s storage usage is increasing rapidly due to many UPDATE and DELETE operations. The engineer needs to reclaim storage space and improve query performance. Which action should be taken?

Accepted Answer

Run VACUUM command. The VACUUM command in Amazon Redshift reclaims disk space occupied by deleted or updated rows and re-sorts the data according to the table's sort keys. This directly addresses the storage increase from UPDATE/DELETE operations and improves query performance by restoring the physical order of rows, which reduces the number of blocks scanned.

Answer

UNLOAD the table to S3 and reload

Answer

Increase cluster node count

Answer

Run ANALYZE command

Question 4

A company runs a Redshift cluster and notices that query performance has degraded over time. The data engineer suspects that table statistics are stale. What should the engineer do to improve query performance?

Accepted Answer

Run the ANALYZE command on the tables. Stale table statistics cause the Redshift query optimizer to generate suboptimal execution plans, leading to degraded query performance. Running the ANALYZE command updates these statistics, allowing the optimizer to make better decisions about join order, distribution, and data scan strategies. This directly addresses the root cause of performance degradation over time.

Answer

Rebuild the tables by using CREATE TABLE AS

Answer

Increase the number of slices in the cluster

Answer

Run the VACUUM command on the tables

Question 5

A company runs a daily batch ETL job using AWS Glue. The job processes 500 GB of data from Amazon RDS to Amazon S3. The job currently uses a single DPU and takes 6 hours to complete. The team wants to reduce runtime to under 1 hour without increasing costs significantly. Which approach should they use?

Accepted Answer

Use AWS Glue Spark job with 100 workers.. AWS Glue Spark jobs can parallelize data processing across multiple workers, dramatically reducing runtime. With 100 workers, the job can process the 500 GB dataset in parallel, achieving sub-1-hour runtime while keeping costs relatively low since Glue charges per DPU-second and the total DPU-seconds may be similar to the original 6-hour single-DPU job.

Answer

Change the job type from Python to Spark.

Answer

Use multiple Glue jobs triggered sequentially.

Answer

Increase the RDS instance size to improve read throughput.

Question 6

A company is using AWS Database Migration Service (DMS) to migrate a 2 TB Oracle database to Amazon Aurora PostgreSQL. The migration must have minimal downtime. The source database is highly active with continuous writes. Which DMS migration type and additional configuration should the engineer use?

Accepted Answer

Use a full load migration task followed by ongoing replication (CDC).. A full load migration followed by ongoing replication (CDC) allows the initial data copy to complete while continuously capturing and applying incremental changes from the highly active source. This minimizes downtime by keeping the target database nearly synchronized, requiring only a brief cutover window to stop writes and finalize replication.

Answer

Use a CDC-only migration task to capture changes from the source.

Answer

Use a full load migration task and stop the source database before starting.

Answer

Use a full load migration task with task restart enabled.

Question 7

A company needs to migrate an on-premises 10 TB PostgreSQL database to Amazon RDS for PostgreSQL with minimal downtime. Which AWS service should be used for the migration?

Accepted Answer

AWS Database Migration Service (DMS). AWS Database Migration Service (DMS) is the correct choice because it is specifically designed for migrating databases to AWS with minimal downtime. It supports continuous replication from an on-premises PostgreSQL source to Amazon RDS for PostgreSQL using change data capture (CDC), allowing the source database to remain operational during the migration.

Answer

AWS Storage Gateway

Answer

AWS Snowball Edge

Answer

AWS DataSync

Question 8

A company uses Amazon S3 to store raw data and AWS Lambda to process files as they arrive. The Lambda function sometimes times out when processing large files. The team wants to improve reliability and scalability. Which approach should the team take?

Accepted Answer

Use Amazon S3 event notifications to send events to an Amazon SQS queue, and then have Lambda poll the queue in batches.. Using S3 event notifications to send events to an SQS queue decouples the file upload from processing. Lambda can then poll the queue in batches, processing multiple events per invocation. This improves reliability by allowing retries and scalability by handling spikes in file arrivals without timing out. Option A is incorrect because AWS Batch is designed for long-running batch jobs, not event-driven processing triggered by S3 events. Option B is incorrect because SNS is push-based and can still overwhelm Lambda, leading to timeouts. Option C is incorrect because increasing Lambda timeout and memory only postpones the problem without addressing the root cause of scaling and reliability.

Answer

Replace Lambda with AWS Batch and use S3 event notifications to trigger the batch job.

Answer

Use Amazon S3 event notifications to send events to an Amazon SNS topic, which triggers Lambda.

Answer

Increase the Lambda function timeout to 15 minutes and memory to 3 GB.

Question 9

A company needs to ingest data from multiple SaaS sources (e.g., Salesforce, Marketo) into Amazon S3 for analytics. Which AWS service is designed for this purpose?

Accepted Answer

Amazon AppFlow. Amazon AppFlow is a fully managed integration service specifically designed to securely transfer data between SaaS applications (like Salesforce, Marketo, Slack, and Zendesk) and AWS services such as Amazon S3 and Amazon Redshift. It supports scheduled, event-driven, or on-demand data ingestion with built-in transformations, filtering, and validation, making it the ideal choice for this use case.

Answer

AWS Transfer Family

Answer

AWS Glue

Answer

AWS DataSync

Question 10

A financial services company uses AWS Glue ETL jobs to process sensitive customer data stored in Amazon S3. The data is encrypted at rest with SSE-KMS using a customer-managed key. Recently, the security team discovered that the Glue job's IAM role has an overly permissive policy that allows the 'kms:Decrypt' action for all KMS keys in the account. The company wants to follow the principle of least privilege. The Glue job runs on a schedule and reads from a specific S3 bucket. The security team needs to update the IAM policy to restrict KMS decryption to only the specific key used for that bucket. What should they do?

Accepted Answer

Update the policy to allow 'kms:Decrypt' only for the specific KMS key ARN used by the S3 bucket containing the customer data.. To follow least privilege, the IAM role for the Glue job should only have access to decrypt using the specific KMS key that encrypts the S3 bucket containing the customer data. This is done by allowing 'kms:Decrypt' with a resource set to the exact ARN of that key, not a wildcard or all keys. Option A is incorrect because using a wildcard in the key ARN (key/*) still grants access to all keys under that key hierarchy, which is overly permissive. Option B is incorrect because allowing 'kms:Decrypt' with resource '*' would grant access to all keys in the account, violating least privilege. Option D is incorrect because removing 'kms:Decrypt' from the IAM policy would prevent the Glue job from decrypting the data; the job's IAM role needs the permission, and relying solely on S3 bucket policies cannot grant decryption permissions cross-account or for IAM roles.

Answer

Update the policy to allow 'kms:Decrypt' with a resource of 'arn:aws:kms:us-east-1:123456789012:key/*' to cover all keys in the account.

Answer

Update the policy to allow 'kms:Decrypt' with a resource of '*' to ensure the job can always decrypt data.

Answer

Remove the 'kms:Decrypt' action from the policy and rely on S3 bucket policies to grant decryption permissions.

Question 11

A data engineer needs to store semi-structured JSON data from IoT devices. The data is written frequently and read occasionally. Which AWS service is MOST cost-effective for this use case?

Accepted Answer

Amazon DynamoDB. Amazon DynamoDB is the most cost-effective choice because it is a fully managed NoSQL key-value and document database that natively supports semi-structured JSON data, offers single-digit millisecond latency for frequent writes, and provides a pay-per-request pricing model ideal for workloads with occasional reads. Its on-demand capacity mode automatically scales to handle high write throughput without provisioning, making it cheaper than provisioned alternatives for spiky or unpredictable IoT ingestion patterns.

Answer

Amazon ElastiCache for Redis

Answer

Amazon RDS for MySQL

Answer

Amazon Redshift

Question 12

A company runs a critical application on Amazon RDS for MySQL. To ensure high availability and automatic failover, the database is deployed as a Multi-AZ DB instance. The application uses read-heavy workloads. Which additional configuration should be used to offload read traffic without impacting write performance?

Accepted Answer

Create one or more Read Replicas in different AZs.. Amazon RDS Read Replicas are designed to offload read traffic from the primary DB instance without affecting write performance. Unlike the Multi-AZ standby instance, which is not accessible for reads, Read Replicas can be placed in different Availability Zones and serve read queries independently, improving read scalability while the primary handles writes.

Answer

Use the Multi-AZ standby instance for read queries.

Answer

Use Amazon ElastiCache to cache read queries.

Answer

Change to a Single-AZ deployment with a larger instance size.

Question 13

A startup is building a ride-sharing application that uses Amazon DynamoDB to store trip data. The table has a partition key of 'trip_id' and a sort key of 'status'. The application writes a new item when a trip starts and updates the status when the trip ends. The development team is experiencing high write latency during peak hours. The table is provisioned with 5,000 write capacity units (WCU) and 5,000 read capacity units (RCU). CloudWatch metrics show that WriteThrottleEvents are occurring frequently, but the consumed write capacity is never above 4,000 WCU. The team suspects that the issue is due to hot partitions. How should the data engineer resolve this issue?

Accepted Answer

Modify the application to add a random suffix to the partition key when writing items.. Adding a random suffix to the partition key distributes writes across multiple partitions, preventing any single partition from becoming a hot spot and causing throttling. Option B is incorrect because DAX is an in-memory cache that speeds up reads, not writes; it does not address write throttling. Option C is incorrect because decreasing RCU does not affect write performance; write throttling is independent of read capacity. Option D is incorrect because increasing WCU does not solve hot partition issues; throttling occurs at the partition level, and a single partition can only handle up to 1000 WCU per partition. Thus, distributing writes is the appropriate solution.

Answer

Enable DynamoDB Accelerator (DAX) to cache write operations.

Answer

Decrease the provisioned RCU to 2,000 to reduce costs.

Answer

Increase the provisioned WCU to 10,000 to handle the spikes.

Question 14

A data engineer is designing a multi-region disaster recovery solution for Amazon RDS for PostgreSQL. The primary region must have a standby in a different Availability Zone, and the secondary region must have a readable replica that can be promoted in case of failure. Which configuration meets these requirements?

Accepted Answer

Enable Multi-AZ in the primary region and create a cross-region read replica. It meets both requirements: Multi-AZ in the primary region provides a synchronous standby in a different Availability Zone for high availability, and a cross-region read replica in the secondary region provides an asynchronous, readable copy that can be promoted to a standalone primary during a regional failure. This combination ensures both intra-region fault tolerance and inter-region disaster recovery.

Answer

Use a single-AZ primary and enable automatic backups

Answer

Use a single-AZ primary and create a cross-region read replica

Answer

Enable Multi-AZ in both primary and secondary regions

Question 15

Refer to the exhibit. The exhibit shows output from AWS CLI commands. Which key can be used to enable automatic annual rotation?

Accepted Answer

The first key (1234abcd-...). (the first key) is correct because automatic annual rotation is only configurable for customer managed keys. The first key is customer managed, allowing the user to enable or disable automatic rotation with a specified frequency (e.g., annually). The second key is AWS managed, which rotates automatically every three years without user configuration, so its rotation cannot be enabled or disabled by the user. Options A and B are incorrect because the second key (AWS managed) does not support user-controlled automatic rotation, and both keys cannot have rotation configured independently. Option C is incorrect because the first key (customer managed) does support automatic annual rotation.

Answer

The second key (5678efgh-...)

Answer

Both keys

Answer

Neither key

Question 16

A data engineer is designing a data lake on Amazon S3. The data includes personally identifiable information (PII) that must be encrypted at rest. Which encryption option provides the most control over encryption keys?

Accepted Answer

Server-side encryption with AWS KMS managed keys (SSE-KMS).. SSE-KMS allows you to use AWS Key Management Service (KMS) to manage your encryption keys, providing you with control over key rotation, access policies, and auditing via AWS CloudTrail. This offers more control than SSE-S3 (where AWS manages the keys entirely) and more flexibility than SSE-C (where you manage the keys yourself but lose AWS-managed key rotation and auditing). Client-side encryption (Option A) gives you control but requires you to manage the encryption process and keys outside of S3, which is not a server-side encryption option and adds complexity.

Answer

Client-side encryption using Amazon S3 Encryption Client.

Answer

Server-side encryption with S3 managed keys (SSE-S3).

Answer

Server-side encryption with customer-provided keys (SSE-C).

Question 17

Refer to the exhibit. A data engineer has attached this IAM policy to a user. The user reports being unable to upload files to my-bucket from an on-premises network with a public IP of 203.0.113.5. What is the issue?

Accepted Answer

The user's IP address is not within the allowed IP range. The IAM policy includes a condition that restricts access to requests originating from the IP range 10.0.0.0/16 (a private range). The user's on-premises network has a public IP of 203.0.113.5, which is not within that range, so the condition fails and the upload is denied. Option A is incorrect because the resource ARN does include the bucket itself (arn:aws:s3:::my-bucket/*), so that is not the issue. Option C is incorrect because the policy explicitly allows s3:PutObject. Option D is incorrect because there is no condition requiring server-side encryption.

Answer

The resource ARN does not include the bucket itself

Answer

The user does not have s3:PutObject permission

Answer

The bucket requires server-side encryption

Question 18

A data engineer is designing a data lake on Amazon S3. The data includes personally identifiable information (PII) that must be encrypted at rest. Which combination of actions meets the encryption requirement with the least operational overhead?

Accepted Answer

Enable default encryption on the S3 bucket using SSE-S3. Enabling default encryption on the S3 bucket with SSE-S3 automatically encrypts all objects at rest using AES-256, managed entirely by AWS. This requires no additional configuration or key management, providing the least operational overhead while meeting the encryption requirement for PII.

Answer

Apply a bucket policy that denies access to unencrypted requests

Answer

Use client-side encryption with AWS KMS

Answer

Use server-side encryption with AWS KMS (SSE-KMS)

Question 19

A data engineer has an IAM policy attached to an IAM role used by an AWS Glue job. The Glue job needs to read from S3 bucket 'data-bucket' and write to the same bucket. The job fails with an access denied error when trying to write to S3. What is the issue?

Accepted Answer

The policy does not include s3:ListBucket permission, which Glue may need.. AWS Glue jobs require the `s3:ListBucket` permission on the bucket to perform operations like listing objects, even when reading and writing specific keys. Without this permission, the job fails with an access denied error when trying to write, as Glue internally uses `ListBucket` to verify bucket existence and access patterns. The policy attached to the IAM role likely includes `s3:GetObject` and `s3:PutObject` but omits the bucket-level `s3:ListBucket` action, which is necessary for the Glue job to interact with S3 successfully.

Answer

The Glue job cannot assume the IAM role because of trust policy.

Answer

The resource ARN for S3 is missing the bucket-level permission.

Answer

The actions for S3 are incorrect; s3:PutObject is not sufficient.

Question 20

A company is migrating an on-premises Hadoop cluster to AWS. The data is stored in HDFS and needs to be accessible by both Amazon EMR and Amazon Redshift Spectrum. Which storage solution is most cost-effective and scalable?

Accepted Answer

Amazon Simple Storage Service (S3). Amazon S3 is the most cost-effective and scalable storage solution for this use case because it provides native integration with both Amazon EMR (via S3A connector or EMRFS) and Amazon Redshift Spectrum (via external tables). Unlike HDFS, S3 decouples compute from storage, allowing you to pay only for the data stored and the compute resources used, with virtually unlimited scalability and 99.999999999% durability.

Answer

Amazon FSx for HDFS

Answer

Amazon Elastic Block Store (EBS)

Answer

Amazon Elastic File System (EFS)